Reply to thread

Message

<blockquote data-quote="griimnak" data-source="post: 354439" data-attributes="member: 35695">please move this thread if it's in the wrong section&nbsp; <img src="/styles/default/xenforo/smilies/emojione/thumbsup.png"&nbsp; class="smilie" loading="lazy" alt=":up:" title="Thumbs Up&nbsp; &nbsp; :up:" data-shortname=":up:" />Been working on my personal cms for awhile and i managed to finish some pretty unique features.<img src="http://i.imgur.com/z7jpAsG.png" alt="" class="fr-fic fr-dii fr-draggable " style="" />Don't take that warning message so lightly, it actualy means what it says.Cross-site request forgery is often forgotten when developers write their code, so i made sure i'm protected against it.<img src="http://i.imgur.com/V82aJz4.png" alt="" class="fr-fic fr-dii fr-draggable " style="" />there will be a hidden token generated every instance of the page load. if a request is made and this token is changed at all, it will stop the request and log the ip etc into the database.<img src="http://i.imgur.com/8pjjXLp.png" alt="" class="fr-fic fr-dii fr-draggable " style="" />Since this is an admin panel, i'm going to log failed login attempts aswell.<img src="http://i.imgur.com/xYRHRJ2.png" alt="" class="fr-fic fr-dii fr-draggable " style="" />The ability to ban certain ip addresses is also done<img src="http://i.imgur.com/2sSYszI.png" alt="" class="fr-fic fr-dii fr-draggable " style="" /><img src="http://i.imgur.com/qraZ8og.png" alt="" class="fr-fic fr-dii fr-draggable " style="" />maintenance is also finished<img src="http://i.imgur.com/jHgxSM4.png" alt="" class="fr-fic fr-dii fr-draggable " style="" /><img src="http://i.imgur.com/oADBgQO.png" alt="" class="fr-fic fr-dii fr-draggable " style="" />I'm also using prepared statements to ensure i'm protected from sql injections.[PHP]query = Database::dbConnect()-&gt;prepare(&quot;SELECT username, password FROM gweb_users WHERE username=:username AND password=:password&quot;);&nbsp; &nbsp; &nbsp; &nbsp; $query-&gt;bindParam(':username', $secure_user);&nbsp; &nbsp; &nbsp; &nbsp; $query-&gt;bindParam(':password', $secure_pass);&nbsp; &nbsp; &nbsp; &nbsp; $query-&gt;execute();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if($row = $query-&gt;fetch()){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $_SESSION['username'] = $row['username'];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; header(&quot;Location: admin_dash&quot;);&nbsp; &nbsp; &nbsp; &nbsp; } [/PHP]Thoughts? how can i make the design prettier (i suck at designing) and what other functions should i include? cheers</blockquote>

[QUOTE="griimnak, post: 354439, member: 35695"] [I]please move this thread if it's in the wrong section [/I]:up: Been working on my personal cms for awhile and i managed to finish some pretty unique features. [IMG]http://i.imgur.com/z7jpAsG.png[/IMG] Don't take that warning message so lightly, it actualy means what it says. Cross-site request forgery is often forgotten when developers write their code, so i made sure i'm protected against it. [IMG]http://i.imgur.com/V82aJz4.png[/IMG] there will be a hidden token generated every instance of the page load. if a request is made and this token is changed at all, it will stop the request and log the ip etc into the database. [IMG]http://i.imgur.com/8pjjXLp.png[/IMG] Since this is an admin panel, i'm going to log failed login attempts aswell. [IMG]http://i.imgur.com/xYRHRJ2.png[/IMG] The ability to ban certain ip addresses is also done [IMG]http://i.imgur.com/2sSYszI.png[/IMG] [IMG]http://i.imgur.com/qraZ8og.png[/IMG] maintenance is also finished [IMG]http://i.imgur.com/jHgxSM4.png[/IMG] [IMG]http://i.imgur.com/oADBgQO.png[/IMG] I'm also using prepared statements to ensure i'm protected from sql injections. [PHP]query = Database::dbConnect()->prepare("SELECT username, password FROM gweb_users WHERE username=:username AND password=:password"); $query->bindParam(':username', $secure_user); $query->bindParam(':password', $secure_pass); $query->execute(); if($row = $query->fetch()){ $_SESSION['username'] = $row['username']; header("Location: admin_dash"); } [/PHP] Thoughts? how can i make the design prettier (i suck at designing) and what other functions should i include? cheers [/QUOTE]

Verification

Reply to thread

Connect with us

Newest members