PHP和MySQL登录安全性疑虑

Question

I am totally new to PHP and mySQL and I built a small login form for my website. As the descriptions on the internet for such a thing are much more extensive, I just want to ask you if this is a secure way to do it, as it was just a few lines and it works:

First I create a table in phpMyAdmin with username and password (hashed with md5). After that I run the login on the website with the following script, where the $_POST stuff comes from a form.

<?php
    session_start();
    $db = @mysqli_connect("...", "...", "...") or
    die("Connection failed!");
    mysqli_select_db($db,'...'); 
    if(isset($_POST['username']))
    {
        $_SESSION['user'] = $_POST['username'];
        $_SESSION['password'] = md5($_POST['password']);
        $user = $_SESSION['user'];
        $password = $_SESSION['password'];
        $sql = "SELECT * FROM logins WHERE username = \"$user\"";
        $result = $db->query($sql);
        $row = $result->fetch_assoc();
        if($row["password"] == $password)
        {
            $_SESSION['logged'] = "loggedin";
        }
    }
?>

The Logout Script is very easy as well.

<?php
    session_start();
    session_destroy();
    unset($_SESSION['user']);
    unset($_SESSION['password']);
    header('Location: ../index.php');
?>

Moreover I restrict every private content with

<?php
     if (isset($_SESSION['logged']))
     {
         $temp = $_SESSION["user"];
         echo "Hello $temp, nice to see you!";
     }
?>

or I make a redirection.

So here are my questions:

1. Is this a secure way to do it? Can It be hacked easily?
2. What sense does md5 make if a reverse lookup is possible?

Thank You!

Answer 1

You gotta lot of work ahead of you. Here are some good places to start. Take the ideas from here and Google because there is a lot of information out there that you will need to tap into.

For how to both server and submit the page see here Is HTTPS as the form's action enough?

For how to hash see here (currently my choice) Password Hashing Functions

Lastly read up on form validation and input sanitizing a good SO post is What's the best method for sanitizing user input with PHP?

Also, as one of the comments points out look into Prepared Statements

Hope this helps get you started on your journey.

Answer 2

You have no security whatsoever, since you are POSTing both the username and the password. They are sent over the internet in clear text, unless you are using HTTPS. The MD5 encoding is pretty useless too.

A more secure way would be to encode the password BEFORE POSTing it, ideally with an expiring timestamp, so it cannot be reused after x amount of time.

Also, your sql statement uses a POSTed value without any sanitizing, this exposes your database to sql injection...

Please don't use your code on any strategic database.