|
所在平台: Udemy |
课程主页: https://www.udemy.com/course/secure-registration-login-system-mfa/
课程评论：没有评论
课程简介：PHP PDO与MySQL：安全注册与登录系统及多重身份验证（MFA） 这门课程旨在教授和深入理解PHP数据库对象（PDO），帮助学员掌握PDO辅助函数的用法，编写合适的数据库封装类和方法。课程将引导学员如何编写简洁、可重用且安全的代码，并了解如何防范常见的网页漏洞，如SQL注入、身份验证和会话管理错误、访问控制漏洞、跨站脚本（XSS）等。 课程内容将包括PDO的深入学习，以具体示例帮助学员巩固知识。学员将一步步构建一个完整的安全用户注册登录系统，使用PHP和MySQL，技术栈包括PDO、MySQL、JQuery、Ajax、Bootstrap 4及PHPMailer库，并利用TextLocal API和MailTrap API进行短信和邮件发送。 课程特别强调纠正一些常见编程错误和不良实践，旨在提高学员的PDO使用水平。通过丰富的实例、实操活动和练习，帮助从 PDO 新手成长为精通者。同时，课程中将花费大量时间讲解与网页安全相关的问题，如验证、净化、转义、SQL注入及安全文件上传等，确保学员能够编写更安全的代码。 课程亮点包括： 1. 多种登录模式：标准登录、带电子邮件OTP的安全记住我登录、JQuery及Ajax的电子邮件OTP登录、JQuery及Ajax的SMS OTP登录。 2. 密码恢复方式：通过电子邮件链接或OTP恢复密码。 3. 电子邮件验证及重发验证链接功能。 4. 登录失败及身份验证失败的缓解措施，如限制登录尝试、非活动用户自动注销、强密码要求及实施多重身份验证。 5. 专为管理员设计的后台，包含用户在线状态显示及数据统计功能。 6. 多角色登录功能。 7. 手机号码验证功能。 8. 安全文件上传功能。 9. 安全优先的开发理念，将安全措施置于编码之前，本课程遵循OWASP前十大网络应用安全风险，实施了多项安全措施（如内容安全策略、抗CSRF令牌等）。 10. 提供PDO封装类、辅助函数和CRUD方法的指导。 无论您是新手、中级开发者还是经验丰富的PHP开发者，本课程都能为您提供提升技能的机会，帮助您避免常见的编程不良习惯。完成课程后，您将自信地使用PDO，编写出简洁、可重用且安全的代码，感受到PDO在处理数据库的优势。
Do you want to learn and understand PHP Database Objects (PDO)?Do you want to know how to harness the power of PDO helper functions?Do you want to know how to write DB Wrapper class and methods the proper way?Do you want to be able to write slim, concise, reusable and secure code?Do you want to know how to prevent the most common website vulnerabilities? Such as: SQL Injection, Broken Authentication and Session Management, Broken Access Control, Cross-site Scripting (XSS) and much more.If your answer to all these is Yes, Then this course is for you.This course begins by an in-depth study of PDO, with concreate examples to buttress the knowledge taught. At the end of this course, you will be well grounded in PDO- knowing when and how to use each helper function correctly.In this course, I am going to walk you through the process of building a Complete and Secure User Registration Login System in OOP using PHP & MySQL. We are going to accomplish this task using web technologies like: PDO, MySQL, JQuery, Ajax, Bootstrap 4 and PHPMailer libraries, TextLocal API(to send SMS), MailTrap API (to send email)Taking cognizance of the so many tutorials/courses on PDO that failed to explain the real benefits of PDO, or even promote rather bad practices. As a result, half of PDO'S features remain in obscurity and almost never used by PHP developers, who as a result are constantly trying to reinvent the wheel which already exists in PDO.The goal of this author is to highlight the common mistakes and bad practices, while showing the right way to do things. After a careful analysis of several YouTube videos, and other web tutorials, it's a sad reality that most of these creators are limited in their knowledge of PDO. Don't take my words for it, you will see with your own eyes. Part of this course include correcting/improving some random codes taken from the internet. So at the end of this course, you will have the knowledge and confidence to tell those YouTubers and other web tutorials creators that what they are doing is wrong.This is course is jam-packed with a lot of examples, practical activities and hands-on exercises enough to take a PDO novice to a mastery level.Considerable time and energy was spent on web security related issues. I have taken the best approach visa-visa web security- explaining and applying the concept of validation, sanitization, escaping, SQL Injection, and secure file upload, broken authentication and session management, sensitive data exposure and much more.My promise to you is that, at the end of this course - you will find working with PDO a second nature that you wouldn't like go back to MySQLi driver or any other driver. You will start writing slim, concise, reusable and secure code. You are going to discover that PDO is even the easier option to MySQLi.This course is for newbies, intermediate and even experienced level PDO PHP developers, because I have pointed out some bad practices (and there are a lot) among the PHP developer's community. One of such is the indiscriminate use of the rowCount() function.Main Features that stand out:This course is jam-packed with a lot of features:1. There are four different login modes: Standard login with Secure Remember Me MFA Login with Email OTP MFA Login with Email OTP with JQuery & AjaxMFA Login with SMS OTP with JQuery & Ajax2. Two different Password Recovery modes: Recover password with Email link Recover password with Email OTP3. Email verification & Resend Email verification link features4. Identification and Authentication Failures Mitigation (featured in OWASP TOP 10 List of Web application Security Risks 2021, formerly known as Broken Authentication ) Limit login attempts Automatic logout if inactive users Strengthen password requirement -impose use of strong passwords Implement Multi-factor Authentication in login & password recovery5. An admin dashboard ONLY for master users. With the following features: Show user online status -users can be either online or offline. If offline display the time in ago format e.g. 1 hour ago. A Bootstrap modal to show user's individual data using JQuery & Ajax A big data section - show the statistics6. A multi-role login feature7. Mobile Number Verification feature8. A secure file upload feature9. This course is built on a Security First Philosophy - meaning thinking about security even before we write a single line of code. The course is built on the backdrop of the OWASP TOP 10 List of Web application Security Risks. As such the following security measures were put in place: Content Security Policy (CSP) - To guard against XSS (Cross-Site Scripting), clickjacking, and cross-site leak vulnerabilities Cross-Site Request Forgery Attacks Mitigation (CSRF) -Implement anti-CSRF token as a protection measure Prepare Statement - To guard against SQL Injection Data Sanitization & Validation - To make sure the proper kind of data is saved into the database Output Escaping/Encode - To guard against XSS attacks10. PDO Wrapper class, helper functions and CRUD methods
