I have the following code to do remember-me style login:
<?php
session_start();
if(!isset($_SESSION['login'])) $_SESSION['login'] = 0;
if(isset($_COOKIE['web_login_cookie']) && $_SESSION['login'] == 0) {
$sql = mysql_query("SELECT * FROM users");
while($row = mysql_fetch_array($sql)) {
$pass = sha1($row['password'] . '@#$%$#%dsf@#$SDFg');
if($_COOKIE['web_login_cookie'] == $pass) {
$_SESSION['userID'] = $row['userID'];
$_SESSION['login'] = 1;
if($row['level'] == 1) {
$_SESSION['admin'] = 1;
}
}
}
if(mysql_num_rows($sql) == 0) {
setcookie("web_login_cookie", "", time()+(60*60*24*14));
session_destroy();
}
}
?>
I have this code in my header file. Is this secure enough or will it pose any security risks in the future?
WHERE
clause in SQL. \$\endgroup\$ – Álvaro G. Vicario Jan 24 '12 at 10:21user
table on every page request will be a bottleneck in the application. \$\endgroup\$ – palacsint Jan 24 '12 at 11:27