I am building a small cms system. The user can login and edit, delete or create a new item in the database.
My question is. Is this login system safe enough?
<?php
session_start(); ?>
<!DOCTYPE HTML>
<html>
<head>
<meta charset="utf-8">
<title>.....</title>
</head>
<body>
<?php
include 'koder.inc.php';
if(!isset($_POST['forsoeg'])){
$forsoeg = 0;
$check_user='0';
$check_pass='0';
} else {
$forsoeg = $_POST['forsoeg'];
$check_user = $_POST['username'];
$check_pass = $_POST['password']; }
if($check_user != $username || $check_pass != $password) {
if($forsoeg >3){
exit("<p>Wrong password or username <br /><br />
<a href='admin_logon.php'>back to login</a></p>");}
$forsoeg ++;
?>
<h1>Login</h1>
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post" name="form">
<p>
<label for="username">username:</label>
<br />
<input title="username:" type="text" name="username" />
</p>
<p>
<label for="password">Password:</label>
<br />
<input title="Skriv dit password" type="text" name="password" />
</p>
<p>
<input class="knap" type="submit" name="Send" value="Login" />
</p>
<input type="hidden" name="forsoeg" value="<?php echo $forsoeg; ?>" />
</form>
<?php
} else {
$_SESSION['logon']="ok";
echo "Login ok..<br />
<a href='administration.php'>Go to admin page</a>"; } ?>
</body>
</html>
I then include the fil koder.inc.php
<?php
$username = "test";
$password = "123456";
?>
And on the pages that need a valid user i start the page with
<?php
session_start(); ?>
