Secure login script + few questions

Question

I've made a login script for my website and need some feedback as to whether it's secure or not and how I can improve it:

<?php
  session_start();

  $user = "root";
  $host = "localhost";
  $pass = "";
  $db = "test_db";

  $cxn = mysqli_connect($host, $user, $pass, $db) or die ("Couldn't connect to the server. Please try again.");

  if(isset($_POST['submit'])) {
    $username = mysql_real_escape_string(strip_tags(trim($_POST['username'])));
    $password = mysql_real_escape_string(strip_tags(trim($_POST['password'])));
    $message = "";

    $stmt = $cxn->prepare('SELECT * FROM users WHERE username = ?');
    $stmt->bind_param('s', $username);

    $stmt->execute();

    $result = $stmt->get_result();
    while ($row = $result->fetch_assoc()) {
      if(password_verify($password, $row['password'])) {
        $_SESSION['username'] = $username;
        $_SESSION['password'] = $password;
        header("location:index.php");
      } else {
        $message = "The username or password is incorrect.";
      }
    }
}

?>

Also, I'm just learning about sessions and have a few questions:

1. After the user logs in successfully, I need their username to show up on any other page. How can I make the sessions secure?
2. How do I make the "log out" feature end the session?

Answer 1

First of all, you shouldn't apply mysql_real_escape_string on the password field. You're escaping the string before the comparison with the hash stored in the database, so if the password contains specials characters like ' or ", they will get escaped. This will change the output hash, and the login won't work.

Take, for example, password pass123' will become pass123\', which will have a different hash.

Second, it's better if you don't store the plaintext password in the session either, as that means they get written (unencrypted by default) to a file on the disk; even if they're just server-side, if the server would get compromised, all logged-in accounts would be compromised, too. It's better if, after login, you just set the userid or an array/object with the logged-in user info. If that's present, you know the user is logged in, and to logout, you just have to unset the variable from the session.

Third, in order to be totally MySQLi risk-free, you should use prepared statements and PDO. For example:

<?php
    $dbh = new PDO("mysql:host=$host;dbname=$db;charset=utf8'", $user, $pass);

    if(isset($_POST['submit'])) {
        // Prepare the statement
        $stmt = $dbh->prepare("SELECT * FROM users WHERE username=:username");

        // Bind the parameters
        $stmt->bindParam(':username', $_POST['username'], PDO::PARAM_STR);

        // Execute the statement
        $stmt->execute();

        // Get the result
        $user= $stmt->fetch(PDO::FETCH_OBJ);

        if (empty($user) || !password_verify($_POST['password'], $user->password)) {
            $message = 'Login Failed';

        // Login is ok, store the user in the session
        } else {
            $_SESSION['loggedInUser'] = $user;

            $message = 'You are now logged in!';
        }
    }

Answer 2

1. Sessions are server sided, so you don't have to worry about security in that sense. You simply include session_start() at the beginning, and then echo $_SESSION['username']; whenever you want to.

2. To end the session, use session_destroy().

---

Like I said in my comment, you need to use parameterized queries to actually be "secure" when creating your login script.

Answer 3

$password = mysql_real_escape_string(strip_tags(trim($_POST['password'])));

Why are you removing whitespace and tags from the password? What if my randomly generated password was <correct horse battery stapl/>e? Your code would turn that password into e. This is all you should do with a password:

$password = mysql_real_escape_string($_POST['password']);

EDIT: Actually, you don't need to escape the password at all, since you're not using it in a query.

---

Regarding your edit:

$username = mysql_real_escape_string(strip_tags(trim($_POST['username'])));
$password = mysql_real_escape_string(strip_tags(trim($_POST['password'])));
$message = "";

$stmt = $cxn->prepare('SELECT * FROM users WHERE username = ?');
$stmt->bind_param('s', $username);

With parameterized queries, you don't need to escape anything (that's the big advantage), so this should be:

$username = trim($_POST['username']);
$password = $_POST['password'];
$message = "";

$stmt = $cxn->prepare('SELECT * FROM users WHERE username = ?');
$stmt->bind_param('s', $username);

---

For some good news, this may be the first Stack Overflow PHP question where I've seen someone handle passwords correctly:

if(password_verify($password, $row['password'])) {

YES.