Hot answers tagged

10 votes
Accepted

PHP Login System with persistent login

Ok, moving down the list... I would separate the content of the includes folder into 2 semantically named folders: includes and ...
user avatar
9 votes
Accepted

PHP Session handling class

Commented out Code You should remove code that is commented out. If you think that you might need it in the future, think about using version control. ...
user avatar
  • 24.9k
8 votes
Accepted

Many nested session verification conditions

This is indeed quite messy. It's really hard to see which else ends which if. Just invert the if and return early: ...
user avatar
  • 24.9k
7 votes
Accepted

Performance of hashmap-based session object

This is pretty simple code, with not a lot of room for improvement. You can make the session variable final, and it's good to ...
user avatar
  • 108k
6 votes

Session Handling Setup

Let's see the code: Your Session class does too many things: Session management Login Data validation Logout Authentication Inclusion management Your class has ...
user avatar
6 votes

Persistent login ("remember me" cookie) using PHP

Security I am not sure if I have done the same thing as explained there Is my code a good way to secure remember me cookie ? No and no. Non-Random Token: Login as anyone The only data ...
user avatar
  • 24.9k
5 votes
Accepted

Session flash class

In general functionality is fulfilled but I'd improve it a bit. Below you will find incremental (further ones will contain previous improvements) list of improvements. Split get to two methods, get ...
user avatar
  • 136
5 votes

Performance of hashmap-based session object

I agree with @janos's assessment of your code: the singleton enum is done right the sessions should be ...
user avatar
  • 96.8k
5 votes

Session Handling Setup

Some Notes: Your use of private variables to hide the inner workings of your class is a very good idea. This is one of the most founding principles of OOP, and you ...
user avatar
5 votes

Simple PHP session handler class (using MySQL for session data storage)

When looking over your code I find several things I would change. It should be said that I am no expert in security, so I will forward you to places where you can get better guidance than I can about ...
user avatar
  • 1,094
5 votes
Accepted

PHP - First Login System

Security You are escaping user input, which prevents SQL injection. It's good enough, but really not the recommended way to do this as it's too error-prone (whenever a project does this, it's ...
user avatar
  • 24.9k
5 votes

httprequest to php login system

isset() accepts multiple parameters, you can simplify: ...
user avatar
  • 7,801
4 votes
Accepted

Sessions and Authentication

It seems to me like it would probably make sense for the members of Auth to be static, though this may be for some reason undesirable to you. Change it as you see ...
user avatar
  • 3,605
4 votes

Sessions and Authentication

The code is understandable, but it can be simplified. Instead of: ...
user avatar
  • 108k
4 votes
Accepted

Preventing session hijacking

Checking an "constant" IP address is an bad idea because of ISP with load balancing. IP address should change to less busy proxy. In most of cases IP address belongs to the same block. It is called ...
user avatar
  • 156
4 votes

How to regenerate my session ID often when using this class?

I like this question because I think it has a lot of answering potential. I'm going to touch on a few things, but my answer shouldn't be considered complete! Security of custom sessions There's one ...
user avatar
  • 5,717
4 votes
Accepted

A wrapper class for Sessions in PHP

I have been using php for over 10 years and never found a need for a session wrapper, but maybe you find it easier/better. There are a few improvements that could be made with your code If we are ...
user avatar
  • 2,056
4 votes

PHP Session Wrapper Class

Security This code doesn't look secure at all. SQL injection SELECT * FROM bc_users WHERE user_id = "'.$_COOKIE['bc_qanda_user_id'].'" As anyone can set the ...
user avatar
  • 24.9k
4 votes

For a login portal, what security measures are needed to prevent unauthorized access?

Your session logic seems good to me. Prepared Statements Use prepared statements. It's unclear where $_SESSION['useracctid'] comes from, but it is placed ...
user avatar
  • 24.9k
4 votes

Protect from people bruteforcing the PHPSESSID

To prevent brute forcing of the PHP Session ID you should use configuration rather than rolling your own security. From OWASP Session Management Cheat Sheet - Session ID Length: The session ID must ...
user avatar
4 votes
Accepted

Basic login script for educational purposes

First, all of your indentation is half indentation: you two-spaces instead of four. Most IDEs have proper spacing if you press TAB. Naming: You have variables need re-naming: ...
user avatar
  • 11.9k
4 votes
Accepted

Find existing session

Some notes: @session: A method called find_or_create_session should not change the state of instance variables. ...
user avatar
  • 11.1k
4 votes

Cookie, Session, and Flash middleware for Iron framework

I've never used these libraries so I only have surface-level comments, but I'm answering anyway because I feel bad you've been ignored. Luckily, I think the lack of answers is at least partly because ...
user avatar
  • 9,553
4 votes
Accepted

Session handling using Python Requests client

Please don't use regexes Regular expressions are power tools. You can use them for many situations, but they tend to be inherently fragile. They're especially fragile for parsing HTML, in part ...
user avatar
  • 7,673
4 votes

PHP Login System with persistent login

You must protect against SQL injections. You said you know about that topic, so why are you using interpolated SQL statements at all? An SQL statement in the source code must never contain a ...
user avatar
4 votes

PHP Login System with persistent login

As you are already using PDO, you should use prepare/execute logic to apply values to SQL statements. Currently they can be subject to an SQL injection. Example: Instead of ...
user avatar
4 votes
Accepted

Language switch based on parameters and session state

Yes. Definitely. You can use a lookup array. ...
user avatar
  • 7,801
4 votes

httprequest to php login system

I'll take a more holistic approach than mickmackusa, he already talked about a lot of details. I don't see any problem with the fact that you use an AJAX call to verify user credentials, and login. ...
user avatar
4 votes
Accepted

MySQL database custom session handler using PHP with MySQLi extension

Use the null coalescing operator for all occurrences where you want to provide fallback values for undeclared/null variables. ...
user avatar
  • 7,801
3 votes
Accepted

Protect from people bruteforcing the PHPSESSID

Depending of the attack, your code might be either may be more secure than the traditional use of PHP sessions. If the attacker gets the session_id cookie from an ...
user avatar
  • 54

Only top scored, non community-wiki answers of a minimum length are eligible