secure PHP login script

This is the finalization of the insane idea I had when publishing the login (security through obscurity) – weird PHP script, idea that could not have been finalized without the post that Stephen did as a response to it… he had some great ideas there…

Let’s see how the finalized version of this so much criticized script will end… And of course it will have some obscurity in it. Why? Many hate it that’s why :þ

Firstly we have our MySQL table that goes by the following definition:

—
create table 1nside0ut(
   id0 int not null auto_increment,
   l0gn4m3 varchar(255),
   entryw41 char(32),
   r34ln4m3 varchar(255),
   primary key(id0)
);
—

Why two username fields, and why named that way?
Because the user should have a login username, used just for that and a shown name, which should be different -> harder to bruteforce it (if you don’t know the login username). The strange column names are this way to make the hackers life harder (to guess the column name is pretty hard, especially in this case), but this is less useful for a server that has MySQL 5 or above, see why MySQL Information Schema table.

Our beautiful PHP code, which was so much criticized and appreciated at the same time follows in it’s altered mode:

—
<?php

$username = md5($_POST["username"]);
$passwd = md5($_POST["passwd"]);

$handle = mysql_connect(”user”,”pass”,”mySQLHost”);
      mysql_select_db(”yourdb”);
$query = “SELECT r34ln4m3 FROM 1nside0ut WHERE
      md5(l0gn4m3)=’$username’ AND entryw41=’$passwd’”;

$result = mysql_query($query, $handle);

if (mysql_num_rows($result)!=0) {
      //mark as valid user
      header(”Location: private.php”);
      exit;
}

//if the code reaches this part then the login failed
//wrong username/password

header(”Location: public.php”);

?>
—

Basically this after my opinion the simplest to implement secure login script, even for rookie web developers which quite often mess up with mysql_real_escape_string(), by not using it, but using instead addslashes. And when they do it right they forget to do quote paring.

If there is a method to do it secure, why bother making another script? Just to stay original, and to spread some security through obscurity tips, which even if not appreciated very useful in hardening a hackers life, not to stop it; for that is security by design !?

I wrote recently a better article on the matter: 8 Tips For A Secure Login Script/Admin Panel

---

Possibly related posts: (automatically generated)

• Happy Birthday
• creating a login script using PHP and MySQL
• How to POST to two different pages after a single click
• Posting to the eForum