I'm new to web development and this is my first website. I was wondering if my login and registration system is secure. I was also wondering how to handle viewing parts of a webpage when the user isn't logged in (ie. hide a section if the user isn't logged in). Sorry in advance if there's irrelevant stuff in the code.
Login.php
<?php
define('DB_HOST', '127.0.0.1');
define('DB_NAME', 'users');
define('DB_USER','root');
define('DB_PASSWORD','db_password');
$con=mysql_connect(DB_HOST,DB_USER,DB_PASSWORD) or die("Failed to connect to MySQL: " . mysql_error());
$db=mysql_select_db(DB_NAME,$con) or die("Failed to connect to MySQL: " . mysql_error());
LogIn();
function LogIn()
{
$log_username = mysql_real_escape_string($_POST['username']);
$log_password = mysql_real_escape_string($_POST['password']);
$query = "SELECT password FROM users WHERE username = '$log_username'";
$storedPassword = mysql_query("SELECT password FROM users WHERE username = '$log_username'");
$row = mysql_fetch_row($storedPassword);
$storedSalt = mysql_query("SELECT salt FROM users WHERE username = '$log_username'");
$saltrow = mysql_fetch_row($storedSalt);
$options = [
'cost' => 12,
];
$hash = password_hash($row, PASSWORD_BCRYPT);
$data = mysql_query ($query)or die(mysql_error());
if($data)
{
if (password_verify($log_password, $row[0]))
{
//echo "Valid login";
session_start();
$_SESSION["uname"] = $log_username;
}
else
{
echo 'Invalid username or password.';
}
}
}
?>
Register.php
<?php
define('DB_HOST', '127.0.0.1');
define('DB_NAME', 'users');
define('DB_USER','root');
define('DB_PASSWORD','db_password');
$con=mysql_connect(DB_HOST,DB_USER,DB_PASSWORD) or die("Failed to connect to MySQL: " . mysql_error());
$db=mysql_select_db(DB_NAME,$con) or die("Failed to connect to MySQL: " . mysql_error());
if(isset($_POST['submit']))
{
NewUser();
}
function NewUser()
{
$reg_email = mysql_real_escape_string($_POST['email']);
$reg_username = mysql_real_escape_string($_POST['username']);
$reg_password = mysql_real_escape_string($_POST['password']);
$reg_repeatpassword = mysql_real_escape_string($_POST['repeatpassword']);
$reg_email = mysql_real_escape_string($_POST['email']);
$reg_hash = mysql_real_escape_string($_POST['password']);
//$options = [
// 'cost' => 12,
//];
$hash = password_hash($reg_hash, PASSWORD_BCRYPT);
if($reg_password != $reg_repeatpassword)
{
echo "Passwords do not match";
}
else
{
$query = "INSERT INTO users (id, username, password, salt, email) VALUES ('', '$reg_username','$hash','','$reg_email')";
$data = mysql_query ($query)or die(mysql_error());
if($data)
{
//echo "Successfully registered";
echo '<script type="text/javascript">alert("Registration successful.");</script>';
}
}
}
?>
Index.php
<body>
<div class="container" align="center">
<?php
if(!isset($_SESSION['uname']))
{
echo "<div style='margin-bottom: 200px; text-align: center;'>Please log in to view uploads.<br>"; echo "</div>";
echo "<div class='container2' align='center'>";
echo "<form action='/login.php' method='post' enctype='multipart/form-data' >";
echo "<label for='username'>Username: </label>";
echo "<input type='text' id='username' name='username'>";
echo "<br>";
echo "<label for='password'>Password: </label>";
echo "<input type='password' id='password' name='password'>";
echo "<div id='lower'>";
echo "<input type='submit' id='submit' value='Log in'>";
echo "</div><!--/ lower-->";
echo "</form>";
echo "</div>";
}
else
{
echo "<div style='margin-bottom: 50px; text-align: center;'>"; echo "<h3>"; echo "Welcome, ". $_SESSION['uname']; echo "</h3>"; echo "</div>";
echo "<div class='logoutbutton' align='center'>";
echo "<form action='/uploads' class='logoutbutton' method='post' enctype='multipart/form-data'><input type='submit' id='submit' value='View uploads'></form>";
echo "<form action='/logout.php' class='logoutbutton' method='post' enctype='multipart/form-data'><input type='submit' id='submit' value='Log out'></form>";
echo "</div>";
}?>
</div>
<!--Version 3.2-->
</body>
