Security in PHP question

I'm working on a website right now.. Nevermind what, but some of you might already know. In any case, there will be users who log in, and I want to know, purely in logic, how to make it secure enough.

Am I right in thinking that storing the md5 of the password, then checking the password on login against that, logging the IP address of whomever is logging in, and then having it recheck the IP against that stored IP each page load, and kicking them out if it changes is secure enough?

If that isn't correct, can anyone clue me into the correct logic here? I'm not one for security really.. That is, I've not done much in the way of things that need it.

Any help is pre-thanked-for.

Do some reading on serverside sessions : http://uk2.php.net/session

For passwords, you're better storing an MD5 of the pass+salt since it's harder to guess what a password is based on the hash.

good idea pert. Thanks a bunch!

Not sure what you are digging at Indiepath.. the link took me to the regular session stuff on the PHP site.. and a find on the page with "serverside" gets nothing and something not-related for "server side" so I don't know what you are talking about...

That and a decent hashing algorithm (MD5 all the way) will produce results that are extremely hard to duplicate, thus making the chance of brute-forcing a password much harder when you have nothing but a hash to go on (and if you can't pass the hash directly to the server, and you never should be able to, they'll have nothing to go on). If you include a sort of three-strikes for failed logins, as well, it can make it really quite painful to brute-force for people who don't have proxies up the wazoo.

That aside, your biggest problem is, in my opinion, simply going to be how secure your users' information is. Not the information you store, but the information you give them and they keep on their end. E.g., e-mails with usernames and passwords and such. Then again, I'm not a very trusting person when it comes to the intelligence of the majority of the earth's population.

But anyway, I don't do network stuff, so my input here is probably close to useless. Just my ideas while I've thought about various topics while designing random pieces of software to test stuff. If you really want security, you're probably better off contracting someone to do it for you (in this case, ignore my signature, I'm not a good candidate).

well.. I can't very-well be incharge of my users being dumbasses or not.. I'll have to deal with it, but I can't make them be smart about their passwords.. Not without putting some of them off, that is.

Say.. How do sites that can e-mail you your password if you lose it store the password? Wouldn't it be insecure to store it in a decryptable way almost anywhere? Off-the-wall, As far as I can tell, we don't plan to have the function... We aren't going to be dealing with really important data.. I can't think of any reason a hacker would want to break into a user's account anyway.. and the admins will have some pretty tough passwords... something like... dustcakes20394alphasquared (just made that up) but you get the idea...

About that. Anyone got any tips for how to handle that side of things? Multiple passwords perhaps? Or would that be over-kill...

we really just need to keep out the amatures, so we don't have people constantly getting their accounts jacked/defaced.. We won't be storing credit card numbers for easy use like an amazon might... The worst thing a hacker would be able to get at would be their password itself.. that they might take over to other sites... like ebay... where they could try the same username / email / passwords to search about for some moolah that way.


BTB... It's good to see you around again NC... I still have a photo of you sitting around somewhere....

I've got plenty of new ones. Unfortunately, this isn't the topic for that.

Never written any really secure php stuff but I do recall on other sites when I forgot my password they wouldnt email me the password but instead gave me a onetime URL ( presumably the parameters passed identify me as the user ) where I can go to and it will allow me to enter a new password.

How are you intending to keep the user session alive once they have logged in?

No. For starters more than one person can share the same IP (NAT). Like Indiepath said, you really should use sessions for this kind of thing.

Also you should definitely store passwords using some form or irreversible encryption / hashing, and force an SSL connection for logging in. Most databases will have a "password" function you can use for securely storing and validating passwords.

There's a decent login system here that might get you started: http://evolt.org/PHP-Login-System-with-Admin-Features?from=600&comments_per_page=50

... I am going to use sessions... I thought that Indie was trying to tell me about something special. I don't think of sessions as serverside... Even if they are in reality..

I left them out of the description, that was a mistake. I just assumed that...

Sessions are serverside, the client simply caches the session ID.

I think what Indiepath's getting at is that if your site is holding something particularly appealing, then a hacker might very well steal the session ID from one of your users (via a trojan) and whilst they are still active, use the same ID to connect to your site themselves, bypassing all your login stuff very easily.

If your site data is important enough, you could implement a method where you regenerate the session ID every ten or twenty minutes (or shorter if you're feeling particularly evil) and send that to the currently logged in user, if they haven't spoken to the server within that time frame, they are logged out. (this is of course more of a pain for the user, but better security is achieved).

Another thing is to limit the number of users using that login (to one for individual accounts).

Also, log IP's (not all hackers are smart) and log in attempts (you could send an automated email if the log in attempts exceed a certain threshold).

As for logins, never ever return an error that tells the user what they got right. Always say the same thing, or say "Invalid username or password".

Never name your users table "users", name it something a little more obscure, or prepend a couple of letters. (helps prevent SQL injection, obviously properly escaping the user provided data should block any of these before it gets this far).

If I could give some advice, and possibly a perspective from the other side of this topic, taking the actions discussed above will be more than enough to stop newbies, and skript kiddies, as for the real hackers, it does not matter what security you put in place on your website, if they want something from you, they will hit you where you cant do anything about it, at your service providers back door.

By rooting your service provider they not only gain what they want from you, but they also gain a mass attack by grabbing and possibly tagging or stealing all other websites currently hosted by your service provider.

On the flip side of that you could be hacked and not actually be the target if you happen to be part of a server or host that gets rooted, your simply hacked by default.

As long as you take the above steps and secure your end of the stick so to speak, I think you will be fine. and you really should not worry about your host because its not something you can do anything about. so why worry.

the only people who really need to secure their stuff up the so called yazzo are those who store customer data like credit card information or e-mail address's. this information could be considered of enough value if the quantity is high enough.

Bottom line I don't think you need to worry about it, take the above steps and you will be fine, if you do get hacked don't take it personally because there will be a high probability that you were done by default simply by being on the server that gets hacked.

If you want to find out if your server has been hit before, this is something everyone should do before they buy from a host, then check zone-h . I wont give the url so use google. just find other sites that have been with your host for a while and then search for their names. if you find any then you know its been done in the past and you might want to find a new host or ask them if the holes were patched.

like I said. I only needed to worry about the small-frys.. people who might be coming in to screw with thier friends accounts, or people who might just be trying to get themselves off by doing something they aren't supposed to. There won't be anything anyone can gain from breaking into our site, aside from bragging rights, which only a noob would be proud of.

I just want to prevent a noob from breaking in, expecially to an admin account, and deleting one, or possible all of the users..

I can add only to check WHAT user can add to your site - eg: comments and so on...
Imagine to allow users to left a message in a form - and record it into the database. Then you want to display the message in a page, but if the message has 'something' special in it like in this case

<script>while(true){alert("Ah ah ah");}</script>

Who read the message will have a little surprise

yeah, we will be disabling most if not all HTML... might just do all by removing all <s and >s

Just use htmlentities on it, that way they can post code if they want to but it will be displayed harmlessly.

can you ellaborate on that pert?

You really should escape everything to prevent SQL injection also (if you are using a DB).

htmlentities

It converts characters to their entity equivalents (i.e. < to &lt;)

<?php
$userInput = "<script language="javascript" type="text/javascript">
              <!--
              alert('nasty code here');
              //-->
              </script>
			  ";
echo htmlentities($userInput);
echo $userInput;
?>

Obviously, you need to use mysql_real_escape_string on the entry when inserting into the database as well. (note that mysql_real_escape_string requires a current database connection).

got ya.


Anything else guys?

All this info is great. Thanks a bunch.

Here's a good site for this kind of stuff.

Be sure to check out the library section of that site.

@DampeS8N - I have a class for php that I developed for pjio.com - I'm happy to share some of it with you if you would be kind enough to email me. You can get me via pjio.com or via the contact form on indiepath.com