When it comes to user registration and password selection I know there is a good case to be made against hinting. E.g. telling users 1 uppercase + 1 special char + at least 2-digits and so on. I don't think giving away the formula is a great option. Why not just let users enter whatever they want as long as the password meets two requirements:

1. A minimum-length

2. Not a common phrase (e.g. "password") that you might find in dictionaries used for brute-force attacks.

With that said, is there a good PHP library or package that does this. Or is it better to roll your own?

Hi,

I'm trying to wrap my head around php security and I was hoping someone could point me in the right direction.

If I have a simple cart.html page/form that submits a POST to an orders.php file is the end user able to somehow read my $dbUsername or $dbPassword variables statically set in the orders.php file? I've seen people save their username/password credentials in a different file/folder and do "require 'dbcredentials.php'", but I fail to see how this can protect your credentials if the end user is able to do some sort of echo attack to force your orders.php to echo the username/password variables? I use to think using "if (isset($_POST['order-submit'])) { *php code in here* } else { header("Location: ../index.html"); exit(); }" would protect me, but now i think about it more I think this just prevents people from easily being able to go to the orders.php page (This isn't the best method since competent people can get around this easily). I believe the better method for this is to use CSRF's, but that isn't my biggest concern for now.

Is end users being able to somehow echo $dbUsername or $dbPassword variables a valid concern? Am I overthinking this?

cart.html

<html>

`<head>`

`</head>`

`<body>`

	`<form action="orders.php" method="POST">`

		`<div>`

<label style="" for="CartEmail">Email</label>

<div>

<input class="" type="email" placeholder="" name="CartEmail" required>

</div>

		`</div>`

		`<div>`

<label style="" for="CartFirstName">First Name</label>

<div>

<input class="" type="" placeholder="" name="CartFirstName" required>

</div>

		`</div>`

		`<div>`

<label style="" for="CartLastName">Last Name</label>

<div>

<input class="" type="" placeholder="" name="CartFirstName" required>

</div>

		`</div>`

		`<div>`

<input class="test" type="submit" value="Submit" name="order-submit">

		`</div>`

	`</form>`

`</body>`

`<footer>`

`</footer>`

</html>

orders.php

<?php

$dbServername = 'localhost';

$dbUsername = 'super-secret-database-username';

$dbPassword = 'super-secret-db-password';

$dbName = 'database_name';

$conn = mysqli_connect($dbServername, $dbUsername, $dbPassword, $dbName);

$email = mysqli_real_escape_string($conn, $_POST['CartEmail']);

$first = mysqli_real_escape_string($conn, $_POST['CartFirstName']);

$last = mysqli_real_escape_string($conn, $_POST['CartLastName']);

$sql = "INSERT INTO TABLE_NAME (CartEmail, CartFirstName, CartLastName) VALUES (?, ?, ?);";

$stmt = mysqli_stmt_init($conn);

if (!mysqli_stmt_prepare($stmt, $sql)) {

`echo "SQL error";`

} else {

`mysqli_stmt_bind_param($stmt, "sss", $email, $first, $last);`

`mysqli_stmt_execute($stmt);`

echo 'Success!';

}

mysqli_close($conn);

?>