CODEWITHSUNDEEP
phpauthenticationgethidden-variables
Dave Salomon
Dave Salomon

Reputation: 3287

PHP: Using hidden GET variable as login?

I'm looking at doing a very basic authentication script as follows:

<?php
   // admin.php
   session_start();

   if($_GET['login'] == 'adminLoginWord')
   {
       $_SESSION['auth'] = true;
   }

   if($_SESSION['auth'])
   {
       // code to show Admin control panel
   }
   else
   {
       echo 'Please login.';
   }

Therefore, to login, someone would need to know to navigate to the URL 

admin.php?login=adminLoginWord

Is this a safe way of authentication?

Upvotes: 1

Views: 289

Answers (7)

Dave Salomon
Dave Salomon

Reputation: 3287

In this case in particular, I was just being thick, and making it more complicated than needs be.

A .htaccess file was more than sufficient for this... woops!

Upvotes: 1

SuperRod
SuperRod

Reputation: 557

I understand your wanting to do easy basic authentication and everyone here has had valid security suggestions. If you really don't mind security but want it more secure than having credentials passed in the URL, you could try something like this (of course you could add a lot more HTML in the form/page area):

/* admin.php */
<?php

$username = "adminLoginWord";
$password = "adminLoginWordPassword";
$msg = "";

if ($_POST['mySiteUsername'] == $username && $_POST['mySitePassword'] == $password){
  $_SESSION['auth'] = true;
} else {
  $msg = "Invalid Username/Password Combination";
}

if(!$_SESSION['auto']){
  $html = "<html>
  <body>
    <div class='error'>$msg</div>
    <form action='admin.php' method='POST'>
       <label for='mySiteUsername'>Username:</label>
       <input type='text' name='mySiteUsername' />
       <label for='mySitePassword'>Password:</label>
       <input type='password' name='mySitePassword' />
    </form>
  </body>
  </html>";
} else {
  // Authorized
}
?>

Upvotes: 0

sdjuan
sdjuan

Reputation: 719

No it's not safe.

You should instead use POST and also use HTTPS

Upvotes: 0

haltabush
haltabush

Reputation: 4538

You have to be aware that, if you use this system, your password will be stored in any browser saving history. One can even add this as a bookmark...

Upvotes: 0

Pramod
Pramod

Reputation: 1

Encrypt your password and then send it over GET or use POST

Upvotes: -1

Vodun
Vodun

Reputation: 1385

No it's not safe. You can hash your special login with sha1 and test if that sha1 is equal to the sha1 of 'adminLoginWord'.

Furthemore, in your case, you should use a POST.

Upvotes: 0

Alejandro Urbano Alvarez
Alejandro Urbano Alvarez

Reputation: 3346

It's not safe at all, you would leave the "password" in the computer's history, it would be very vulnerable to anyone sniffing... etc

This said, safe always depends on the application, but if you want a safer approach, use a POST variable and compare it like so:

if($_POST['pass'] == 'password123'){
    echo 'Login OK';
}

(Which still isn't the best approach, but it's better than a GET variable)

Upvotes: 3

Related Questions