When it come to security I try to be to better as possible but I don't have the knowledge.
According to what I read on-line my following code should be good but I could use some of your comment/critic/fixes
Here is a simple class just to example how I would do a login. Does it look secure enough?
class UserClass
{
private $dbCon = null;
public $Error = '';
public function __construct(PDO $dbCon)
{
$this->dbCon = $dbCon;
}
public function login($Email,$Password,$RegisterCustomerSession = FALSE)
{
$GetSalt = $this->dbCon->prepare('SELECT id,salt,hashPass FROM `customer` WHERE `email` = :Email');
$GetSalt -> bindValue(':Email',$Email);
$GetSalt -> execute();
if($GetSalt -> rowCount() == 0)
{
$this->Error = "No customer is registered with that email";
return false;
}
elseif($GetSalt->rowCount()>0)
{
$CustomerInfo = $GetSalt->fetch(PDO::FETCH_ASSOC);
if(sha1($Password.$CustomerInfo['salt'])==$CustomerInfo['hashPass'])
{
if($RegisterCustomerSession)
self::RegisterAllCustomerSession($CustomerInfo['id']);
return true;
}
else
{
$this->Error = "Invalid Password";
return false;
}
}
}
public function SetPassword($CustomerId,$Password)
{
$Salt = self::CreateSalt(16);
$HashPass = sha1($Password.$Salt);
$SetPasswordAndSalt = $this->dbCon->prepare('UPDATE `customer` SET `hashPass` = :HashPass,`salt` = :Salt WHERE `id` = :CustomerId;');
$SetPasswordAndSalt -> bindValue(':CustomerId',$CustomerId);
$SetPasswordAndSalt -> bindValue(':Salt',$Salt);
$SetPasswordAndSalt -> bindValue(':HashPass',$HashPass);
try{
$SetPasswordAndSalt ->execute();
return true;
}catch(PDOException $e){echo $e->getMessage(); return false; }
}
private function CreateSalt($HowLong = 16)
{
$CharStr = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@#$%^&*()-=+_<>';
$ReturnStr = '';
for($i = 0;$i<$HowLong;$i++)
{
$ReturnStr .= $CharStr{mt_rand(0,77)};
}
return $ReturnStr;
}
private function RegisterAllCustomerSession($CustomerId)
{
// some code.
}
}