obiektowy system autoryzacji Opcje

[tab]

troche mi zajelo zeby ogarnac ten caly oop, wiec jak juz mi sie w koncu udalo to postanowilem sobie cos napisac. moglibyscie to ocenic pod katem bezpieczenstwa i wydajnosci? pozdrawiam

index.php

[PHP] pobierz, plaintext 
<?php ob_start() ?>
 
<meta http-equiv="Content-Type" content="text/html;charset=utf-8">
<a href="index.php">Logowanie</a> <a href="reg.php">Rejestracja</a>
 
<form action="index.php" method="post">
Login: <input type="text" name="login"><br>
Hasło: <input type="password" name="passwd"><br>
<input type="submit" name="log" value="Zaloguj">
</form>
 
<?php
 class User
 {
  private $_login;
  private $_passwd;
  private $_id;
 
  public function __get ($name)
  {
	return $this->getValue($name);
  }
 
  public function __construct ($login,$passwd)
  {
	$this->_login = $login;
	$this->_passwd = sha1($passwd);
  }
 
  public function getValue ($name)
  {
	return $this->$name;
  }
 
  public function auth ()
  {
	$pdo = new PDO('mysql:host=localhost;dbname=DBNAME', 'LOGIN', 'HASLO');
	$stmt=$pdo->query("SELECT id FROM users WHERE login='$this->_login' and passwd='$this->_passwd'");
	$res=$stmt->fetch(PDO::FETCH_ASSOC);
	$stmt->closeCursor();
 
	$this->_id = $res['id'];
 
	if (empty($res)) die('Niepoprawne dane');
  }
 
  public function logme ()
  {
	session_start();
 
	if (!isset($_SESSION['init']))
    {
		session_regenerate_id();
		$_SESSION['init'] = true;
    }
 
	$_SESSION['id'] = $this->_id;
	$_SESSION['login'] = $this->_login;
	header('Location: main.php');
	ob_end_flush();
  }
 }
 
 if (isset($_POST['log']))
 {
	$user = new User(strip_tags(trim($_POST['login'])),($_POST['passwd']));
	$user->auth();
	$user->logme();
 }
 ?>
[PHP] pobierz, plaintext 

reg.php

[PHP] pobierz, plaintext 
<meta http-equiv="Content-Type" content="text/html;charset=utf-8">
<a href="index.php">Logowanie</a> <a href="reg.php">Rejestracja</a>
 
<form action="reg.php" method="post">
Login: <input type="text" name="login"><br>
Hasło: <input type="password" name="passwd"><br>
E-mail: <input type="text" name="email"><br>
<input type="submit" name="register" value="Zarejestruj">
</form>
 
<?php
 class User
 {
  private $_login;
  private $_passwd;
  private $_email;
  private $_ip;
 
  public function __get ($name)
  {
	return $this->getValue($name);
  }
 
  public function __construct ($login,$passwd,$email,$ip)
  {
	$this->_login = $login;
	$this->_passwd = $passwd;
	$this->_email = $email;
	$this->_ip = $ip;
  }
 
  public function getValue ($name)
  {
	return $this->$name;
  }
 
  public function auth1 ()
  {
	if ((strlen($this->_login) < 3) or (strlen($this->_login) > 20)) die('Login musi mieć min. 3 i maks. 20 znaków');
	if (strlen($this->_passwd) < 6) die('Hasło musi mieć min. 6 znaków');
	if (!preg_match('/^[A-Za-z0-9\.\_\-]+\@[a-z0-9]+\.[a-z]{2,4}$/D',$this->_email)) die('Niepoprawny e-mail');
  }
 
  public function auth2 ()
  {
	$pdo = new PDO('mysql:host=localhost;dbname=DBNAME', 'LOGIN', 'HASLO');
	$stmt=$pdo->query("SELECT login FROM users WHERE login='$this->_login'");
	$res=$stmt->fetch(PDO::FETCH_ASSOC);
	$stmt->closeCursor();
	if ($res > 0) die('Ten login jest już zajęty');
 
	$stmt=$pdo->query("SELECT email FROM users WHERE email='$this->_email'");
	$res=$stmt->fetch(PDO::FETCH_ASSOC);
	$stmt->closeCursor();
	if ($res > 0) die('Ten e-mail jest już zajęty');
  }
 
  public function addUser ()
  {
	$pdo = new PDO('mysql:host=localhost;dbname=DBNAME', 'LOGIN', 'HASLO');
	$stmt=$pdo->prepare('INSERT INTO users (login,passwd,email,ip) VALUES (:login,:passwd,:email,:ip)');
	$stmt->bindValue(':login',$this->_login,PDO::PARAM_STR);
	$stmt->bindValue(':passwd',sha1($this->_passwd),PDO::PARAM_STR);
	$stmt->bindValue(':email',$this->_email,PDO::PARAM_STR);
	$stmt->bindValue(':ip',$this->_ip,PDO::PARAM_STR);
	$num=$stmt->execute();
  }
 }
 
 if (isset($_POST['register']))
 {
	$user = new User(strip_tags(trim($_POST['login'])),$_POST['passwd'],strip_tags(trim($_POST['email'])),$_SERVER['REMOTE_ADDR']);
	$user->auth1();
	$user->auth2();
	$user->addUser();
	echo 'Rejestracja ukonczona.';
 }
[PHP] pobierz, plaintext 

main.php

[PHP] pobierz, plaintext 
<?php ob_start() ?>
 
<meta http-equiv="Content-Type" content="text/html;charset=utf-8">
 
<?php
 session_start();
 if (!isset($_SESSION['id'])) die('Taka sesja nie istnieje!');
 
 if (!isset($_SESSION['init']))
 {
	session_regenerate_id();
	$_SESSION['init'] = true;
 }
 
 echo 'Witaj '.$_SESSION['login'].' ';
 echo '<a href="main.php?action=0">wyloguj</a>';
 
 if (isset($_GET['action']))
 {
	switch ($_GET['action'])
	{
		case 0:
		unset($_SESSION['id']);
		unset($_SESSION['login']);
		session_destroy();
		header('Location: index.php');
		ob_end_flush();
		break;
	}
 }
 ?>
[PHP] pobierz, plaintext 

PS: głupi problem ale co zrobic zebym nie musiał pisac $pdo = new PDO(...) w kazdej metodzie w ktorej potrzebuje wykonac zapytanie do bazy? np. w reg.php wpisuje to samo w metodzie auth2 i addUser. gdy chcialem wrzucic to do konstruktora to byl problem taki, ze te dwie metody nie wiedzialy czym jest $pdo w wyrazeniu $stmt=$pdo.. tak wiec jak to obejsc?