Membuat Anti SQL Injection

Membuat Anti SQL Injection login dengan menggunakan enskripsi MD5
1.buat database users

2.Buat file koneksi:

<?php
$host = "localhost";
$username = "root";
$password = "";
$databasename = "lat";
$connection = mysql_connect($host, $username, $password) or die("Kesalahan Koneksi … !!");
mysql_select_db($databasename, $connection) or die("Database Error");
?>

3.Buat form login:

<!DOCTYPE html>
<head>
<title>form login</title>
</head>
<body>
<form name="login" action="login_check.php" method="post">
<table border="1" align="center" bordercolor="#000">
<tr><td colspan="2"><div align="center">
Form Login</div>
</td></tr>
<tr><td>Username</td><td> : <input type="text" name="namausers"></td></tr>
<tr><td>Password</td><td> : <input type="password" name="sandiusers"></td></tr>
<tr><td colspan="2"><div align="center">
  <input type="submit" value="Login">
</div>
</td></tr>
</table>
</form>
</body>
</html>

4.Buat file validasi:

<?php
include "conn.php"; //file koneksi
function anti_injection($data){
$filter = mysql_real_escape_string(stripslashes(strip_tags(htmlspecialchars($data,ENT_QUOTES))));
return $filter;
}
$username = anti_injection($_POST['namausers']);
$pass     = anti_injection(md5($_POST['sandiusers']));
//pastikan username dan password adalah karakter atau nomor.
if (!ctype_alnum($username) OR !ctype_alnum($pass)){
echo "sekarang login form telah terlindungi. Tidak ada SQL Injection.";
}
else{
$login=mysql_query("select * from users where namausers='$username' and sandiusers='$pass'");
$found=mysql_num_rows($login);
$r=mysql_fetch_array($login);
//Jika ditemukan username dan password
if ($found > 0){
session_start();
include "timeout.php";
$_SESSION[username]     = $r[namausers];
$_SESSION[fullname]     = $r[nama_lengkap];
$_SESSION[passuser]     = $r[sandiusers];
$_SESSION[leveluser]    = $r[level_user];
// timeout session
$_SESSION[login] = 1;
timer();
$old_sid = session_id();
session_regenerate_id();
$new_sid = session_id();
mysql_query("update users set id_session='$new_sid' where username='$username'");
header('location:home.php'); //Halaman di alihkan, setelah login sukses
}
else{
echo "<center>
LOGIN GAGAL!!!<br/>
salah username atau password.<br/>
atau accaunt anda diblokir<br/>";
echo "<a href='login.php'><b>Coba Lagi</b></a></center>
";
}
}
?>

5.Buat file timeout:

<?php
session_start();
function timer(){
$time=10000; //mengatur waktu
$_SESSION[timeout]=time()+$time;
}
function login_check(){
$timeout=$_SESSION[timeout];
if(time()<$timeout){
timer();
return true;
}else{
unset($_SESSION[timeout]);
return false;
}
}
?>

6.Membuat page home:

<?php
session_start();
error_reporting(0);
include "timeout.php";
if($_SESSION[login]==1){
if(!login_check()){
$_SESSION[login] = 0;
}
}
if($_SESSION[login]==0){
header('location:login.php');
}
else{
if (empty($_SESSION['username']) AND empty($_SESSION['passuser']) AND $_SESSION['login']==0){
"<center>
Untuk mengakses halaman ini, login dulu ya!<br/>";
echo "<a href=login_form.php><b>LOGIN</b></a></center>
";
}
else{
?>
<!DOCTYPE html>
<head>
<title></title>
<style type="text/css">
<!–
#Layer1 {
            padding:10px;
            width:1000px;
            height:280px;
            background-color: #00CCFF;
}
.style1 {color: #000000}
–>
</style>
</head>
<body>
<div id="Layer1">
  <h1 align="center">
Selamat Datang </h1>
<h4 align="center">
Anda Berhasil Login</h4>
<p align="center">
<a href="logout.php" target="_parent">logout</a></p>
<p>
 </p>
</div>
</body>
</html>
<?php
}
}
?>

7.Membuat file logout:

<?php
session_start();
session_destroy();
echo "<center>
Anda berhasil Keluar dari sistem.<b>[LOGOUT]</b> <br> <a href='home.php'>home</a></center>
";
?>

Navigation

blue color

Label

Membuat Anti SQL Injection

0 komentar:

Arsip Blog

Popular Posts