1. Web Programming Language
Chapter 7

2. Cookies, Sessions & Security
PHP Login Script
Online Security Threats

3. Security
Last chapter we allowed PHP scripts to write data to a database, but gave very little consideration to security.
Security is a constantly evolving field, so this isn’t a complete guide to security.
Security threats include SQL injections, Brute Force attacks
In a calendar, only the owner of the calendar should be able to create appointments – but how do you find out who it is?
Login through passwords?
Form Validation?
HTTP is a stateless protocol – each request is treated independently, and the server doesn’t keep track of the state of any client.

4. Cookies
Small pieces of data sent from a website and stored in the user’s browser.
The cookie could store whether a user is logged in, and some data about which user it is.
Cookies are key=>value pairs
Cookies can contain up to 4,096 bytes of data, and each domain could store up to 50 cookies
Note – later we will discuss Local Storage from HTML5, which changes Cookies…

5. PHP & Cookies PHP can set cookies, using the setcookie() function.
$name = “user”; $value = “John”; setcookie($name, $value, time() + (60*60*24));
Notice that the cookie is set for a time period in seconds
The cookie is then sent to the server along with any page request within the superglobal array $_COOKIE
Similar to the $_POST and $_GET arrays discussed previously

6. PHP and Cookies
The server can then check if the cookie exists and access it.
if(isset($_COOKIE[‘user’])) { $user = $_COOKIE[‘user’]; } echo “Welcome “ . $user;
Cookies will naturally expire, but can be deleted by setting a timestamp in the past
setcookie(“user”, “John”, time() -1);

7. Sessions
Cookies are stored on the client machine, while sessions are stored on the server, with an identifying cookie on the client.
A session is a period of time when a user is doing some tasks – logging in, doing some tasks and then leaving.
PHP sessions are created using a call to ‘session_start()’, after which variables can be stored in the $_SESSION super global array
<?php session_start(); $_SESSION[‘name’] = “John”; echo $_SESSION[‘name’]; ?>

8. Sessions Session variables can be removed using
session_unset()
Sessions can be completely removed using
session_destroy()

9. Secure PHP Login Script
The book contains a tutorial for setting up a Login Script…
An alternative is here…
But…

10. Online Security Threats
SQL Injections
Consider this SQL Query
<?php $sql = “SELECT * FROM users WHERE username = ‘” . $username . “’;”; ?>
If the user was to submit this
‘ OR ‘1’=’1’; DROP TABLE users;
Without carefully processing the input, the server would see the following query
SELECT * FROM users WHERE username = ‘’ OR ‘1’=’1’; DROP TABLE users;
It is important to use Prepared Statements, and to escape a SQL statement using mysqli_real_escape_string()

11. Online Security Threats
Session Hijacking
What if I was to steal your session?

12. Key Points
HTTP is a stateless protocol, so the server doesn’t store the state of each client that connects to it.
Cookies can be used to store data in the user’s browser so that the server can identify which browser has made the request. However, as they are stored on the client machine, the server has limited control over them.
A session stores data on the server, with an identifying cookie on the client machine.
Sessions can be used to secure certain webpages, meaning a user has to login to access it.
Passwords should be secured before being sent over the web.
SQL injections and session hijacking are just 2 security threats that users need to be protected from.