Highly secure way to achieve login functionality by using PHP and MySQLi












0












$begingroup$


I am new to PHP and am trying to create a highly secure login system using PHP and MySQLi. I tried searching a lot for the different approaches. Finally, I found one.



Is this code is safe or prone to security threats? Please suggest some modifications, if needed, in order to enhance security, along with some other best practices if you know.



function login($email, $password, $mysqli) {
// Using prepared statements means that SQL injection is not possible. `enter code here`
if ($stmt = $mysqli->prepare("SELECT id, username, password
FROM members
WHERE email = ?
LIMIT 1")) {
$stmt->bind_param('s', $email); // Bind "$email" to parameter.
$stmt->execute(); // Execute the prepared query.
$stmt->store_result();

// get variables from result.
$stmt->bind_result($user_id, $username, $db_password);
$stmt->fetch();

if ($stmt->num_rows == 1) {
// If the user exists we check if the account is locked
// from too many login attempts

if (checkbrute($user_id, $mysqli) == true) {
// Account is locked
// Send an email to user saying their account is locked
return false;
} else {
// Check if the password in the database matches
// the password the user submitted. We are using
// the password_verify function to avoid timing attacks.
if (password_verify($password, $db_password)) {
// Password is correct!
// Get the user-agent string of the user.
$user_browser = $_SERVER['HTTP_USER_AGENT'];
// XSS protection as we might print this value
$user_id = preg_replace("/[^0-9]+/", "", $user_id);
$_SESSION['user_id'] = $user_id;
// XSS protection as we might print this value
$username = preg_replace("/[^a-zA-Z0-9_-]+/",
"",
$username);
$_SESSION['username'] = $username;
$_SESSION['login_string'] = hash('sha512',
$db_password . $user_browser);
// Login successful.
return true;
} else {
// Password is not correct
// We record this attempt in the database
$now = time();
$mysqli->query("INSERT INTO login_attempts(user_id, time)
VALUES ('$user_id', '$now')");
return false;
}
}
} else {
// No user exists.
return false;
}
}
}









share|improve this question









New contributor




Purushottam Patil is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
Check out our Code of Conduct.







$endgroup$

















    0












    $begingroup$


    I am new to PHP and am trying to create a highly secure login system using PHP and MySQLi. I tried searching a lot for the different approaches. Finally, I found one.



    Is this code is safe or prone to security threats? Please suggest some modifications, if needed, in order to enhance security, along with some other best practices if you know.



    function login($email, $password, $mysqli) {
    // Using prepared statements means that SQL injection is not possible. `enter code here`
    if ($stmt = $mysqli->prepare("SELECT id, username, password
    FROM members
    WHERE email = ?
    LIMIT 1")) {
    $stmt->bind_param('s', $email); // Bind "$email" to parameter.
    $stmt->execute(); // Execute the prepared query.
    $stmt->store_result();

    // get variables from result.
    $stmt->bind_result($user_id, $username, $db_password);
    $stmt->fetch();

    if ($stmt->num_rows == 1) {
    // If the user exists we check if the account is locked
    // from too many login attempts

    if (checkbrute($user_id, $mysqli) == true) {
    // Account is locked
    // Send an email to user saying their account is locked
    return false;
    } else {
    // Check if the password in the database matches
    // the password the user submitted. We are using
    // the password_verify function to avoid timing attacks.
    if (password_verify($password, $db_password)) {
    // Password is correct!
    // Get the user-agent string of the user.
    $user_browser = $_SERVER['HTTP_USER_AGENT'];
    // XSS protection as we might print this value
    $user_id = preg_replace("/[^0-9]+/", "", $user_id);
    $_SESSION['user_id'] = $user_id;
    // XSS protection as we might print this value
    $username = preg_replace("/[^a-zA-Z0-9_-]+/",
    "",
    $username);
    $_SESSION['username'] = $username;
    $_SESSION['login_string'] = hash('sha512',
    $db_password . $user_browser);
    // Login successful.
    return true;
    } else {
    // Password is not correct
    // We record this attempt in the database
    $now = time();
    $mysqli->query("INSERT INTO login_attempts(user_id, time)
    VALUES ('$user_id', '$now')");
    return false;
    }
    }
    } else {
    // No user exists.
    return false;
    }
    }
    }









    share|improve this question









    New contributor




    Purushottam Patil is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
    Check out our Code of Conduct.







    $endgroup$















      0












      0








      0





      $begingroup$


      I am new to PHP and am trying to create a highly secure login system using PHP and MySQLi. I tried searching a lot for the different approaches. Finally, I found one.



      Is this code is safe or prone to security threats? Please suggest some modifications, if needed, in order to enhance security, along with some other best practices if you know.



      function login($email, $password, $mysqli) {
      // Using prepared statements means that SQL injection is not possible. `enter code here`
      if ($stmt = $mysqli->prepare("SELECT id, username, password
      FROM members
      WHERE email = ?
      LIMIT 1")) {
      $stmt->bind_param('s', $email); // Bind "$email" to parameter.
      $stmt->execute(); // Execute the prepared query.
      $stmt->store_result();

      // get variables from result.
      $stmt->bind_result($user_id, $username, $db_password);
      $stmt->fetch();

      if ($stmt->num_rows == 1) {
      // If the user exists we check if the account is locked
      // from too many login attempts

      if (checkbrute($user_id, $mysqli) == true) {
      // Account is locked
      // Send an email to user saying their account is locked
      return false;
      } else {
      // Check if the password in the database matches
      // the password the user submitted. We are using
      // the password_verify function to avoid timing attacks.
      if (password_verify($password, $db_password)) {
      // Password is correct!
      // Get the user-agent string of the user.
      $user_browser = $_SERVER['HTTP_USER_AGENT'];
      // XSS protection as we might print this value
      $user_id = preg_replace("/[^0-9]+/", "", $user_id);
      $_SESSION['user_id'] = $user_id;
      // XSS protection as we might print this value
      $username = preg_replace("/[^a-zA-Z0-9_-]+/",
      "",
      $username);
      $_SESSION['username'] = $username;
      $_SESSION['login_string'] = hash('sha512',
      $db_password . $user_browser);
      // Login successful.
      return true;
      } else {
      // Password is not correct
      // We record this attempt in the database
      $now = time();
      $mysqli->query("INSERT INTO login_attempts(user_id, time)
      VALUES ('$user_id', '$now')");
      return false;
      }
      }
      } else {
      // No user exists.
      return false;
      }
      }
      }









      share|improve this question









      New contributor




      Purushottam Patil is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.







      $endgroup$




      I am new to PHP and am trying to create a highly secure login system using PHP and MySQLi. I tried searching a lot for the different approaches. Finally, I found one.



      Is this code is safe or prone to security threats? Please suggest some modifications, if needed, in order to enhance security, along with some other best practices if you know.



      function login($email, $password, $mysqli) {
      // Using prepared statements means that SQL injection is not possible. `enter code here`
      if ($stmt = $mysqli->prepare("SELECT id, username, password
      FROM members
      WHERE email = ?
      LIMIT 1")) {
      $stmt->bind_param('s', $email); // Bind "$email" to parameter.
      $stmt->execute(); // Execute the prepared query.
      $stmt->store_result();

      // get variables from result.
      $stmt->bind_result($user_id, $username, $db_password);
      $stmt->fetch();

      if ($stmt->num_rows == 1) {
      // If the user exists we check if the account is locked
      // from too many login attempts

      if (checkbrute($user_id, $mysqli) == true) {
      // Account is locked
      // Send an email to user saying their account is locked
      return false;
      } else {
      // Check if the password in the database matches
      // the password the user submitted. We are using
      // the password_verify function to avoid timing attacks.
      if (password_verify($password, $db_password)) {
      // Password is correct!
      // Get the user-agent string of the user.
      $user_browser = $_SERVER['HTTP_USER_AGENT'];
      // XSS protection as we might print this value
      $user_id = preg_replace("/[^0-9]+/", "", $user_id);
      $_SESSION['user_id'] = $user_id;
      // XSS protection as we might print this value
      $username = preg_replace("/[^a-zA-Z0-9_-]+/",
      "",
      $username);
      $_SESSION['username'] = $username;
      $_SESSION['login_string'] = hash('sha512',
      $db_password . $user_browser);
      // Login successful.
      return true;
      } else {
      // Password is not correct
      // We record this attempt in the database
      $now = time();
      $mysqli->query("INSERT INTO login_attempts(user_id, time)
      VALUES ('$user_id', '$now')");
      return false;
      }
      }
      } else {
      // No user exists.
      return false;
      }
      }
      }






      php mysqli






      share|improve this question









      New contributor




      Purushottam Patil is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.











      share|improve this question









      New contributor




      Purushottam Patil is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.









      share|improve this question




      share|improve this question








      edited 25 mins ago









      Jamal

      30.3k11116226




      30.3k11116226






      New contributor




      Purushottam Patil is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.









      asked 43 mins ago









      Purushottam PatilPurushottam Patil

      1




      1




      New contributor




      Purushottam Patil is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.





      New contributor





      Purushottam Patil is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.






      Purushottam Patil is a new contributor to this site. Take care in asking for clarification, commenting, and answering.
      Check out our Code of Conduct.






















          0






          active

          oldest

          votes











          Your Answer





          StackExchange.ifUsing("editor", function () {
          return StackExchange.using("mathjaxEditing", function () {
          StackExchange.MarkdownEditor.creationCallbacks.add(function (editor, postfix) {
          StackExchange.mathjaxEditing.prepareWmdForMathJax(editor, postfix, [["\$", "\$"]]);
          });
          });
          }, "mathjax-editing");

          StackExchange.ifUsing("editor", function () {
          StackExchange.using("externalEditor", function () {
          StackExchange.using("snippets", function () {
          StackExchange.snippets.init();
          });
          });
          }, "code-snippets");

          StackExchange.ready(function() {
          var channelOptions = {
          tags: "".split(" "),
          id: "196"
          };
          initTagRenderer("".split(" "), "".split(" "), channelOptions);

          StackExchange.using("externalEditor", function() {
          // Have to fire editor after snippets, if snippets enabled
          if (StackExchange.settings.snippets.snippetsEnabled) {
          StackExchange.using("snippets", function() {
          createEditor();
          });
          }
          else {
          createEditor();
          }
          });

          function createEditor() {
          StackExchange.prepareEditor({
          heartbeatType: 'answer',
          autoActivateHeartbeat: false,
          convertImagesToLinks: false,
          noModals: true,
          showLowRepImageUploadWarning: true,
          reputationToPostImages: null,
          bindNavPrevention: true,
          postfix: "",
          imageUploader: {
          brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
          contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
          allowUrls: true
          },
          onDemand: true,
          discardSelector: ".discard-answer"
          ,immediatelyShowMarkdownHelp:true
          });


          }
          });






          Purushottam Patil is a new contributor. Be nice, and check out our Code of Conduct.










          draft saved

          draft discarded


















          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcodereview.stackexchange.com%2fquestions%2f211892%2fhighly-secure-way-to-achieve-login-functionality-by-using-php-and-mysqli%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown

























          0






          active

          oldest

          votes








          0






          active

          oldest

          votes









          active

          oldest

          votes






          active

          oldest

          votes








          Purushottam Patil is a new contributor. Be nice, and check out our Code of Conduct.










          draft saved

          draft discarded


















          Purushottam Patil is a new contributor. Be nice, and check out our Code of Conduct.













          Purushottam Patil is a new contributor. Be nice, and check out our Code of Conduct.












          Purushottam Patil is a new contributor. Be nice, and check out our Code of Conduct.
















          Thanks for contributing an answer to Code Review Stack Exchange!


          • Please be sure to answer the question. Provide details and share your research!

          But avoid



          • Asking for help, clarification, or responding to other answers.

          • Making statements based on opinion; back them up with references or personal experience.


          Use MathJax to format equations. MathJax reference.


          To learn more, see our tips on writing great answers.




          draft saved


          draft discarded














          StackExchange.ready(
          function () {
          StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fcodereview.stackexchange.com%2fquestions%2f211892%2fhighly-secure-way-to-achieve-login-functionality-by-using-php-and-mysqli%23new-answer', 'question_page');
          }
          );

          Post as a guest















          Required, but never shown





















































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown

































          Required, but never shown














          Required, but never shown












          Required, but never shown







          Required, but never shown







          Popular posts from this blog

          404 Error Contact Form 7 ajax form submitting

          How to know if a Active Directory user can login interactively

          TypeError: fit_transform() missing 1 required positional argument: 'X'