Re: Security - is this enough??

Hi Max, there's not much more you can do. Maybe consider using some challenge-response mechanism for exchanging the password between the browser and your site (for an example have a look at PHPLib) if you want the passwords not to be sent over the net unencrypted or use https. If you want more security, you will probably have to start with certificates & co. Pavel ----- Original Message ----- From: "Maxwell Hung" <maxwell_hung@yahoo.com> To: <php-general@lists.php.net> Sent: Friday, June 30, 2000 11:07 AM Subject: [PHP] Security - is this enough?? > Hi > > I wonder if I could run this by you to get some > feedback. > > I have a table in the db which stores users details > name, username, password etc.. The password is > stored > using mysql password function. > When a user logs in, their username and password are > checked against the db. If they match a cookie is > set > with a random session id and their username, these > details are also entered into a table. > Every page which requires auth. checks for the > cookie > then checks the details against those stored in the > db. Obviously if someone tries to tamper with the > cookie details the info won't match that in the db > and > prompts them to relogin. > If they match it lets them in. The cookie is set to > expire after an hour and a cron job deletes the > sessions every hour. > > Is this a secure enough way to prevent people > getting > into these pages. They are not mission criticle but > may contain some sensitive information. I can't use > php authentication as PHP is installed as CGI; and > it's a shared server but I know about the risks > involved there. > I know about phplib but I've already done this now. > I don't really want to use htaccess because I want > to > have a bit of personality within their pages > (welcome's etc...) > > Many thanks for your time and comments. > > M@X > > __________________________________________________ > Do You Yahoo!? > Get Yahoo! Mail - Free email you can access from anywhere! > http://mail.yahoo.com/ > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net >