User/ Member Security?

Discussion in 'PHP' started by splatcatballa99, Sep 19, 2007.

0
  1. #1
    How do you validate that a user is actually logged in and is who they claim they are?
     
    splatcatballa99, Sep 19, 2007 IP
  2. nico_swd

    nico_swd Prominent Member

    Messages:
    4,153
    Likes Received:
    344
    Best Answers:
    18
    Trophy Points:
    375
    #2
    nico_swd, Sep 19, 2007 IP
  3. splatcatballa99

    splatcatballa99 Well-Known Member

    Messages:
    400
    Likes Received:
    5
    Best Answers:
    0
    Trophy Points:
    130
    Digital Goods:
    1
    #3
    ok after reading around i've come up with this strategy....

    1.) When a user first visits my site I set a cookie called status and set it to 1(meaning the user is not logged in)

    2.) A user logs in, if the login turns up true I add a row to a sessions table with there ip, and session id. I then change the status cookie to 2(meaning the user is logged in) and i also set a cookie with the session id(should i encrypt that? Also is are there any php functions that generate a completely random string? If so would it be more practical to have a the session id be that but still have the id row for simplicity?)

    3.)Next I have a function that takes the session id(from the cookie i set earlier) and check it against all sessions in the session table? If the session is fraudulent I set the status cookie to 1(meaning the user isn't logged in) if it isn't I leave the status cookie at 2(meaning the use is logged in)

    4.) then on every page that requires a user to be logged in I check if the status cookie is set to 2.
     
    splatcatballa99, Sep 19, 2007 IP