Skip to main content
3 of 4
edited tags
200_success
  • 144.2k
  • 22
  • 188
  • 473

Security of login and register system

I need some help with my register/login functions. I'm not sure if I understood bcrypt correctly either.

Is this good or do I have to do any changes? Did I miss something? is it secure enough?

For the database table users I created (ID, username and password[char:60]):

function loginAccount() {
    global $connect;

    $username = mysqli_real_escape_string($connect, $_POST['username']);
    $password = mysqli_real_escape_string($connect, $_POST['password']);

    $existingHashFromDb = "";
    if(!isset($existingHashFromDb)) {
        // existing password from database is not set
    } else {

        $login_sql = "SELECT password FROM users WHERE username = '".$username."'";
        $login_result = mysqli_query($connect, $login_sql);

        if($login_result) {
            while($row = mysqli_fetch_assoc($login_result)) {
                $existingHashFromDb = $row['password'];
            }

            # Check if the hash of the entered login password, matches the stored hash.
            # The salt and the cost factor will be extracted from $existingHashFromDb.
            $isPasswordCorrect = password_verify($password, $existingHashFromDb);

            if($isPasswordCorrect) {
                // you are logged in
                echo "<p>Welcome <a href=\"#{$username}\">" . ucfirst($username) . "</a></p>";

                // logout?
                echo "<p><a href=\"?logout\">Logout</a></p>";
            } else {
                echo "<p>Password did not match.</p>";
            }
        } else {
            // query failed
            mysqli_free_result($login_result);
            mysqli_close($connect);
        }

    }

}

function registerAccount() {
    global $connect;

    $username       = mysqli_real_escape_string($connect, $_POST['username']);
    $password       = mysqli_real_escape_string($connect, $_POST['password']);
    $password_again = mysqli_real_escape_string($connect, $_POST['password_again']);


    # This way you can define a cost factor (by default 10). Increasing the
    # cost factor by 1, doubles the needed time to calculate the hash value.
    $hashToStoreInDb = password_hash($password, PASSWORD_BCRYPT, array("cost" => 11));

    # See if the username already exists in the database
    $userexist_query = "SELECT username FROM users WHERE username = '".$username."'";
    $userexist_result = mysqli_query($connect, $userexist_query);

    if($userexist_result) {
        if(mysqli_num_rows($userexist_result) >= 1) {
            echo "<p>Username already exists!</p>";
        } else {
            # See if the password and password_again is matching.
            if($password == $password_again) {
                $register_query  = "INSERT INTO users (username, password) VALUES ('$username', '$hashToStoreInDb')";
                $register_result = mysqli_query($connect, $register_query);

                if($register_result) {
                    echo "<p><a href=\"#{$username}\">" . ucfirst($username) . "</a> has been created! <br> Password: <b>{$hashToStoreInDb}</b></p>";
                } else {
                    // query failed
                    mysqli_free_result($register_result);
                    mysqli_close($connect);
                }
            } else {
                echo "<p>Password does not match!</p>";
            }
        }
    } else {
        // query failed
        mysqli_free_result($userexist_result);
        mysqli_close($connect);
    }


}
Emil
  • 51
  • 2