Logowanie PHP PDO Opcje

[seba199696]

Cześć wszystkim (IMG:style_emoticons/default/smile.gif)

Napisałem logowanie do serwisu i wszystko działa poprawnie lecz proszę o wasze sugestię na temat bezpieczeństwa skryptu. Proszę o wyrozumiałość (IMG:style_emoticons/default/smile.gif) Pozdrawiam!

Daję kod:

[PHP] pobierz, plaintext 
<?php
session_start();
?>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
 
	<form method="post" action="login.php">
		 <input type="text" name="email"/>
   		 <input type="password" name="password"/>
   		 <input type="submit" name="submit"/>
	</form>
<?php
 try
   {
	  //conect
      $pdo = new PDO('mysql:host=localhost;dbname=user', 'user', '***');
      $pdo -> setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
 
  if(isset($_POST['submit'])) {
 
	if(filter_var($_POST['email'], FILTER_VALIDATE_EMAIL))
	{
 
    $password = sha1($_POST['password'].'sad8%$9sdk');
 
	$stmt = $pdo -> prepare('SELECT `email`, `password`,`id` FROM `users` WHERE `email` = :email AND `password` = :password'); 
 
                        $stmt -> bindValue(':email', $_POST['email'], PDO::PARAM_STR);
			$stmt -> bindValue(':password', $password, PDO::PARAM_STR);
                        $stmt -> execute(); 
 
						$count = $stmt ->rowCount();
 
						if($count > 0) {
 
							 while($row = $stmt -> fetch())
      						{
								 session_regenerate_id (true);
 
								 $_SESSION['status'] = true;
          						         $_SESSION['id'] = $row['id'];
								 $_SESSION['HTTP_USER_AGENT'] = sha1($_SERVER['HTTP_USER_AGENT'].'dsd#$%^');
 
								 header('Location: home.php');
      						}
 
						} else {
 
						echo "Logowanie zakończone niepowodzeniem!";
 
						}
 
	} else {
 
	echo 'Adres e-mail niepoprawny';
 
	}
 
 }
  }
   catch(PDOException $e)
   {
      echo 'Error: ' . $e->getMessage();
   }
?>
[PHP] pobierz, plaintext 

[seba199696]

Wkleję za niedługo poprawiony skrypt (IMG:style_emoticons/default/smile.gif)

[PHP] pobierz, plaintext 
<?PHP
session_start();
if(isset($_POST['submit'])) {
 
	if (preg_match("/^(?=.*[A-Z])(?=.*[a-z])(?=.*[0-9])(?=.*[!@#$%^&*()_+|-]).{8,30}$/",$_POST['password'])) {
 
		if(preg_match('/^[a-zA-Z\.\-\_]+\@[a-zA-Z0-9\.\-\_]+\.[a-z]{2,4}$/D', $_POST['email'])) {
 
		try
  		 {
	  	  $pdo = new PDO('mysql:host=localhost;dbname=user', 'user', '***');
     	          $pdo -> setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);	
 
		  $password = sha1($_POST['password'].'sad8%$9sdk');
 
		        $stmt = $pdo -> prepare('SELECT `email`, `password`,`id` FROM `users` WHERE `email` = :email AND `password` = :password'); 
 
                        $stmt -> bindValue(':email', $_POST['email'], PDO::PARAM_STR);
			$stmt -> bindValue(':password', $password, PDO::PARAM_STR);
                        $stmt -> execute(); 
 
						$count = $stmt ->rowCount();
 
						if($count > 0) {
 
							while($row = $stmt -> fetch())
      						{
								 session_regenerate_id (true);
 
							        $_SESSION['status'] = true;
          						        $_SESSION['id'] = $row['id'];
							        $_SESSION['HTTP_USER_AGENT'] = sha1($_SERVER['HTTP_USER_AGENT'].'dsd#$%^');
 
							      // last active the user ip 
								$stmt = $pdo -> prepare('UPDATE `users` SET `ip` = :ip WHERE `id` = :id');     
 
                        	                        	$stmt -> bindValue(':ip', $_SERVER['REMOTE_ADDR'], PDO::PARAM_STR);
                        		                        $stmt -> bindValue(':id', $row['id'], PDO::PARAM_STR);
 
                       		                                $stmt -> execute(); 
							     // 
 
								 header('Location: index.php');
      						}
 
						}
		 }
 
	 	 catch(PDOException $e)
  		 {
         echo 'Error: ' . $e->getMessage();
  		 }
			} else { echo "Email error"; }
				} else { echo "Hasło error"; } 
					} else { echo "Formularz error"; }
 
?>
 
[PHP] pobierz, plaintext 

Ten post edytował seba199696 16.11.2011, 23:02:52