Home/ Questions/Q 8363755
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-09T12:15:48+00:00

I am building a small cms system. The user can login and edit, delete

  • 0

I am building a small cms system. The user can login and edit, delete or create a new item in the database.

My question is. Is this login system safe enough?

<?php 
session_start(); ?>
<!DOCTYPE HTML>
<html>
<head>
<meta charset="utf-8">
<title>.....</title>
</head>

<body>
<?php

    include 'koder.inc.php';


if(!isset($_POST['forsoeg'])){
    $forsoeg = 0;
    $check_user='0';
    $check_pass='0';
} else {
    $forsoeg = $_POST['forsoeg'];
    $check_user = $_POST['username'];
    $check_pass = $_POST['password']; }

    if($check_user != $username || $check_pass != $password)     {
        if($forsoeg >3){
            exit("<p>Wrong password or username <br /><br />
            <a href='admin_logon.php'>back to login</a></p>");}


            $forsoeg ++;  

            ?>
<h1>Login</h1>
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post" name="form">
  <p>
    <label for="username">username:</label>
    <br />
    <input title="username:" type="text" name="username"  />
  </p>
  <p>
    <label for="password">Password:</label>
    <br />
    <input title="Skriv dit password" type="text" name="password"  />
  </p>
  <p>
    <input class="knap" type="submit" name="Send" value="Login" />
  </p>
  <input type="hidden" name="forsoeg" value="<?php echo $forsoeg; ?>"  />
</form>
<?php

    } else {
        $_SESSION['logon']="ok";

        echo "Login ok..<br />
        <a href='administration.php'>Go to admin page</a>"; } ?>
</body>
</html>

I then include the fil koder.inc.php

<?php 

 $username = "test";
 $password = "123456";


?>

And on the pages that need a valid user i start the page with 

<?php 
session_start(); ?>
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    If you’re going for a multi user setup, you should migrate from a plain text file, and use a database instead.

    For storing passwords in the database you would need to first encrypt it, using PBKDF2 etc. then add a salt, and encrypt it again. The salt has to be random, it is safe to keep this in the database stored in plaintext along with the password.

    To verify a log in, you would pull the password from the database, and match it with an encrypted version of the password stored in the $_POST variable.

    • 0