OTP TABLE

CREATE TABLE `otp` (
  `id` int(11) NOT NULL,
  `otp_pass` varchar(12) NOT NULL,
  `otp_timestamp` datetime NOT NULL DEFAULT CURRENT_TIMESTAMP,
  `otp_tries` tinyint(1) NOT NULL DEFAULT '0'
) ENGINE=InnoDB DEFAULT CHARSET=latin1;

ALTER TABLE `otp`
  ADD PRIMARY KEY (`id`);

That is the gist of it, please feel free to make changes to fit your own project.

CONFIG FILE

This is just a config file to hold all your settings – Remember to change the database and OTP settings to your own.

OTP LIBRARY

pdo = new PDO(
        $str, DB_USER, DB_PASSWORD, [
          PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
          PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC,
          PDO::ATTR_EMULATE_PREPARES => false
        ]
      );
      return true;
    }

    // ERROR - DO SOMETHING HERE
    // THROW ERROR MESSAGE OR SOMETHING
    catch (Exception $ex) {
      print_r($ex);
      die();
    }
  }

  function __destruct() {
  // __destruct() : close connection when done

    if ($this->stmt !== null) { $this->stmt = null; }
    if ($this->pdo !== null) { $this->pdo = null; }
  }

  function exec($sql, $data=null) {
  // exec() : run insert, replace, update, delete query
  // PARAM $sql : SQL query
  //       $data : array of data

    try {
      $this->stmt = $this->pdo->prepare($sql);
      $this->stmt->execute($data);
      $this->lastID = $this->pdo->lastInsertId();
    } catch (Exception $ex) {
      $this->error = $ex;
      return false;
    }
    $this->stmt = null;
    return true;
  }

  function fetch ($sql, $cond=null, $sort=null) {
  // fetch() : perform select query (single row expected)
  //           returns an array of column => value
  // PARAM $sql : SQL query
  //       $cond : array of conditions
  //       $sort : custom sort function

    $result = [];
    try {
      $this->stmt = $this->pdo->prepare($sql);
      $this->stmt->execute($cond);
      if (is_callable($sort)) {
        while ($row = $this->stmt->fetch(PDO::FETCH_NAMED)) {
          $result = $sort($row);
        }
      } else {
        while ($row = $this->stmt->fetch(PDO::FETCH_NAMED)) {
          $result = $row;
        }
      }
    } catch (Exception $ex) {
      $this->error = $ex;
      return false;
    }
    // Return result
    $this->stmt = null;
    return count($result)==0 ? false : $result ;
  }

  /* [OTP FUNCTIONS] */
  function randompass ($len) {
  // randompass() : create a random password
  // PARAM $len : random password length

    // Change this alphabets set as needed. For example, if you want numbers only
    // $alphabets = "0123456789";
    $alphabets = "abcdefghijklmnopqrstuwxyzABCDEFGHIJKLMNOPQRSTUWXYZ0123456789";
    $count = strlen($alphabets) - 1;
    $pass = "";
    for ($i=0; $irandompass(OTP_LEN);

    // Database entry
    $sql = "REPLACE INTO `otp` (`id`, `otp_pass`, `otp_timestamp`, `otp_tries`) VALUES (?, ?, ?, ?)";
    $data = [$id, $pass, date("Y-m-d H:i:s"), 0];
    $ok = $this->exec($sql, $data);

    // Result
    return [
      "status" => $ok ? 1 : 0,
      "pass" => $ok ? $pass : ""
    ];
  }

  function challenge ($id, $pass) {
  // challenge() : challenge the OTP

    // Get the OTP entry
    $sql = "SELECT * FROM `otp` WHERE `id`=?";
    $data = [$id];
    $otp = $this->fetch($sql, $data);

    // OTP entry not found!?
    if ($otp === false) {
      $this->error = "OTP transaction not found.";
      return false;
    }

    // Too many tries
    if ($otp['otp_tries'] >= OTP_TRIES) {
      $this->error = "Too many tries for OTP.";
      return false;
    }

    // Expired
    $validTill = strtotime($otp['otp_timestamp']) + (OTP_VALID * 60);
    if (strtotime("now") > $validTill) {
      $this->error = "OTP has expired.";
      return false;
    }

    // Incorrect password
    if ($pass != $otp['otp_pass']) {
      // Add a strike to number of tries
      $strikes = $otp['otp_tries'] + 1;
      $sql = "UPDATE `otp` SET `otp_tries`=? WHERE `id`=?";
      $data = [$strikes, $id];
      $this->exec($sql, $data);

      // Security lock down - Too many tries
      if ($strikes >= OTP_TRIES) {
        $this->lockdown();
      }

      // Return result
      $this->error = "Incorrect OTP.";
      return false;
    }

    // OK - CORRECT OTP
    /* You can delete the OTP at this point if you want
     * $sql = "DELETE FROM `otp` WHERE `id`=?";
     * $data = [$id];
     * $this->exec($sql, $data);
     */
    return true;
  }

  function lockdown () {
  // lockdown() : failed challenge multiple times
    // @TODO - SECURITY LOCKDOWN
    // Suspend the user account?
    // Maybe temporary lock for a few hours to prevent spam?
    // Send warning email + SMS?
    // All up to your own system.
  }
}
?>

THE EXPLANATION

Yikes! This library looks complicated at first, but there are actually 2 parts to it –

• Support functions that deal with the database.
• Actual functions that deal with the OTP.

So if you are using your own PHP framework, please feel free to remove the database support functions, and update the OTP to use your framework.

1) GENERATE THE OTP

init(999);
 
// (3) SEND THE ONE-TIME PASSWORD TO THE USER
// (3A) OK - SEND OTP TO USER
if ($result['status'] == 1) {
  // Send message via email, SMS, messaging, or whatever communication gateway you use
  echo "Please visit https://your-site.com/page/ to verify. This password is valid for " . OTP_VALID . " minutes - " . $result['pass'];
}
// ERROR
else {
  echo "ERROR - ". $libOTP->error;
}
?>

The very first step of the process is to generate an OTP using the init() function – Just pass in the unique ID that you want to track, and remember to send the OTP and verification page to the user.

2) LANDING PAGE – OTP CHALLENGE

  
    

      OTP Password
      


      ID (This will be hidden or kept in the session) 
      

  

This is an example landing page for the user to enter the OTP – Which is just a simple HTML form.

3) OTP VERIFICATION

challenge($_POST['id'], $_POST['pass']);
} else {
  $libOTP->error = "Invalid OTP password and ID";
}

// (3) RESULTS
echo json_encode([
  "status" => $result ? 1 : 0,
  "message" => $result ? "OK" : $libOTP->error
]);
?>

Finally, we only have to verify the password that the user has provided.

QUICK START

Skipped the entire tutorial? Here is a quick introduction to how the folders are being organized in the zip file.

• ROOT The project root folder.
  • lib Where we store all the config and library files.
  • sql Contains the SQL for the OTP table.

So just import the SQL, update the settings in lib/config.php, and start tracing from 1-initialize.php.

SOURCE CODE DOWNLOAD

Click here to download the source code, I have released it under the MIT license, so feel free to build on top of it or use it in your own project.
 

The post 3 Steps to Create One Time Password (OTP) in PHP appeared first on Code Boxx.