Posted by What nickname do you want? on 12/21/05 13:08

I want to provide secured acces to a MySQL database. This is what I've
done. Firstly the relevant pages are in a folder to which Apache
requires password authentication. Then I have an HTML page with a form
to enter (MySQL) ID and password, which I POST to a PHP page which
tries to connect to the MySQL database, and if so starts a session...

$id = $_POST['ID'];
$pass=$_POST['password'];
if ($connect=mysql_pconnect("localhost",$id,$pass) )
{
session_start();
echo "Connected - using database 'test'<br>";
mysql_select_db("test");
$_SESSION["id"]=$id;
$_SESSION["password"]=$pass;
$_SESSION["start"]=time();
}
else
{
header("Location: http://127.0.0.1");
exit();
}

Subsequent PHP pages are like:

session_start();
$id=$_SESSION["id"];
$pass=$_SESSION["password"];
$start=$_SESSION["start"];
$duration = time()-$start;
if ($duration>10)
{
session_destroy();
header ("Location: http://127.0.0.1/timeout.htm");
exit();
}
$_session["start"]=time();

$connect=mysql_pconnect("localhost",$id,$pass);
$myQuery=...

Is this reasonably secure? What are the obvious holes? TIA

[Back to original message]