Making A Secure Login

Question

I have been trying to make a secure login for my site that I am developing.

I just cant get it to work, I use MySQL databases with PHP.

I can make the form to add the user and their info to the database but I can't seem to make it work with the login.

What type of encryption is used with HTML <input type="password">?

How do I keep the User logged in throughout their visit to my site?

I how do I securely check if it is the right password that matches the username?

I have been doing PHP for maybe a year now, I just haven't learned this part yet so it would be nice to know.

Answer 1

What type of encryption is used with html < input type=password >??

None. The input is just masked to protect against "Looking at the monitor" attacks.

If you want security, transmit your data over HTTPS (HTTP with SSL).

How do I keep the User logged in throughout their visit to my site?

Most people use cookies.

I how do i securely check if it is the right password that matches the username??

Securely?

Don't use a shared server. Follow the normal steps for keeping data on that server secure. Store passwords as hashes, not as plain text.

Check?

Convert the submitted password to the matching hash, then compare as normal. Assuming you store the data in a database, just SELECT FROM users WHERE user=? AND password=? and count the number of rows you get back.

Answer 2

I'll address the password protection portion of your question.

There is no built in encryption with the password input type. The browser will submit it as plain text just like everything else. There are two ways to protect the password.

The first is to set up a challenge/response system but this will require Javascript to work. Basically you take the user's password, apply a hashing function if that's the way it's stored on the server, then you take a server challenge token and salt the password value for a new hash. The server will take it's value of the password and apply the challenge as well. If they match the password is correct and there is no way for anyone to know what the actual password was. This requires javascript because the hash must be produced on the client side if this approach is to be effective.

Another, more simple option, is to require HTTPs for the log in portion of the site.