Security form web access

If coding is more your thing then the Website Development & Scripting forums are for you. Share server-side scripting and database integration tips, tricks and problems here.
Post Reply
User avatar
edwin
Junior Member
Posts: 18
Joined: Thu Sep 28, 2017 6:17 pm

Thu Sep 28, 2017 6:21 pm

Hello, 

I have been asked to make a web application for a company that requires user and password to access. 

Whenever I have done something similar I have placed in the index a form (method: post and action: login.php). The form contains the typical user box and password. 

The login.php receives the two parameters and if the combination (user-pass) in the users table of the USERDB gives access to the client. 

I have the doubt that someone from the company tell me that this is not safe enough, that they are a serious company with very confidential information. Do you see it right? Can you add something to make it safer? 

Thank you. Greetings


Beverly
Junior Member
Posts: 21
Joined: Mon Sep 01, 2014 5:59 pm

Thu Sep 28, 2017 6:32 pm

In principle it will always be the same structure, the security extras will mainly be jquery / php checks / validations ...

you can in the first instance ask for secure passwords, as you have seen in many sites: the password must contain 1 numeral, 1 uppercase and a length of at least 8 characters ...

Strictly validate the data received in login.php before introducing these to the SQL statement and not common:

Code: Select all

 $ user  =  $ _POST [ 'user' ] ;
$ contra  =  $ _POST [ 'against' ] ;
$ sql  =  "SELECT * FROM users WHERE user = ' $ user ' ....." ;
this is very insecure, you must take into account every aspect so that the work should be very well done and at the same time I lasted a long time without tinkering, which is the best!
Xandria
Junior Member
Posts: 14
Joined: Fri Sep 12, 2014 5:02 pm

Thu Sep 28, 2017 6:42 pm

Authentication via user and password is one of the most used methods, and in even more web environments. You should consider two aspects:

1. Make your web safe, at least the login form and authentication process accessible by HTTPS, I would say more, your application accessible only by HTTPS.

2. It validates both the client and server side the data entered by the user.

3. Perform a check against CSRF attacks.

4. As @"beverly"  explains , establish a secure password policy for your system.

5. Avoid SQL injection.

Where users come from, it does not matter, in an enterprise environment it could be that your application is integrated into a Windows Active Directory or similar, stored in the same database of your application or accessible through a web service or REST API, but always the procedure is the same: validation, identification and authentication !!!!
Post Reply
  • Information
  • Who is online

    Users browsing this forum: No registered users and 0 guests