0

I've written a User class like this:

<?php

class User{

    private $id;
    private $username;
    private $password;
    private $name;
    private $email;
    private $key;
    private $phone;
    private $is_verified;
    private $last_login;
    private $last_ip;
    private $language;
    private $is_loggedIn;

    function __construct()
    {

    }

    public function __set ($property , $value){
        $this->$property = $value;
    }

    public function __get($property){
        return $this->$property;
    }

    public function check_login(){

    }
}

?>

Now, I'm thinking to set all the private parameters in check_login() function with user data. This function will be called on top of each and every file. Will it be a good idea to load all user data including password, email, phone etc on top of each file?

8
  • When you say password, do you mean password-hash? Because login/registration/password change are the only places where you have the plaintext password (because the user sent it as part of the current request) and those are not a field in a User class. – CodesInChaos Apr 7 '18 at 13:43
  • @CodesInChaos yes properly hashed passwords. – Kshitij Kumar Apr 7 '18 at 13:46
  • 1
    Can you be more specific about what you mean by "good idea?" Do you mean secure? Performant? Having the lowest number of calories? – Robert Harvey Apr 7 '18 at 14:18
  • @RobertHarvey security is my main concern. – Kshitij Kumar Apr 7 '18 at 14:49
  • maybe a better question is why are you doing this in the first place? obvs security is always going to be a bit better if you load less info – Ewan Apr 7 '18 at 15:26
1

Good idea I wouldn't say, but security wise it shouldn't be a big issue. To make sure you are not leaking sensitive information it is important how you treat it, are passwords properly encrypted/hashed, how do you have it in the session etc. Calling a resource intensive function on top of every file also can hit performance depending on what you execute in your check_login().

It's better to log the user in once and then check the session if the user is logged in or not. Don't perform a full login at the start of each file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.