"Dynamics" sessions

Question

We have a login form that is processed by php and ajax. The ajax sends a request to the php page with the username and password to be logged in. It gets a response and if it's correct and working info, it logs them in:

The php page that takes requests has this code:

        echo (checkLogin($_POST['user'], $_POST['pass']) ? 'true' : 'false');
        if(checkLogin($_POST['user'], $_POST['pass']) == true)
        logIn($_POST['user'], $_POST['pass']);

The functions used in that statement:

function logIn($user, $pass)
    {
            $_SESSION['sid'] = md5(md5($user) . md5($pass));
            $_SESSION['username'] = $user;
            $_SESSION['password'] = $pass;
    }

    function checkLogin($user, $pass)
    {
        $user = strtolower($user);
        $pass = strtolower($pass);

        $res = mysql_query("SELECT * FROM users WHERE username='".$user."'");
        if(mysql_num_rows($res) == 1)
        {
            $data = mysql_fetch_assoc($res);
            if($data['pass'] == aCrypt($pass))
            {
                return true;
            }
            else
            {
                return false;
            }
        }
        else
        {
            return false;           
        }
    }

Now, it seems that the session is started and only able to be seen AFTER the user reloads the page. We need it to start the session right on the page...would we need to refresh the entire page with ajax? I don't really know where to go from here.

Please look up SQL injection (http://stackoverflow.com/questions/332365/xkcd-sql-injection-please-explain) and also consider using `session_regenerate_id` after login to prevent session fixation attacks (http://en.wikipedia.org/wiki/Session_fixation). — El Yobo, May 23 '11 at 01:51

score 0 · Answer 1 · answered May 23 '11 at 01:53

0

You probably want to use the Post-Redirect-Get pattern; after the user is successfully authenticated, use a redirect to send him to a new page.

As I noted above, please look into fixing the SQL injection and session fixation vulnerabilities in your code as well.

answered May 23 '11 at 01:53

El Yobo

14,823
5
60
78

SQL injection is already fixed. At the top of the userActions page all of the post data is sanitized with a custom function I wrote up. Thanks though. – Mitchell M May 23 '11 at 16:51
Doing it that way is going to cause you pain in the long run (mainly because you have to always do it right). Look into prepared statements with PDO, it's easier and safer. – El Yobo May 23 '11 at 22:04

"Dynamics" sessions

1 Answers1