How secure is this?

JamesU2005

JamesU2005

JamesU2005

Soldato
Joined
30 Nov 2005
Posts
3,084
Location
London
Can any PHP experts take a look at my code and tell me how secure it is?

I realise it's not the cleanest of codes but it works. :p

PHP: 
<?php 

include 'database.php';


$AdminUsername = $_POST['adminusername']; 
$AdminPassword = $_POST['adminpasswordguess']; 



$AdminUser = mysql_real_escape_string($AdminUsername);

$AdminUserChar = str_replace(' ', '', $AdminUser);

$AdminClear = preg_replace("/[^a-zA-Z0-9]/", "", $AdminUserChar);



$AdminPass = mysql_real_escape_string($AdminPassword);

$AdminPassChar = str_replace(' ', '', $AdminPass);

$AdminPassClear = preg_replace("/[^a-zA-Z0-9]/", "", $AdminPassChar);


$query = "SELECT adminid, adminusername, adminpassword FROM admin WHERE adminusername = 'AdminClear' AND adminpassword = '$AdminPassClear'"; 
$result = mysql_query($query);
 
$row = mysql_fetch_array($result);

$AdminID = $row["adminid"]; 

if (mysql_num_rows($result) != 1) {
    header("Location: wrongpassword.php");

} else {
	session_start();
    $_SESSION['adminusername'] = "$AdminUsername";
	$_SESSION['adminuserid'] = "$AdminID";
	$_SESSION['AdminAuthorised'] = "Y";
    include "adminindex.php";
}

?>

and then this at the top of everypage:

PHP: 
<?php
session_start();
if ($_SESSION['AdminAuthorised'] != "Y")		
	header("Location: notauthorised.php");?>
 
Thanks for the replies.

It's just a login system to be used be one person for a mini-CMS I made.

I've not "hased" password because there's only one person that can login but I may do it if you think I should.

Is there anyway that someone could get round my code and login? That's what I want to know.
 
Right ok so without hashing the login is safe BUT if the hacker gains access via some other means on the server, it would be compromised without hashing?
 
You must log in or register to reply here.
Back
Top Bottom