Click here to Skip to main content
15,901,001 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I have created a simple login system that connects to a MySQL database.

The login is basically asking for a username and password which are stored in the database. There is no option for a user to register/sign up.

What are the best practices to make my login secure?

What security measures would you recommend?

What I have tried:

I have looked into password_hash and password_verify but i think this would only be suitable when someone is signing up or creating a new username and password.. correct me if i am wrong as i am new to this.

I am using sessions in my code but this is not enough security.
Posted
Updated 23-Mar-18 3:38am
Comments

1 solution

Never store passwords. That is a serious security risk.
Always hash them: Password Storage: How to do it.[^] - the code is in C# but it's exactly teh same principle in any language.
Hash the password - with a salt, such as the userID so two users with the string "password" don't get the same hash - and store the hash. When the user tries to login, hash what he enters (using the same salt) and compare the hashes. If they match, let him in.

But first check that everything in your code is SQL Injection safe - all DB access should use parameterised queries not string concatenation - or securing the passwords becomes irrelevant!
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900