This is a user login (some session wrapper I managed to put together after a lot of web searching).
It's for a simple CMS I'm trying to build. It only needs one user and there is no need for multiple user log in at the same time. It works, the problem being I think it has safety issues.
It works like this:
- The user accesses CMS index page, and inserts the user and password.
- If one of them does not coincide with the data in the database it does not set the session and triggers a "die" or a error message.
- If the info is ok then it sets the session and redirects the user from the index page to an admin.php page as you can see in the code below.
I commented it quite well. If you see any safety issues please point them out as I can't seem to notice them.
The form is a simple user, password and submit form.
The class:
<?php
class Session{
private static $_user;
private static $_password;
private static $_sessionStart = false;
//here we check if the data inserted by the user in the form coincides with the rows in the db
//if it does it sets the session for the user
public static function CheckLog($received_user,$received_password){
self::$_user = $received_user;
self::$_password = $received_password;
$db = Database::getInstance();
$mysqli = $db->getConnection();
$sql = 'SELECT * FROM utilizatori ';
$sql .= 'WHERE user = "'.self::$_user.'" AND password = "'.self::$_password.'" ';
$result = $mysqli->query($sql) or die (mysqli_error());
if($row = $result->fetch_assoc()){
if(($row['user'] === self::$_user)&&($row['password'] === self::$_password)){
self::set('user',self::$_user);
self::set('key',session_id());
}
}
}
//this method starts the session
public static function start(){
if(self::$_sessionStart == false){
session_start();
self::$_sessionStart = true;
}
}
//this function sets the session values
public static function set($key,$value){
$_SESSION[$key] = $value;
}
public static function get($key){
if(isset($_SESSION[$key])){
return $_SESSION[$key];
}
else{
return false;
}
}
}
//from here is the handeling of the data in the "index" page:
include("class_def/database.inc");
include("class_def/user.inc");
Session::start(); //here we start the session
$up = strip_tags($_POST['user']); //post the user name
$pp = strip_tags($_POST['password']); //post the password
//check if the variables are set and access the CheckLog method
if((isset($up))&&(isset($pp))){
Session::CheckLog($up,$pp);
}
//get the name of the current file
$current_file = basename($_SERVER["SCRIPT_FILENAME"], '.php');
//if the current page is index and the key is set redirect to admin.php
if(isset($_SESSION['key'])){
if($current_file == 'index')
{ echo '
<script type="text/javascript">
<!--
window.location = "admin.php"
//-->
</script>';
}
}
else{ //if the key is not set and the page is any other than index die and display message
if($current_file != 'index'){
die('You must log in first');
}
else{ // if the page is index echo out an error message
$error_msj = 'Wrong user or pass';
}
}
?>