PHP登录怎么写安全,PHP登录安全理念

我有一个系统登录用户并验证他们在页面上登录的想法 .

我意识到那里有很多系统，但我主要是好奇，如果我的想法是好的 . 我一直认为是重要的做法(如密码加密等) . 我真的使用了应用程序安全性，希望得到一些反馈 .

当用户登录时，他们的名称和密码是根据数据库进行验证的，密码是使用SHA256和随机生成的盐加密的，整个字符串(盐和加密密码都是128个字符 . 长) . 这是密码验证码：

function ValidatePassword($password, $correctHash)

{

$salt = substr($correctHash, 0, 64); //get the salt from the front of the hash

$validHash = substr($correctHash, 64, 64); //the SHA256

$testHash = hash("sha256", $salt . $password); //hash the password being tested

//if the hashes are exactly the same, the password is valid

return $testHash === $validHash;

}

如果登录有效，则会为其分配令牌 . 此令牌类似于密码加密，但存储加密的纪元以及另一个随机盐 . 令牌，登录时间，到期时间和用户名存储在DB中，用户名和令牌作为会话信息发送 .

这是创建令牌的代码：

function loginUser($email)

{

$thetime = time();

$ip = $_SERVER['REMOTE_ADDR'];

$dbuser="///";

$dbpass="///";

$dbtable="tokens";

mysql_connect(localhost,$dbuser,$dbpass);

mysql_select_db("///") or die( "Unable to select database");

//Generate a salt

$salt = bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM));

//Hash the salt and the current time to get a random token

$hash = hash("sha256", $salt . $password);

//Prepend the salt to the hash

$final = $salt . $hash;

$exptime = $thetime + 3600;

//Store this value into the db

$query = "INSERT INTO `spanel`.`tokens` VALUES ('$final', $thetime, $exptime, $thetime, '$ip', MD5('$email') )";

mysql_query($query) or die ("Could not create token.");

//Store the data into session vars

$_SESSION['spanel_email'] = $email;

$_SESSION['spanel_token'] = $final;

return true;

}

当他们到达页面时，他们拥有的令牌和用户名将根据数据库进行检查 . 如果检查结果良好，则更新到期时间并加载页面 . 这是代码：

function validateUser($page)

{

//Grab some vars

$thetime = time();

$ip = $_SERVER['REMOTE_ADDR'];

$token = $_SESSION['spanel_token'];

$email = $_SESSION['spanel_email'];

$dbuser="///";

$dbpass="///";

$dbtable="tokens";

mysql_connect(localhost,$dbuser,$dbpass);

mysql_select_db("///") or die( "Unable to select database");

//Global var

//Get the var for token expire

$token_expire = 3600;

//Validate the token

$query = "SELECT * FROM `tokens` WHERE `token` LIKE '$token' AND `user_id` LIKE MD5('$email') AND `exp` > $thetime";

$result = mysql_query($query) or die(mysql_error());

//Check if we have a valid result

if ( mysql_num_rows($result) != 1 ) {

//Logout the user

//Destroy the session

session_destroy();

//Redirect

header("location: /spanel/login.php?denied=1");

exit();

//(Since the token is already invalid, there's no reason to reset it as invalid)

}

$row = mysql_fetch_assoc($result);

//Update the token with our lastseen

$newexp = $thetime + $token_expire;

$query = "UPDATE `spanel`.`tokens` SET `exp` = $newexp, `lastseen_ip` = $thetime, `lastseen_ip` = '$ip' WHERE `token` LIKE '$token'";

mysql_query($query);

}

感谢反馈(好的和坏的) . 就像我说的，我没有做太多的安全性，并希望得到指针 .

编辑：我担心我高估了我有效创建登录系统的能力 . 说到这一点，我明白你是否决定不再试图找出这个可能有缺陷的想法的乱七八糟的混乱 .

不过，这是登录页面的php代码 . (在这里说了之后，我意识到只是POST'ing密码是一个很大的禁忌) .

$email = $_POST['email'];

$password = $_POST['password'];

$dbuser="///";

$dbpass="///";

$dbtable="///";

mysql_connect(localhost,$dbuser,$dbpass);

mysql_select_db("spanel") or die( "Unable to select database");

$query = "SELECT * FROM users WHERE `email` LIKE '$email'";

$result=mysql_query($query) or die(mysql_error());

$num=mysql_num_rows($result);

$row = mysql_fetch_array($result);

if ( ValidatePassword($password, $row['hash']) == true ) {

loginUser($email);

header("location: /spanel/index.php");

} else {

echo "

Login Failed.

";

}

这是在创建帐户时生成密码salt和hash的位 .

function HashPassword($password)

{

$salt = bin2hex(mcrypt_create_iv(32, MCRYPT_DEV_URANDOM)); //get 256 random bits in hex

$hash = hash("sha256", $salt . $password); //prepend the salt, then hash

//store the salt and hash in the same string, so only 1 DB column is needed

$final = $salt . $hash;

return $final;

}

感谢您的反馈，我很高兴在这里找到了我缺乏知识的问题而不是在攻击之后 .