[RESOLVED] PHP Logon Security

[kzatu]

I did some quick searching and found some stuff about logon security in PHP but nothing was direct enough for this question. Using PHP, what are some recommened ways to make sure your pages are only access by someone who logged in correctly?

I am currently using MySQL which has a table named "users" and it contains their logon names, proper names, and encrypted passwords.

Right now I have every page include login.php as one of the very first lines. If the user is logged in then they will see no ouput from login.php. If they are not then it displays the login form and terminates loading anything further.

The user inputs their login name and password and then I run this query

$query='SELECT * from users
       WHERE username="'.$username.'" AND password=password("'.$password.'")';
$sqlresult=mysql_query($query) or die(mysql_error());
$rowcount=mysql_num_rows($sqlresult); 

As far as I can tell, I should only get 1 row if the user successfully loggedin and Zero rows if they did not. I then proceed to set a SESSION variable like below. Then every page checks to see if that SESSION variable is set before it loads any of the page.

$_SESSION['valid_user'] = $row['FullName']; 

Now I understand that there are probably many levels of security, everything ranging from no security, to light security, to your Pentagon (multi-billion dollar budget) security. My web app runs on a private Intranet of less than 150 people and only 4 people know it exists and have access to it. So I don't think I need heavy duty security. But I'm just not certain if this is good enough.

[penagate]

Honestly, for an small scale intranet app I would not care about security beyond what you have done.

I would be more concerned that you do not appear to have escaped the $username or $password variables before inserting them into a SQL query (or at least, it is not apparent whether or not you have done so).
Always make sure that you use mysql_real_escape_string to escape variables before inserting them into SQL queries, otherwise certain characters will cause your query to break (which is a SQL injection vulnerability, too, but I wouldn't worry about those on an intranet).
If possible, use a data access library — such as PDO or mysqli — which allows parameterised queries. This avoids the headache of having to escape variables and just generally makes life easier.

[kzatu]

Well I am uncertain about these SESSION variables. Allow me to explain.

I was upgrading and addings lots of features to my intranet app but I didn't want to effect the one in production, so I made a copy of it on the web server. So on my web server I had
http://intranet/app1 (live)
http://intranet/app2 (under development)

I noticed that if I logged into one then I didn't have to log into the other. And likewise, if I logged out of one then they both would ask me to login. The SESSION variables were shared between these two apps. This is what brought me to my concerns about its security. Shouldn't each web app maintain its own set of SESSION variables?

[chemicalNova]

What I do is store a user object as a session item.. that way there are separate objects for each session login..

if (!isset($_SESSION['userData']))
    header("Location: login.php");

$user = $_SESSION['userData'];
// userleves and such
if ($user->UserLevel == $ADMIN)
    // do something 

chem

[penagate]

PHP doesn't have any native facility for separating web sites. You can however do this yourself.

Sessions are identified on the client by a cookie containing the session ID. The cookie by default matches by domain only. You can modify this behaviour so that the cookie matches by domain and script path in order to separate the sessions of two different applications on the same domain.

session_set_cookie_params(0, '/app1');
session_start(); 

[kzatu]

Hmm, okay. I'll look into that Penegate. Thanks.

Going back to your previous recommendation about using mysql_real_escape_string. I am only using that command in a couple key places but it makes sense to use it everywhere that I enter data into the MySQL database.

[kzatu]

... Always make sure that you use mysql_real_escape_string to escape variables before inserting them into SQL queries, otherwise certain characters will cause your query to break (which is a SQL injection vulnerability, too, but I wouldn't worry about those on an intranet). ...

A quick question about this. Did you mean that it is best to use the mysql_real_escape_string on the whole query string or just the variables being inserted into the query string?

For example, this uses it on the variable being inserted into the query.

$newtext=mysql_real_escape_string($newtext);
$query='INSERT INTO table SET field="'.$newtext.'"';
mysql_query($query) or die(mysql_error()); 

And this example uses it on the whole query string.

$query='INSERT INTO table SET field="'.$newtext.'"';
$query=mysql_real_escape_string($query);
mysql_query($query) or die(mysql_error()); 

[penagate]

Only the variable. Otherwise you will break the query syntax.

[kzatu]

That's what I was afraid of. Thanks.