Member Avatar for spluskhan

Ha gyz i develop website for online shoping just for testing, this website contact 5 admins i want to secure login for thoes admin via mobile verification code, Like facebook verification code & google email login 2-setp verifcation etc.

Can any bosdy have khew about this how it to be done?

  • 4 Contributors
  • 8 Replies
  • 253 Views
  • 5 Months Discussion Span
  • Latest Post Latest Post by szurcsii

Dani AI

Generated

As requested a practical way to protect five admin accounts with a mobile verification step, the simplest, safest pattern is: validate username/password, generate a short one‑time code, deliver it to the admin’s phone, then verify that code before granting the elevated session. outlined that flow; and pointed toward using a gateway. The notes below focus on the PHP server side and hardening the OTP lifecycle so delivery choice can be treated as a separate integration detail.

Key server-side rules

  • Generate codes with a cryptographically secure source (for example random_int) and use 6 digits for SMS convenience.
  • Never store the plaintext code: store only a hash (e.g. password_hash) and mark the row “used” after a successful verify.
  • Set a short expiry (5–10 minutes), a small max-attempts counter (3–5), and tie the OTP row to user_id and the login/session ID.
  • Rate-limit code requests and record send/verify events for auditing.
  • Normalize phone numbers to E.164 at registration and verify ownership once (one-time setup).
  • Protect provider API calls with HTTPS and avoid logging the OTP itself. For admin accounts prefer app-based TOTP or hardware tokens where possible — SMS has known interception/SIM-swap risks.

Practical PHP pattern (minimal)

<?php
// PDO $pdo is assumed. send_sms($phone,$msg) is provider-specific.
function create_otp(PDO $pdo, int $user_id, string $phone) : bool {
    $code = str_pad(random_int(0, 999999), 6, '0', STR_PAD_LEFT);
    $hash = password_hash($code, PASSWORD_DEFAULT);
    $expires = (new DateTime('+8 minutes'))->format('Y-m-d H:i:s');
    $stmt = $pdo->prepare('INSERT INTO otp_codes (user_id, code_hash, phone, expires_at, attempts, used, created_at) VALUES (?, ?, ?, ?, 0, 0, NOW())');
    $stmt->execute([$user_id, $hash, $phone, $expires]);
    send_sms($phone, "Login code: $code");
    return true;
}

function verify_otp(PDO $pdo, int $user_id, string $input) : bool {
    $stmt = $pdo->prepare('SELECT id, code_hash, expires_at, attempts, used FROM otp_codes WHERE user_id=? ORDER BY created_at DESC LIMIT 1');
    $stmt->execute([$user_id]);
    $row = $stmt->fetch(PDO::FETCH_ASSOC);
    if (!$row || $row['used'] || new DateTime($row['expires_at']) < new DateTime() || $row['attempts'] >= 5) return false;
    if (!password_verify($input, $row['code_hash'])) {
        $pdo->prepare('UPDATE otp_codes SET attempts = attempts + 1 WHERE id = ?')->execute([$row['id']]);
        return false;
    }
    $pdo->prepare('UPDATE otp_codes SET used = 1 WHERE id = ?')->execute([$row['id']]);
    return true;
}
?>

Troubleshooting & operational tips

  • If SMS delivery is inconsistent, check provider delivery logs and sender ID settings, confirm number formatting, and test across carriers.
  • Keep a secure emergency-reset procedure for admins (manual identity checks and short-lived override codes).
  • If ease is the priority and the admin email accounts are tightly controlled, delivering codes to admin email is possible but is weaker than app-based 2FA for high‑privilege users.

Recommended Answers

All 8 Replies

Member Avatar for spluskhan

any body

Member Avatar for 203428

read about Kannel

kannel is open source getway between server web and SMSC operator.

Member Avatar for spluskhan

can you explain what is this

Member Avatar for chrishea

If all you want to do is to strengthen the login process by sending them a code that they can use as part of their login, then after they do the normal ID and PW entry, generate a random code and send it via SMS. Display a screen (from PHP) where they can enter the code and once they enter it (and you verify it) you're done.

Many Carriers provide an email address format where you can send an SMS message. To do it that way, you need to know the carrier for each user and the format that they use. In North America, all Carriers do this and there is no extra charge. If that is not the case in your country, you can use a paid service. This may be provided by your phone company or by a separate organization like Twillio. In that case, they provide you with an API and all you need to have is the phone number that you wish to send to.

Member Avatar for spluskhan

Thank you for sharing info, Its very lenghty process is this possible that the verification code is send to his email which is registerd in database i think this will be an easy way if it done?

Member Avatar for 203428

so
you want to send a message verication code to user after submiting his login and his password .
thats mean send message from a server working with http request to mobile working with SMS request, so you need a gatway to do this.

server_side{ http(message code) }====> getway ===> mobile_side{SMS(message code)}

for the getway i propose to see kannel .
read about it, ;)

Member Avatar for spluskhan

i read out Kannel but its very comlicated can you provide me some examplets or tutorials

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.