Ho appena realizzato un piccolo form di login per un'area di amministrazione, e vorrei sentire i vostri pareri,consigli o qualsiasi altra cosa che abbiate da chiedermi o dirmi;
lo username e la password vengono confrontati con i valori salvati in un database e se sono corretti registro i dati dell'utente che si è loggato(username,ip,ora login,ora logout).
Ecco il codice:

LOGIN.CLASS.PHP
Codice PHP:
<?php

class loginClass{
    
    private $key = 's6ufnNBBYJD=)/bndwudbacv$gwsnNUJufSAxwq02Ngf4%Wh!';
                                                                         
    public function isConnected(){
        return (isset($_SESSION['logged']) === true) ?  true :  false;
    }
    
    public function login($user, $pass){
        $hashPass = PMA_blowfish_encrypt($pass, $key);
        $sql = "SELECT id FROM users WHERE username='".$user."' AND password='".$hashPass."'";
        $result = mysql_query($sql);
        $row = mysql_num_rows($result);
        if($row == '1')
        {
            $verifyStore = $this->storeLog($user,'LogIn');
            if($verifyStore === true) 
            {
                $_SESSION['logged'] = PMA_blowfish_encrypt("SESSION+VERIFIED", $this->key);
                return true;
            }
            else
                return false;            
        }
        else     
            return false;
        
    }
    
    public function logout(){
        
        $this->storeLog('','LogOut');
        unset($_SESSION['logged'],$_SESSION['idSession']);
        session_destroy();        
    }
    
    private function storeLog($user,$action){
        
        $CurrentTime = date('c');
        
        if($action == 'LogIn')
        {    

            $ip=$_SERVER['REMOTE_ADDR'];
                        
            $sql="INSERT INTO SiteAccess (id,user,ip,login_time,logout_time) VALUES('','".$user."','".$ip."','".$CurrentTime."','')";
            $result=mysql_query($sql);
            if($result === true) 
            {
                $idSession = mysql_insert_id();
                $_SESSION['idSession'] = PMA_blowfish_encrypt($idSession, $this->key);
                return true;
            }
            else
                return false;
        }
        elseif($action == 'LogOut')
        {
            $idSession=PMA_blowfish_decrypt($_SESSION['idSession'], $this->key);
            $sql="UPDATE SiteAccess SET logout_time='".$CurrentTime."' WHERE id='".$idSession."'";
            mysql_query($sql);
        }
        else     
            return false;
    }

}
LOGIN.PHP
Codice PHP:
<!DOCTYPE unspecified PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<head>
<?php session_start();?>
<?php require_once 'PhpClass/connection.Class.php'; ?>
<?php require_once 'PhpClass/crypt.Class.php'; ?>
<?php require_once 'PhpClass/login.Class.php'; ?>
</head>
<html>
    <body>
    <?php 
            
        $log = new loginClass();
        
        $verifyUserConn = $log->isConnected();
        
        if($verifyUserConn === true)
            header("Location: Pages/intro.php");
        else
        {
            if(isset($_POST['uname']) && isset($_POST['passw']))
            {        
                $filteredUser = mysql_real_escape_string($_POST['uname']);
                $filteredPass = mysql_real_escape_string($_POST['passw']);
                $connection = new connect();
                $connection->connessioneMysql('root', '', 'localhost', 'administration');    
                $verifyLogin = $log->login($filteredUser, $filteredPass);
                if($verifyLogin === true)
                    header("Location: Pages/intro.php");
                else
                    header("Location: ".$_SERVER['PHP_SELF']);
            }
            else 
            {                    
    ?>
        Inserire username e password
        <form method="post" action="<?php echo $_SERVER['PHP_SELF'];?>">
            Username<input type="text" name="uname">

            Password<input type="password" name="passw">

            <button type="submit">invia</button>
        </form>
    <?php 
            }
        }            
    ?>
    </body>
</html>
Poi volevo chiedere se qualcuno avesse mai usato $_SERVER['PHP_AUTH_USER'] per le autenticazioni.
Grazie in anticipo per tutte le eventuali risposte