此登錄腳本是否正常/當前/安全？

這是一個網站的身份驗證腳本。這安全嗎？是最近的編程嗎？它過時了嗎？是否有「更安全的方式」我很新，但沒有看到太多使用標題授權的地方。此登錄腳本是否正常/當前/安全？

任何幫助，將不勝感激！這是我做過的第一個登錄腳本，也是註冊。但是我不確定我喜歡標題授權。

<?php 
require_once('connectvars.php'); 
IF (!isset($_SERVER['PHP_AUTH_USER']) || !isset($_SERVER['PHP_AUTH_PW'])) { 
header('HTTP/1.1 401 Unauthorized'); 
header('WWW-Authenticate: Basic realm="Register"'); 
exit('<h3> You must enter your username & password to continue'); 
} 
$Dbc = mysqli_connect('localhost', 'root', '', 'learn'); 
$user_username = mysqli_real_escape_string($Dbc, trim($_SERVER['PHP_AUTH_USER'])); 
$user_password = mysqli_real_escape_string($Dbc, trim($_SERVER['PHP_AUTH_PW'])); 
$query = "SELECT ID, Username from members where Username = '$user_username' AND " . 
"Password = SHA1('$user_password')"; 
$data = mysqli_query($Dbc, $query); 
if (mysqli_num_rows($data) == 1) { 
$row = mysqli_fetch_array($data); 
$user_id = $row['ID']; 
$username = $row['Username']; 
} 
else { 
header('http/1.1 401 unauthorized'); 
header('www-authenticate: basic realm="Register"'); 
} 
echo ('<p class="Login"> yo are logged in as ' . $user_username . '.</p>'); 

if (isset($_POST['submit'])) { 
$username = $_POST['username']; 
$password = $_POST['password']; 
$email = $_POST['email']; 

if (empty($username)){ 
echo "you forgot to enter a username.</br>"; 
} 
if (empty($password)) { 
echo "you forgot to enter a password.</br>"; 
} 
if (empty($email)) { 
echo "you forgot to enter an email.</br>"; 
} 

if(!empty($username) && !empty($password) && !empty($email)) { 
$dbc = mysqli_connect('localhost', 'root', '', 'learn'); 
$checkusername = 'SELECT username FROM members where username = "'.$username.'"'; 
if (mysqli_num_rows(mysqli_query($dbc, $checkusername)) != 0) 
{ 
    echo "<font color = red> Username <font color = black><u>   $username</u></font> already exists in the database.</font></br>"; 

$checkemail = 'Select email FROM members where email = "'.$email.'"'; 
if (mysqli_num_rows(mysqli_query($dbc, $checkemail)) != 0) 
     echo "<font color = red> Email <font color = black><u>  $email</u></font> already exists in the database.</font>"; 
    mysqli_close($dbc); 
} 
else 
{ 
$query = "INSERT INTO members VALUES (0, '$username', SHA1('$password'), '$email')"; 
mysqli_query($dbc, $query); 
echo " Username: <font color = green ><u> $username</u></font> & Password: <font color = green><u> $password</u></font> have been added to the database."; 
mysqli_close($dbc); 
} 
} 
} 

?>

來源

2012-04-11 Cody Muir

乍一看，我會選擇一些東西。永遠不要假設設置了$ _POST變量。代碼格式非常糟糕。（除非它的複製/粘貼出錯了。）它對SQL注入是開放的。無論如何，codereview.stackexchange.com更適合這個。 – Corbin 2012-04-11 01:29:37

你也應該吃鹽。 – xanadont 2012-04-11 02:31:26

@xanadont真的，他應該可能不會使用sha1。雖然醃製肯定會有所改進。 – Corbin 2012-04-11 03:06:12

這是錯誤的。 mysqli支持參數化查詢;使用它們。

來源

2012-04-11 01:29:18

啊哈！沒有複製和粘貼，我正在閱讀一本書，只是試圖讓它做我想要的格式，而不是專業格式......我顯然缺乏反正！感謝您的建議虐待網站，至於參數化的查詢，我會做更多的學習，謝謝 – 2012-04-11 02:52:35

此登錄腳本是否正常/當前/安全？

回答

相關問題