10
votes
Accepted
PHP Login System with persistent login
Ok, moving down the list...
I would separate the content of the includes folder into 2 semantically named folders: includes and ...
- 2,309
9
votes
Accepted
PHP Session handling class
Commented out Code
You should remove code that is commented out. If you think that you might need it in the future, think about using version control.
...
- 24.9k
8
votes
Accepted
Many nested session verification conditions
This is indeed quite messy. It's really hard to see which else ends which if.
Just invert the if and return early:
...
- 24.9k
7
votes
Accepted
Performance of hashmap-based session object
This is pretty simple code, with not a lot of room for improvement.
You can make the session variable final, and it's good to ...
- 108k
6
votes
Session Handling Setup
Let's see the code:
Your Session class does too many things:
Session management
Login
Data validation
Logout
Authentication
Inclusion management
Your class has ...
- 5,643
6
votes
Persistent login ("remember me" cookie) using PHP
Security
I am not sure if I have done the same thing as explained there
Is my code a good way to secure remember me cookie ?
No and no.
Non-Random Token: Login as anyone
The only data ...
- 24.9k
5
votes
Accepted
Session flash class
In general functionality is fulfilled but I'd improve it a bit.
Below you will find incremental (further ones will contain previous improvements) list of improvements.
Split get to two methods, get ...
- 136
5
votes
Performance of hashmap-based session object
I agree with @janos's assessment of your code:
the singleton enum is done right
the sessions should be ...
- 96.8k
5
votes
Session Handling Setup
Some Notes:
Your use of private variables to hide the inner workings of your class is a very good idea. This is one of the most founding principles of OOP, and you ...
- 20k
5
votes
Simple PHP session handler class (using MySQL for session data storage)
When looking over your code I find several things I would change. It should be said that I am no expert in security, so I will forward you to places where you can get better guidance than I can about ...
- 1,094
5
votes
Accepted
PHP - First Login System
Security
You are escaping user input, which prevents SQL injection. It's good enough, but really not the recommended way to do this as it's too error-prone (whenever a project does this, it's ...
- 24.9k
5
votes
4
votes
Accepted
Sessions and Authentication
It seems to me like it would probably make sense for the members of Auth to be static, though this may be for some reason undesirable to you. Change it as you see ...
- 3,605
4
votes
Sessions and Authentication
The code is understandable, but it can be simplified.
Instead of:
...
- 108k
4
votes
Accepted
Preventing session hijacking
Checking an "constant" IP address is an bad idea because of ISP with load balancing. IP address should change to less busy proxy.
In most of cases IP address belongs to the same block. It is called ...
- 156
4
votes
How to regenerate my session ID often when using this class?
I like this question because I think it has a lot of answering potential. I'm going to touch on a few things, but my answer shouldn't be considered complete!
Security of custom sessions
There's one ...
- 5,717
4
votes
Accepted
A wrapper class for Sessions in PHP
I have been using php for over 10 years and never found a need for a session wrapper, but maybe you find it easier/better.
There are a few improvements that could be made with your code
If we are ...
- 2,056
4
votes
PHP Session Wrapper Class
Security
This code doesn't look secure at all.
SQL injection
SELECT * FROM bc_users
WHERE user_id = "'.$_COOKIE['bc_qanda_user_id'].'"
As anyone can set the ...
- 24.9k
4
votes
For a login portal, what security measures are needed to prevent unauthorized access?
Your session logic seems good to me.
Prepared Statements
Use prepared statements.
It's unclear where $_SESSION['useracctid'] comes from, but it is placed ...
- 24.9k
4
votes
Protect from people bruteforcing the PHPSESSID
To prevent brute forcing of the PHP Session ID you should use configuration rather than rolling your own security.
From OWASP Session Management Cheat Sheet - Session ID Length:
The session ID must ...
- 540
4
votes
Accepted
Basic login script for educational purposes
First, all of your indentation is half indentation: you two-spaces instead of four.
Most IDEs have proper spacing if you press TAB.
Naming:
You have variables need re-naming:
...
- 11.9k
4
votes
Accepted
Find existing session
Some notes:
@session: A method called find_or_create_session should not change the state of instance variables.
...
- 11.1k
4
votes
Cookie, Session, and Flash middleware for Iron framework
I've never used these libraries so I only have surface-level comments, but I'm answering anyway because I feel bad you've been ignored. Luckily, I think the lack of answers is at least partly because ...
- 9,553
4
votes
Accepted
Session handling using Python Requests client
Please don't use regexes
Regular expressions are power tools. You can use them for many situations, but they tend to be inherently fragile. They're especially fragile for parsing HTML, in part ...
- 7,673
4
votes
PHP Login System with persistent login
You must protect against SQL injections. You said you know about that topic, so why are you using interpolated SQL statements at all? An SQL statement in the source code must never contain a ...
- 21k
4
votes
PHP Login System with persistent login
As you are already using PDO, you should use prepare/execute logic to apply values to SQL statements. Currently they can be subject to an SQL injection.
Example:
Instead of
...
- 286
4
votes
Accepted
Language switch based on parameters and session state
Yes. Definitely. You can use a lookup array.
...
- 7,801
4
votes
httprequest to php login system
I'll take a more holistic approach than mickmackusa, he already talked about a lot of details.
I don't see any problem with the fact that you use an AJAX call to verify user credentials, and login. ...
- 5,470
4
votes
Accepted
MySQL database custom session handler using PHP with MySQLi extension
Use the null coalescing operator for all occurrences where you want to provide fallback values for undeclared/null variables.
...
- 7,801
3
votes
Accepted
Protect from people bruteforcing the PHPSESSID
Depending of the attack, your code might be either may be more secure than the traditional use of PHP sessions.
If the attacker gets the session_id cookie from an ...
- 54
Only top scored, non community-wiki answers of a minimum length are eligible