與網絡安全

Question

有麻煩我的網站的登錄網頁不安全，每當輸入Firefox中的登錄頁面上輸入用戶名或密碼，我得到一個對話框說：

連接是不安全的。此處輸入的登錄信息可能會受到影響。

我應該嘗試準備好的語句，還是有另一個問題？對不起，這是一個廣泛的問題，但我並不太熟悉網絡安全。

這裏是我的登錄頁面代碼：

<?php 
include("connect.php"); 
include('PHPMailer/PHPMailer-master/examples/gmail_xoauth.phps'); 
    if (isset($_POST['createaccount'])) { 
     $username = $_POST['username']; 
     $password = $_POST['password']; 
     $email = $_POST['email']; 
     if (!connect::query('SELECT username FROM accounts WHERE username=:username', array(':username'=>$username))) { 
       if (strlen($username) >= 3 && strlen($username) <= 32) { 
         if (preg_match('/[a-zA-Z0-9_]+/', $username)) { 
           if (strlen($password) >= 6 && strlen($password) <= 60) { 
           if (filter_var($email, FILTER_VALIDATE_EMAIL)) { 
           if (!connect::query('SELECT email FROM accounts WHERE email=:email', array(':email'=>$email))) { 

             connect::query('INSERT INTO accounts VALUES (null, :username, :password, :email, \'0\')', array(':username'=>$username, ':password'=>password_hash($password, PASSWORD_BCRYPT), ':email'=>$email)); 
             gmail_xoauth::sendMail('Welcome to the Website!', 'Your account has been created!', $email); 
             echo "<h3 class = 'errmessage'>Success!</h3>"; 


           } else { 
             echo '<h3 class = "errmessage">Email already in use!</h3>'; 
           } 
         } else { 
             echo '<h3 class = "errmessage">Invalid email!</h3>'; 
           } 
         } else { 
           echo '<h3 class = "errmessage">Invalid password, at least 6 characters!</h3>'; 
         } 
         } else { 
           echo '<h3 class = "errmessage">Invalid username, at least 3 characters</h3>'; 
         } 
       } else { 
         echo '<h3 class = "errmessage">Invalid username</h3>'; 
       } 
     } else { 
       echo '<h3 class = "errmessage">User already exists!</h3>'; 
     } 
    } 

    if (isset($_POST['login'])) { 
     $username = $_POST['username']; 
     $password = $_POST['password']; 
     if (connect::query('SELECT username FROM accounts WHERE username=:username', array(':username'=>$username))) { 
       if (password_verify($password, connect::query('SELECT password FROM accounts WHERE username=:username', array(':username'=>$username))[0]['password'])) { 
         $cstrong = True; 
         $token = bin2hex(openssl_random_pseudo_bytes(64, $cstrong)); 
         $user_id = connect::query('SELECT id FROM accounts WHERE username=:username', array(':username'=>$username))[0]['id']; 
         connect::query('INSERT INTO users VALUES (null, :token, :user_id)', array(':token'=>sha1($token), ':user_id'=>$user_id)); 
         setcookie("SNID", $token, time() + 60 * 60 * 24 * 7, '/', NULL, NULL, TRUE); 
         setcookie("SNID_", '1', time() + 60 * 60 * 24 * 3, '/', NULL, NULL, TRUE); 
     setcookie("username", $username, time()+3600); 
     header("Location: home.php"); 

       } else { 
         echo '<h3 class = "errmessage">Incorrect Password!Try again</h3><br><br><br>'; 
       } 
     } else { 
       echo '<h3 class = "errmessage">User not registered!Try again</h3><br><br><br>'; 
     } 


    } 

?> 

這裏的connect.php文件：

<?php 
class connect 
{ 
    private static function db() 
    { 
     $pdo = new PDO('mysql:host=localhost;dbname=database_name;charset = utf8','username','password'); 

     $pdo->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); 

    return $pdo; 
} 

    public static function query($query,$params = array()) 
    { 

     $statement = self :: db()->prepare($query); 
     $statement->execute($params); 
     if(explode(' ',$query)[0] == 'SELECT') 
     { 
      $data = $statement->fetchAll(); 
      return $data; 
     } 

    } 

} 

?> 

Answer 1

這是由於您在非SSL頁面上有一個密碼字段，這意味着您的頁面是通過http而不是https提供的。您可以瞭解更多關於here和Mozilla's note to developers here的Firefox方面的信息。這可以通過向服務器添加SSL證書來解決。

某些證書需要花費，但您可以查看Let's Encrypt免費證書。付費證書和Let's Encrypt證書之間的主要區別是有效期限。在撰寫本文時，他們只有3個月的時間，但有些工具可以自動更新。

Answer 2

火狐加入此警告表單元素在頁面上未使用服HTTPS，它決定是獲取敏感信息。這在Firefox 52中生效。有關更多信息，請參閱this Mozilla blog post和this Mozilla support page。