A good secure login script with PHP and mySQL

genderbender · 04-30-2006, 06:21 AM

I'm creating a PHP website and I need a login script that references a mySQL database, the database has already been created. A tutorial will do, not a long one please... I've got two books on how to do it, but there quite hefty (I picked professional editions, lol). So a very basic tutorial will do, oh yeah it also has to be secure, basic security at least a 64 bit MD5 hash will do.

Thanks guys,

always a great help

graemef · 04-30-2006, 10:10 AM

Check out the Pear scripts

Wim Sturkenboom · 05-02-2006, 12:38 AM

Check your books for 'authentication'. I'm sure you'll find something. Else a search on the internet for php mysql authentication will give you plenty examples as well.

I use a 'user' table in every database (so not the user table provided in the mysql database itself).
When you add a user, you store the password in encrypted form. In the code below, replace mycrypt by one of the crypt functions supplied by MySQL (see chapter 12.9.2)

Code:

insert into user set login='genderbender',pwd=mycrypt('genderbender password')

The following code can be used for authentication

Code:

select * from user where login='supplied login' and pwd=mycrypt('supplied password')

If the query returns a row, it's a valid user.

krizzz · 05-02-2006, 11:06 AM

MD5 will definitely do it, as long as you create secure login web page. Make sure it's not XSS (cross site scripting) vulnerable and also make sure SQL injection is not possible through your input fields.