Here I'm trying to develop a simple framework for my own purpose. I'm using PHP and PDO. But, I'm still worried about my password security codes. Below I have posted my codes. it stored like these in my database $1$sr1.F90.$hXd.9DheSMtYmI52KT7fy0
. Is this the right way to store passwords? Or Am I make anything wrong here?
I am worried about SQL injection and XSS attacks. But, here I'm using PDO. Is this code good enough to prevent attacks?
Insert script
$password = $_POST['pwd'];
$crypted_pass = crypt($password);
date_default_timezone_set('Asia/Kolkata');
$date = date('Y-m-d h:i:s');
$insert_query = $dbh->prepare("INSERT INTO admin ( user_name, user_pwd, user_email, profile_created_on ) VALUES ( :username, :userpwd, :useremail, :date )");
$insert_query->bindValue(':username', 'Administrator');
$insert_query->bindValue(':userpwd', $crypted_pass);
$insert_query->bindValue(':useremail', '[email protected]');
$insert_query->bindParam(':date', $date);
$insert_query->execute();
Access script
if(isset($_POST['admin_login']))
{
$username = mysql_real_escape_string($_POST['admin_user_name']);
$password = mysql_real_escape_string($_POST['admin_user_pwd']);
try
{
$select_query = $dbh->prepare("SELECT * FROM admin WHERE user_name = '$username'");
$result = $select_query->execute();
if(count($result) > 0)
{
while($row = $select_query->fetch(PDO::FETCH_ASSOC))
{
if(crypt($password, $row['user_pwd']) == $row['user_pwd'] && $row['user_name'] == $username)
{
session_start();
$_SESSION['sessionname'] = $row['user_name'];
header('Location: dashboard.php');
return true;
}
else
{
echo '<div style="background: #FF0000; color: #FFF; font-family: arial; font-size: 14px; padding: 20px; position: absolute; z-index:15; top:50%; left:50%; margin:-50px 0 0 -200px;">Access Denied. Wrong Username or Password. <a style="color: #FFF; text-decoration: none; background: #333; padding: 5px;" href="index.php">Go Back</a></div>';
return false;
}
}
}
}