Home/ Questions/Q 6947233
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T13:40:05+00:00

I’ve created a login system using PHP sessions. Here’s how it works: 1.) when

  • 0

I’ve created a login system using PHP sessions.

Here’s how it works:

1.) when the user logs in (with the valid login info):
Their info (username and password) are stored into a session, along with a few other bits of info:
The Expire time: This is just 5mins added onto the current time (so if the user login is at 22:30 the expire time would be 22:35).

2.) On every page view of the user being logged in:
The session is checked to see if exists. If it doesn’t, the user is redirected to the login page. If the session does exist, it then checks the expire time and compares it with the current time. If the expire time is more then the current time (the user has been inactive for 5+ mins) then their user details (in the session) are checked (compared to ones in database) and the Expiretime session is updated, but if the expire time is less then the current time, It wont check any details, updates the expire time session and will allow the user to carry on. Ive done that to prevent constant querying on the DB to save bandwidth.

So basically, once the user has successfully logged on, their username and password wont be checked on the DB again until they either become inactive (stay on one page) for 5+ mins or if they log out.

FORGOT to mention something guys:
The expire time session is actually called expire_time_unique_characters ($_SESSION['expire_time_'.$unique_nu]) which means the evil person will also have to find the $unique_nu when faking the session…

I just have this feeling that its not very secure.

Also, the project this is for is open source (people can see the source code) so that poses an even higher risk here…

can you guys give me some feedback?

Thanks

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    $_SESSION is relatively secure, provided it’s used right. For instance, if you keep the session files below the web root, they cannot be accessed except by someone with direct access to the server filesystem itself. For this reason, you still want to keep the password encrypted, but the username in plain text is perfectly fine.

    Keep the session ID in a cookie rather than using the query string method, otherwise anyone copying the URL will inadvertently share their session and bypass login.

    That should about do it. Obviously if someone is hacking the user’s network and obtains the cookie data then they can use it to pretend to be the user, but there’s almost nothing you can do about that. You can make it harder (require the User Agent string to be the same, for instance), but ultimately there’s not much you can do if the user’s network is compromised. It’s not your responsibility to protect their network anyway, only their data on your server.

    • 0