How safe is validating users in SQL from $_COOKIE["username"]?

Question

$user = $_COOKIE["username"];
$admin = $db->query("
    SELECT *
        FROM users
        WHERE username = '$user'
        AND admin = '1' -- if 1, user is an administrator
");
if ($admin->rowCount()==1) {
    //stuff related to admin controls/admin specific pages
}

How safe is this for validating a user is an administrator? Can an end user edit their cookie information, and if they know the administrator's name they can gain access somehow? If this is a case, should $user also be sanitized to prevent malicious behavior?

Answer 1

I think you're misunderstanding the concept of logging in and what happens after that.

In your code, how do they get the cookie in the first place so you can log them in? It's the other way around.

You first register someone by taking their chosen username and password and saving those to the database. Later, to log them in, they use login form and you take their inputted username and password and verify it matches those stored in the database. No use of sessions or cookies so far.

So if the username and password matches together in the db then they have confirmed credentials (note in this scenario you will need unique usernames, otherwise, however unlikely, if two people had the same username/password they would both access the first account in the db)

Now, if you want to check throughout your site they are logged in or not (of course) you need to set a session when you verify their credentials are good. This will store some data about them, which on each page you can check and verify they are logged in. This can be their username, whatever.

You can go to any length here, and check their IP still matches on each page etc. Ssessions are hard to hack, and likely if someone has hacked a session on a server they have access to all manner of other things anyway (it's safe to use sessions).

By default on most servers, a session will actually use a cookie as well, it's the session ID for the session stored on the server. So when you get session data for a user it gets the ID from that users sores cookie and access the relevant info stored on the server.

Don't store sensitive info in the session/cookie.

For storing their password, you want to use crypt (not md5 or sha) and use a salting method with it, such as blowfish.

Answer 2

You can manipulate cookies on your own machine. A better approach would be to assign the logged in user a random token that you can cross reference with the database to pull the user's level.

You should always sanitize input before using it in a query.

So create a table for logins and generate a random string to use as an access token. Look into the php crypt function to help generate the string and store that token and that token alone in the cookie. You can store just the user id and the token in the login table, then join with the user table to fetch level from there.

You can choose to cycle the tokens per page use or something to increase the improbability of someone else guessing a token and hijacking an admin session.

To increase the security on it, you can store a timestamp and invalidate the token after a certain time frame.

Answer 3

Absolutely zero security! Never, never use the method you described above.

Instead, consider the following alternative with sessions

session_start();

// Set this when the user logs in.
// Then it can be read on subsequent requests and the data stored
// on the server and never accepted from the client.
$_SESSION["username"] = "Bob";

$user = $_SESSION["username"];
$admin = $db->query("
    SELECT *
        FROM users
        WHERE username = '$user'
        AND admin = '1' -- if 1, user is an administrator
");
if ($admin->rowCount()==1) {
    //stuff related to admin controls/admin specific pages
}