Comments on: Simple PHP Password Protection

By: Craig

Craig — Fri, 04 Dec 2009 15:15:59 +0000

Cookieless sessions?

http://myles.eftos.id.au/blog/2005/11/26/cookie-less-sessions-in-php/

Or check force user to have cookies enabled, otherwise no login attempts allowed.

If quote “there will be no session” unquote, can you even login? Therefore just hammering at “nothing” lol

Just a thought…

By: danoli3

danoli3 — Mon, 31 Aug 2009 08:24:10 +0000

hey man, I can’t get this to work on my local domain,

apache 2.2 and php 5.3.0.
:(

By: user24

user24 — Mon, 03 Aug 2009 11:03:33 +0000

You are correct, but there’s nothing anybody can do about that. Every password script in the world will suffer the same problem. People can connect via 100,000 proxies, what can I do to stop that?

By: speedy18us

speedy18us — Sat, 01 Aug 2009 07:58:17 +0000

sorry to inform you but this script is not protected against hammering. if i disable cookie, there will be no session and i could try some hammering all day. i just did :)

By: Alex

Alex — Fri, 31 Jul 2009 03:37:34 +0000

How do you set the session length in the program? As entering 30 in this varailble did not seem to have any effect
$_SESSION['mpass_session_expires'] = “”;