title: php login form - security basics
body: <p>again a simple but not very obvious question from me. This time is login in PHP and the session.</p>
  
  <p>AS far as I understand the security side of it:</p>
  
  <ul>
  <li><p>checking all the variables before sending to MySQL</p></li>
  <li><p>using $_POST for hiding info</p></li>
  <li><p>and logging the sessions</p></li>
  </ul>
  
  <p>Well I have some code 'learned/made' but if you could spot out things that I am missing with a little explanation I would very much appreciate and also could be useful for many beginners like me. (I have read so many questions about it but most of the time the answer started - Despite the fact the code is disastrous in many ways, the specific answer to...) </p>
  
  <p>So here there are:</p>
  
  <p>index.php
     </p>
  
  <pre><code>&lt;html&gt;
  &lt;head&gt;
  &lt;title&gt;Website&lt;/title&gt;
  &lt;meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"&gt;
  &lt;/head&gt;
  
  &lt;body&gt;
  &lt;ul&gt;&lt;li&gt;&lt;a href="index.php"&gt;HOME&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="menu1.php"&gt;menu1&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="logout.php"&gt;logout&lt;/a&gt;&lt;/li&gt;&lt;/ul&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>session.php:</p>
  
  <pre><code>&lt;?php 
  session_start(); 
  if (!isset($_SESSION["txtUserId"])) { 
  require "login.php"; 
  exit; 
  }
  </code></pre>
  
  <p>login.php
      
  
  <pre><code>require_once('db_connect.php');
  
  $errorMessage = '';
  if (isset($_POST['txtUserId']) &amp;&amp; isset($_POST['txtPassword'])) {
   // check if the user id and password combination is correct
   $random = '$%hgy5djk3tgbG^bhk';;
   $logname=htmlspecialchars($_POST['txtUserId']);
   $pass=sha1(($_POST['txtPassword']).$random)
  
   $sql = "SELECT user, pass FROM users WHERE username= :login";
   $stmt = $db-&gt;prepare($sql);
  
    $stmt-&gt;bindvalue( ':login', $logname);
    $stmt-&gt;execute();
   if $stmt['pass']==$pass {
  
     // set the session
     $_SESSION['basic_is_logged_in'] = true;
     header('Location: main.php');
    exit;
   }
  else {
   $errorMessage = 'Sorry, wrong user id / password';
   require "login.php"; 
   } 
  }
  ?&gt;
   &lt;html&gt;
   &lt;head&gt;
   &lt;title&gt;Login ...&lt;/title&gt;
   &lt;meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"&gt;
   &lt;/head&gt;
  
   &lt;body&gt;
   &lt;?php
   if ($errorMessage != '') {
    ?&gt;
  &lt;p align="center"&gt;&lt;strong&gt;&lt;font color="#990000"&gt;&lt;?php echo $errorMessage; ?&gt;&lt;/font&gt;&lt;/strong&gt;&lt;/p&gt;
  &lt;?php
  }
  ?&gt;
  &lt;form method="post" name="frmLogin" id="frmLogin"&gt;
  &lt;table width="400" border="1" align="center" cellpadding="2" cellspacing="2"&gt;
  &lt;tr&gt;
  &lt;td width="150"&gt;User Id&lt;/td&gt;
  &lt;td&gt;&lt;input name="txtUserId" type="text" id="txtUserId"&gt;&lt;/td&gt;
  &lt;/tr&gt;
  &lt;tr&gt;
  &lt;td width="150"&gt;Password&lt;/td&gt;
  &lt;td&gt;&lt;input name="txtPassword" type="password" id="txtPassword"&gt;&lt;/td&gt;
  &lt;/tr&gt;
  &lt;tr&gt;
  &lt;td width="150"&gt;&amp;nbsp;&lt;/td&gt;
  &lt;td&gt;&lt;input type="submit" name="btnLogin" value="Login"&gt;&lt;/td&gt;
  &lt;/tr&gt;  
  &lt;/table&gt;
  &lt;/form&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>db_connect.php:</p>
  
  <pre><code>&lt;?php
  $hostname = "localhost";
  $username = "name";
  $password = "pass";
   try {
      $pdo = new PDO("mysql:host=$hostname; dbname=dbnamehere", $username, $password);
  //echo "Connected to database"; // check for connection
      }
  catch(PDOException $e)
      {
      echo $e-&gt;getMessage();
      }
  ?&gt;
  </code></pre>