I am writing a personal blog script on the sly and got to the admin panel. I would very much like to know about the security level of the authentication form verification script. Here is the code:

<?php session_start(); if(isset($_POST['log_on'])){//если были получены данные из формы function clean($value){ $value = trim($value);//убираем лишние пробелы $value = strip_tags($value);//убираем html теги $value = htmlspecialchars($value);//заменяем спецсимволы return $value; } $_POST['login'] = clean($_POST['login']); $_POST['password'] = clean($_POST['password']);//чистим полученные данные include "../configs/config.php";//подключаем файл конфигурации $login = mysqli_query($connect, "SELECT * FROM `users` WHERE `id` = 1"); $log = mysqli_fetch_assoc($login);//получаем данные из базы if($_POST['login'] == '' || $_POST['login'] != $log['login']){//сравниваем $_SESSION['error'] = 'Неправильный логин!';//отправляем сообщение через сессию header("Location:/administrator/index.php");//перенаправляем на страницу авторизации exit; } if($_POST['password'] == '' || $_POST['password'] != $log['password']){ $_SESSION['error'] = 'Неправильный пароль!'; header("Location:/administrator/index.php"); exit; } if(empty($_SESSION['error'])){//если нет ошибок $_SESSION['login'] = true; header("Location:/administrator/admin.php");//направляем в панель администратора } } ?>

Began to learn PHP about a month ago, please do not kick much

  • one
    Use prepared queries. and remove the clean function. and by the way, it is better not to deduce that the login was not correctly entered, you need to say, just the data is not correctly entered. - And
  • @And BETTER? Is it somewhere better? All normal portals inform about the wrong login or password. The first is done in order for the user to know whether there is his account at all on the site. - Manitikyl
  • And what is the function of clean bad? - Ivan
  • @ Ivan, read ru.stackoverflow.com/q/637185/186083 And to display data from the server, use htmlspecialchars () Full description here php.net/manual/ru/function.htmlspecialchars.php 2 and 3 are required for setting options! - Visman pm
  • Let's just say, at least protect you from newbies? And give, please, a link where about md5 is explained more clearly than on php.su - Ivan

0