I started a web project. Now I was wondering if it is secure enough. I followed some tutorials on HTS, but I can't see all holes (if there are any). Can you check my pages and if you can find any hole in it (like XSS or SQL injections). Thanks for helping :)!
My URL is: **
And another security question: is my HTTPS certificate safe enough? (**) And my SMTP/SSH/... services?
You can now login using: user: demo
, password: test123
User controller code:
<?php if ( ! defined('BASEPATH')) exit('No direct script access allowed');
class User extends CI_Controller {
public function create() {
setHTTPS();
if ($this->form_validation->run() == false) {
$this->load->view('user/create');
} else {
$this->MUser->create();
$this->load->view('user/email_sent');
}
}
public function login() {
setHTTPS();
if ($this->form_validation->run() == false) {
$this->load->view('user/login');
} else {
$this->MUser->createSession();
$this->MUser->checkLogin();
$this->load->view('user/dashboard');
}
}
public function logout() {
setHTTPS();
if ($this->MUser->login()) {
$this->MUser->logout();
$this->load->view('user/logout');
} else {
$this->load->view('user/logout_failed');
}
}
public function dashboard($username) {
setHTTPS();
$this->MUser->checkLogin();
$this->load->view('/user/dashboard');
}
public function verify($userID, $code) {
setHTTPS();
$safeCode = urldecode($code);
if ($this->MUser->checkVerifyCode($userID, $safeCode)) {
$this->MUser->cleanVerifyCode($userID);
$this->MUser->setActive($userID);
mailSignupComplete($userID);
$this->load->view('user/signup_complete');
} else {
$this->load->view('user/validation_failed');
}
}
public function password($userID = null, $verifier = null) {
setHTTPS();
if ($userID !== null) {
$safeCode = urldecode($verifier);
if ($this->MUser->checkPasswordCode($userID, $safeCode)) {
$this->MUser->updatePassword($userID);
$this->load->view('user/password_succes');
} else {
$this->load->view('user/password_failed');
}
} else {
if ($this->form_validation->run() == false) {
$this->load->view('user/password');
} else {
$this->MUser->addRecoverPasswordEntry();
$this->load->view('user/password_sent');
}
}
}
}
/* End of file user.php */
/* Location: ./application/controllers/user.php */