The assignment is to create a login system secured for SQL injections and XSS.
It's in PHP and I'm using PDO with prepared statements obviously. Which from my point of view should protect against the simplest injections at least. The ones I'm throwing at the system are ineffectual.
If you believe it's not secure against SQL injection I would gladly take comments and an example of what should work against it.
With regards to XSS I haven't done anything to protect against it yet. From the school I believe it was mostly about html or url-encode the inputs. But would that be enough? From google I also have some articles about sql escaping.
Comments or help on XSS protection could be nice. Or is it only a matter of escaping the inputs before it reaches the SQL query?
<form method="post">
<input type="text" name="username" id="username">
<input type="password" name="password" id="password">
<button type="submit" name="submit" class="login-button">Login</button>
<a href="register.php">Register!</a>
<p class="forgot-password"><a href="forgot.php">Forgot login?</a></p>
</form>
function Log_in($username, $password) {
$db = new PDO("host;dbname", "user", "password");
$login = $db -> prepare("SELECT * FROM Users WHERE Username =:username and Password =:password");
$login->bindValue(':username', $username, PDO::PARAM_STR);
$login->bindValue(':password', $password, PDO::PARAM_STR);
$login->execute();
global $count;
$count = $login->rowCount();
global $data;
$data=$login->fetchColumn(2);
return $count;
return $data;
}
$username = trim($_POST["username"]);
$password = trim($_POST["password"]);
if (isset($_POST['submit'])) {
getSalt($username);
foreach ($rowset as $row) {
$salt = $row[0];
}
$hashpassword = sha1($password.$salt);
Log_in($username, $hashpassword);
if($count==1){
session_start();
$_SESSION['email'] = $data;
header("location:index.php");
} else {
echo "Wrong";
}
}