[PHP] Secure Logins?

[`P R O D I G Y™]

How exactly should login data be handled other than mysql_escape_string, what parts need to be cookied stored, etc?

[ndee]

It really depends on the script. It it's a forum, then it's something, if it's an user panel, it's another thing.

[Iarkey]

store the username and some sort of session key that expires every X minutes and only works if the current ip matches last login ip.

[Proof]

store the username and some sort of session key that expires every X minutes and only works if the current ip matches last login ip.

Use a cookie.

in the log in block put this

PHP Code:

$x = 3600; // time to expire
setcookie("IP", $_SERVER['REMOTE_ADDR'], time()+$x); 


you can check if they match by doing this

PHP Code:

if($_COOKIE['IP'] == $_SERVER['REMOTE_ADDR']){
//do stuff
}else
die(); 


[Iarkey]

Use a cookie.

in the log in block put this

PHP Code:

$x = 3600; // time to expire
setcookie("IP", $_SERVER['REMOTE_ADDR'], time()+$x); 


you can check if they match by doing this

PHP Code:

if($_COOKIE['IP'] == $_SERVER['REMOTE_ADDR']){
//do stuff
}else
die(); 


Then someone can just steal the cookie D:

[Proof]

Then someone can just steal the cookie D:

You can steal a session if you're on the same server... I think it goes the same for a cookie. You can also add more parameters to it.

[Iarkey]

You can steal a session if you're on the same server... I think it goes the same for a cookie. You can also add more parameters to it.

you want to check the client uses the same ip as the one you assigned the cookie too.

[Proof]

you want to check the client uses the same ip as the one you assigned the cookie too.

Either I'm not understanding you or you didn't read it..

PHP Code:

if($_COOKIE['IP'] == $_SERVER['REMOTE_ADDR']){
//do stuff
}else
die(); 


[Iarkey]

Either I'm not understanding you or you didn't read it..

PHP Code:

if($_COOKIE['IP'] == $_SERVER['REMOTE_ADDR']){
//do stuff
}else
die(); 


wouldn't you just be able to edit the ip in the cookie to yours?

[Proof]

wouldn't you just be able to edit the ip in the cookie to yours?

I guess you register a random md5 hash and then put it in the DB and check if it matches up each time a page loads.