0

i was told that my login page is still not secure even if i use the mysqli_real_escape_string function. can you please look at my code and show me a way i could better secure my login. here is the code:

<?php
session_start();
include("includes/config.php");

if(isset($_POST['login'])){
$email = mysqli_real_escape_string($connection,$_POST['email']);
$pass = mysqli_real_escape_string($connection,$_POST['pass']);
$pass = md5($pass);

$get_user = "SELECT * FROM members WHERE user_email='$email' AND user_pass='$pass'";
$run_user = mysqli_query($connection,$get_user);
$check = mysqli_num_rows($run_user);

if($check==1){
    $_SESSION['user_email']=$email;
    $rows_check = mysqli_fetch_array($run_user);
    $activate = $rows_check['activate'];

    if($activate == 0){
        echo "<script>window.open('lock_out.php','_self')</script>";
    }
    if($activate == 1){
        echo "<script>window.open('home.php','_self')</script>";
        $stat = 1;
        $update = "UPDATE members SET online='$stat' WHERE       user_email='$email'";
        $run_update = mysqli_query($connection,$update);            
    }
} else {
    echo "<script>alert('Password or email is not correct!')</script>";
    echo "<script>window.open('index.php','_self')</script>";
  }
}
?>
Funk Forty Niner
  • 74,450
  • 15
  • 68
  • 141
styles41
  • 9
  • 1
  • simple: use a prepared statement and keep XSS in mind also. Don't use MD5 neither; you're asking for trouble. – Funk Forty Niner Sep 28 '16 at 18:29
  • ok so whats better than md5. SHA1 is better then? – styles41 Sep 28 '16 at 18:36
  • no, sha1 is just as bad. Use `password_hash()` or the compatibility pack if <5.5. See the manual http://php.net/manual/en/function.password-hash.php – Funk Forty Niner Sep 28 '16 at 18:37
  • Start [here](http://php.net/manual/en/book.password.php) to learn about PHP support for password hashing. Read and understand each section shown in the link. – DFriend Sep 28 '16 at 18:41
  • ok thanks for that. ill work on the password section in a bit. but i do not understand how to use prepared statements. could someone please explain how it works – styles41 Sep 28 '16 at 18:43

0 Answers0