Other points to consider:
1. You are vulnerable to bruteforce
A dictionary attribute will crack your password. Since the vast majority of users have an insecure password, this is only a matter of time. Use captcha or invalid entries. Or add a delay when the password is incorrect.
As Colonel Shrapnel said, the rainbow table does not bother you because they are used when someone has a bunch of hashes and they want to crack them. Salt is used to get some protection from the rainbow table, and this is not your case.
2. You send clear text passwords
If someone sniffs your username (for example, wifi), you are doomed. There are some javascript libraries out there that can encrypt anything using public keys. If you do not want to use SSL, encrypt the login / password, send it to the server, decrypt it using the private key, and you will be safer.
3. Consider using prepared MySQL statements
Using prepared statements helps in SQL injection, since it can safely work even with malicious input:
$dbc = new mysqli("mysql_server_ip", "mysqluser", "mysqlpass", "dbname"); $statement = $db_connection->prepare("SELECT * FROM table WHERE thing='?'"); $statement->bind_param("i", $thing); $statement->execute();
4. Do not allow client side validation
In your login form, you pass the javascript function, preventing the Enter-key function. What if I turn off Javascript? You can use a hidden field (for example, <input type = 'hidden' name = 'FormIsValid' value = '0'>), use your function to prevent key entry and use the onSubmit () function to change FormIsValid to 1 before submitting the form. On your server, check out FormIsValid.
5. You are vulnerable to session hijacking
Your session is saved in the default cookie named PHPSESSID. If an attacker can get this cookie, he can send it to your server and steal your session. To prevent it, you can save the IP address of the user and the user agent in the session and compare the value received from the session with each request. If the values do not match, the user IP address may be changed or the session may be hacked.
6. You may be vulnerable to commit session
As stated above, if someone convinces your administrator to access a certain site, and this site sends a request to your site using PHPSESSID upon request, your site will create a session, process the login / password and indicate that the credentials are incorrect. Not bad so far.
Later, your administrator will log into your portal, the session already exists, the username and password match, and the session is UPDATED. Now the actual variable is 1.
Once the variable is updated, the attacker has full access to your portal, since he knows the PHPSESSID, your site does not prevent session capture or session fixation.
To avoid session fixation and hijacking, see No. 5.