我的方法验证用户登录的安全性如何？

Question

I am creating a directory for local businesses in my town. I am allowing each business to create a profile on the site where they can upload contact info, photos, their location on a Google map, etc.

I have a good knowledge of php but I wouldn't be anywhere near industry standard.

I'm just looking for some advice on authenticating that the business is logged in on the admin pages. The way I have it at the moment is that when their username and password have been verified I create a session for them:

$_SESSION['session_businessid']

This is basically just a session with their business ID that is taken fem the businesses table in the mySQL database.

Then on each page that requires the business to be logged in I include a php file called verify_logged_in.php which contains the following code:

<?php
session_start();

if ($_SESSION['session_businessid'])
{
    $BusinessID = $_SESSION['session_businessid'];
}
else
    header ("location: /admin/login.php");
?>

I'm just wondering how secure/unsecure this method is and if there's any better way of doing it?

Answer 1

This is not secure enough as you are store session variables in default php sessions. You must use secure sessions in order to protect the information being hacked or misused by session hijacking, XSS attack, etc. You may use the following link to guide you on how to create secure php sessions- Create-a-Secure-Session-Managment-System-in-Php-and-Mysql.

Alternatively, if you want a simpler but a less secure session, then you can use the following code:

sessions.php:

function sec_session_start() {
        $session_name = 'sec_session_id'; // Set a custom session name
        $secure = false; // Set to true if using https.
        $httponly = true; // This stops javascript being able to access the session id. 

        ini_set('session.use_only_cookies', 1); // Forces sessions to only use cookies. 
        $cookieParams = session_get_cookie_params(); // Gets current cookies params.
        session_set_cookie_params($cookieParams["lifetime"], $cookieParams["path"], $cookieParams["domain"], $secure, $httponly); 
        session_name($session_name); // Sets the session name to the one set above.
        session_start(); // Start the php session
        session_regenerate_id(); // regenerated the session, delete the old one.

anypage.php:

include 'sessions.php';
sec_session_start();
//rest of the code.

Also, the methods you are using for login will make a difference in the security of the stored information of the businesses.