Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!news-1.dfn.de!news.dfn.de!fu-berlin.de!uni-berlin.de!individual.net!not-for-mail From: "J.O. Aho" Newsgroups: comp.lang.php Subject: Re: session management Date: Sat, 07 Mar 2015 14:21:15 +0100 Lines: 36 Message-ID: References: <54f7fce9$0$2983$426a74cc@news.free.fr> <54f835eb$0$2851$e4fe514c@news2.news.xs4all.nl> <54f8450f$0$3374$426a34cc@news.free.fr> <54f8578f$0$2896$e4fe514c@news2.news.xs4all.nl> Mime-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit X-Trace: individual.net Pv2k/ZmB0SWfQXGTzbjiBAiKQKEgaxeP6h2sWds9yi/WASVkxP Cancel-Lock: sha1:WrxumS//63MaH1V/l3plmWxdE+M= User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Thunderbird/31.5.0 In-Reply-To: Xref: csiph.com comp.lang.php:15070 On 07/03/15 11:59, jorn@jorna.dk wrote: > On Thu, 05 Mar 2015 14:18:27 +0100, Erwin Moller > wrote: > >> What actually happens (but I didn't see your code of course) is >> something like this: >> >> 1) You present the visitor a page with a login: username and password >> for example. >> They reside in a form. Form is posted, and server does something like this: >> >> > >> session_start(); // Or use session.autostart in php.ini >> >> // Receive posting >> $username = $_POST["username"]; >> $password = $_POST["password "]; >> >> // Check against database: >> $SQL = "SELECT userid, isadmin, cansendemail FROM tblusers where >> ((username={$username}) AND (password={$password}))"; >> // NEVER use the above example as I posted. >> // You should make sure you are not vunurable to SQL injection >> // make sure you escaped $username and $password properly. > > And *never* save passwords in clear text in a database. > User passwords should *always* be hashed! Hashing ain't enough, you need to salt it too, speacially if using weak hashing like sha1. -- //Aho