What are some best practices for improving security in PHP scripts that handle user logins?

Issue: One common security vulnerability in PHP scripts that handle user logins is SQL injection. To prevent this, it is important to use prepared statements when interacting with the database to ensure that user input is properly sanitized. Code snippet: 

// Establish a database connection
$servername = "localhost";
$username = "username";
$password = "password";
$dbname = "myDB";

$conn = new mysqli($servername, $username, $password, $dbname);

// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}

// Using prepared statements to prevent SQL injection
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $username);

// Set parameters and execute
$username = $_POST['username'];
$stmt->execute();

// Check if user exists
$result = $stmt->get_result();
if ($result->num_rows > 0) {
    // User found, verify password
    $user = $result->fetch_assoc();
    if (password_verify($_POST['password'], $user['password'])) {
        // Password is correct, proceed with login
        echo "Login successful";
    } else {
        // Password is incorrect
        echo "Incorrect password";
    }
} else {
    // User not found
    echo "User not found";
}

// Close statement and connection
$stmt->close();
$conn->close();

Keywords

password hashing SQL injection prevention CSRF protection secure session management input validation

Related Questions