防止对php登录系统的恶意攻击

Question

I'm developing a C# application that allows the user to register and login. I'm planning to use MySQL database and PHP on server side code. Here is the server-side code that I plan to use. This code copied from the below two articles.

(Secure) PHP Login System (Protected Against SQL-Injections)
Login System with PHP

register.php

<?php
$conn = new mysqli("db4free.net", "csharptricks", "12345678", "csharptricks");

$username = $_POST["username"];
$password = $_POST["password"];
$hashedpw = md5($password);

$stmt = $conn->prepare("SELECT username FROM Users WHERE username = ?");
$stmt->bind_param("s", $username);
$stmt->execute();
$stmt->store_result();

if ($stmt->num_rows > 0) {
     echo "Existing";
}
else { 
     $stmt = $conn->prepare("INSERT INTO Users (username, password) VALUES (?, ?);");
     $stmt->bind_param("ss", $username, $hashedpw);
     $stmt->execute();
     echo "Success";
}
?>

login.php

<?php
session_start();

$conn = new mysqli("db4free.net", "csharptricks", "12345678", "csharptricks");

$username = $_POST["username"];
$password = $_POST["password"];
$hashedpw = md5($password);

$stmt = $conn->prepare("SELECT username, password FROM Users WHERE username = ? LIMIT 1");
$stmt->bind_param("s", $username);
$stmt->execute();
$stmt->bind_result($output1, $output2);
$row = $stmt->fetch();

if($output2 == $hashedpw) { 
    $_SESSION["username"] = $username; 
    echo "LoginGood"; 
} 
else { 
    echo "LoginBad"; 
} 
?>

I'm new to PHP, so I would like to know from experts is there any risk at this code. Any advice and suggestions are highly appreciated.

Thanks in advance.

Answer 1

If you're using PHP 5.5.0 or above, it is preferable if you can use in-built password_hash() function in order to generate hashed passwords. password_hash() creates a new password hash using a strong one-way hashing algorithm.

string password_hash ( string $password , int $algo [, array $options ] )

The following algorithms are currently supported:

• PASSWORD_DEFAULT - Use the bcrypt algorithm (default as of PHP 5.5.0). Note that this constant is designed to change over time as new and stronger algorithms are added to PHP. For that reason, the length of the result from using this identifier can change over time. Therefore, it is recommended to store the result in a database column that can expand beyond 60 characters (255 characters would be a good choice).

• PASSWORD_BCRYPT - Use the CRYPT_BLOWFISH algorithm to create the hash. This will produce a standard crypt() compatible hash using the "$2y$" identifier. The result will always be a 60 character string, or FALSE on failure.

• PASSWORD_ARGON2I - Use the Argon2 hashing algorithm to create the hash.

To verify password hashed using password_hash() , you need to use password_verify() function.

bool password_verify ( string $password , string $hash )