📚 LibSecure – Secure Library Management System

LibSecure is a web-based Library Management System developed using PHP and MySQL, enhanced with several web security implementations based on secure coding practices. This project was developed as part of a Network Security course to demonstrate how authentication, authorization, session management, and secure communication can be integrated into a web application.

---

🌐 Live Demo

The application has been deployed and is available online.

🔗 Live Website: https://libsecure-project-production.up.railway.app

Feel free to explore the application using the demo accounts below.

---

👥 Demo Accounts

Administrator

• Username: admin
• Password: admin123

User

• Username: user
• Password: user123

These accounts are provided for demonstration purposes only.

---

✨ Features

Library Management

• User authentication
• Book management
• Borrowing and returning books
• User dashboard
• Admin dashboard

Security Features

• 🔐 Password Hashing using password_hash() and password_verify()
• 👤 Role-Based Access Control (RBAC)
• 🛡️ Secure Session Management
• 🚪 Secure Login & Logout
• 💉 SQL Injection Prevention using Prepared Statements
• 🔒 HTTPS/TLS Support
• 🍪 Secure Session Cookie Handling

---

🛠️ Technologies Used

• PHP
• MySQL
• HTML5
• CSS3
• Bootstrap
• Apache (XAMPP)
• Git & GitHub

---

📂 Project Structure

LibSecure/
│
├── admin/
├── assets/
├── config/
├── css/
├── database/
├── includes/
├── uploads/
├── login.php
├── logout.php
├── dashboard.php
└── README.md

---

🔐 Security Implementation

1. Password Hashing

Passwords are never stored in plain text. User passwords are hashed using PHP's built-in password_hash() function and verified using password_verify().

2. SQL Injection Prevention

All database operations use Prepared Statements, preventing SQL Injection attacks by separating SQL commands from user input.

3. Session Management

After successful authentication, a secure PHP session is created to maintain the user's login state. Unauthorized users cannot access protected pages without a valid session.

4. Secure Logout

The logout mechanism securely ends a user's session by:

• Clearing all session variables.
• Removing the session cookie from the browser.
• Destroying the session stored on the server.
• Redirecting users back to the login page.

This implementation helps prevent session hijacking and unauthorized reuse of session IDs.

5. Role-Based Access Control (RBAC)

Access to application features is restricted based on user roles (Administrator and User). Each role has different permissions, ensuring users can only access authorized resources.

6. HTTPS Communication

The application is deployed using HTTPS, ensuring all communication between the client and server is encrypted to protect sensitive information such as login credentials.

---

🚀 Getting Started

You can use the application in two ways:

Option 1 – Try the Live Demo

Simply visit the deployed application:

https://libsecure-project-production.up.railway.app

Login using one of the demo accounts provided above.

Option 2 – Run Locally

1. Clone this repository

git clone https://github.com/yourusername/libsecure.git

2. Import the provided SQL database into MySQL.

3. Configure your database credentials in config.php.

4. Start Apache and MySQL using XAMPP.

5. Open the application in your browser:

http://localhost/libsecure

---

🎯 Learning Objectives

This project demonstrates the practical implementation of:

• Secure User Authentication
• Password Hashing
• Session Management
• Secure Login & Logout
• Role-Based Access Control (RBAC)
• SQL Injection Prevention
• HTTPS/TLS Communication
• Secure Coding Practices in PHP

---

👨‍💻 Author

Nibras Aliah Mukhbita

Information Systems Student Faculty of Computer Science Universitas Pembangunan Nasional "Veteran" Jakarta

---

📄 License

This project was developed for educational purposes as part of a Network Security course.