mtdev

Frequently asked and answered questions about the PHP login script and login scripts in general.

This is a list of questions that I have answered many times reguarding my Secure PHP Login Script (also available for download), Jester's Creating a Login Script with PHP 4, and Creating a Login Script with PHP 4 - Part II.

Note: I called my login script secure because it is more secure than the average PHP login scripts that are available. It is not 100% secure and I don't think there can be such a script at all - you have to choose between security and ease of use, portability, etc.

How to expire the logins in 30 minutes (for example)

Set session.gc_maxlifetime and session.cookie_lifetime to 1800.

How to redirect to another page after the user is logged in

Use header("Location: /foobar") before any output (or turn on output buffering)

Users without cookies cannot log in

For PHP versions before 4.2.0 recompile PHP with --enable-trans-sid, newer versions enable it by default. Then add session.use_trans_sid = on in your php.ini.

I get an already exists error when a user signs up

Modify your id column so that it is auto generated - use auto_increment for MySQL and serial for PostgreSQL.

How to get the IP of the visitor without the last part (the C class network)

Use the following code:

$ip = explode('.', $_SERVER['REMOTE_ADDR']);
array_pop($ip);
$ip = implode('.', $ip);

How to generate a cookie for remember-me logins

Set $uid to the id of the current user and then execute the following code:

$cookie = md5(uniqid(mt_rand(1, mt_rand_getmax())));
$cookie = serialize(array($uid, $cookie));

For versions of PHP before 4.2.0 you have to call mt_srand() before using the random number generator.

To send the cookie use setcookie(). Make sure you keep the cookie value in your database.

Note that in my article I have used the username instead of the id but as computers deal with numbers better than strings I recommend using the id.

How do I ensure that queries to the database are safe

Use $db->quote('value') where $db is a PEAR::DB instance or if you are using native MySQL functions mysql_escape_string(). If you deal with numbers always cast them explicitely: $value = (int) $value.

How do I ensure that user supplied information I display on the site is secure

Use htmlspecialchars() on the value to escape HTML code.

What does the session_id() function do

It returns the current session id or if it a new session the newly generated id.

I get an error that says I don't have DB.php

Download and install PEAR or ask your system administrator to do it for you, the packages you need to download are PEAR and DB. The files that are required by PEAR::DB are DB.php, PEAR.php, DB/common.php, and DB/mysql.php for MySQL database or another for your database respectively. Make sure that you add the PEAR installation directory to your include_path.

How do I change my PHP configuration

Read Make Your PHP Code Portable for a quick start, more detailed information can be found in the PHP manual.