Project Security Management System Documentation
BSINFOTECH302C
Name: Salen, Leonardo III D.
Ronquillo Yesha Jhen B.
Operario, Princess Mae E.
Navales, Krizzy Mae M.
Sipat, Abeigail C.
System Overview
The Hotel Management System is a web-based application developed using JavaScript, PHP,
Bootstrap, MySQL. The system allows guest to view hotel information such as hotel rooms, amenities and
other facilities but need to register to book room, that’s when User comes can book and manage his
information. Lastly, Admin handle the managing of room information, user queries or feedback, and website
settings.
Figure 1. System Architecture Diagram
Figure 2. Data Flow
Figure 3. Registration Database Flow
Figure 4. Login Flow
Function/Method Dictionary
Module Function/Method Purpose
User Management registeruser() Hash password, insert new user
loginuser() Verify hash, start session
deleteuser() Remove account
Room Management addroom() Insert new room
getrooms() Display room list
deleteroom() Remove room
Reservation Module bookroom() Insert booking
getbooking() View all bookings
Security password_hash() One-way hashing
password_verify() Compare login input with stored
hash
trackAttempt() Increment failed login attemps
lockAccount() Lock the account after 3 failures
login attempt
unlockAccount() Admin manually unlock the
account
Session Management session_start() Initialize session
$_SESSION[] Store user state
session_destroy() End session
Security Whitepaper
The security of this system used cryptographic and access-control mechanisms in the Eterna Luxe
Hotel Management System to protect user credentials and prevent unauthorized access. The system applies
two complementary layers of security, one-way password hashing using SHA-256, and a brute-force lockout
shield that lock the account and need to contact the admin to manually unlock the certain account.
Password Hashing
SHA-256 (Secure Hash Algorithm 256-bit) is a member of the SHA-2 family standardized by NIST.
It produces a fixed-length 256-bit (64 hexadecimal character) digest from any input. The algorithm is
deterministic the same input always produces the same output but is computationally infeasible to reverse,
making it suitable for password storage.
• Registration flow: when a user registers, the plain-text password is never written to disk. Instead,
hash('sha256', $password) is computed in PHP and the resulting 64-character string is stored in
[Link]. The plain-text is discarded immediately after hashing.
• Login flow: when a user attempts to log in, the submitted password is hashed with SHA-256 and
compared to the stored hash using strict equality (===). No decryption occurs the comparison is purely
hash-to-hash.
• Visual validation: upon successful registration, the system displays the generated hash to the user
alongside the algorithm name, so they can verify that their password was processed cryptographically
and not stored as plain text.
Brute Force Shield Implementation
The system implements a persistent, database-backed lockout mechanism. Unlike session-based
throttling (which resets when a browser is closed), this approach records attempt counts in the users table,
making it immune to browser resets, incognito mode, or VPN switching.
Schema: two columns are added to the users table:
• failed_attempts TINYINT(1) DEFAULT 0 — incremented on every wrong password
• status ENUM('Active','Locked') DEFAULT 'Active' — flipped to 'Locked' at the threshold
Logic on each login attempt:
1. The system first checks status. If already 'Locked', access is denied immediately — no password check
is performed.
2. If status = 'Active', the submitted password is hashed and compared to the stored hash.
3. On a match: failed_attempts is reset to 0 and the session is granted.
4. On a mismatch: failed_attempts is incremented by 1. If it reaches 3, status is simultaneously set to
'Locked'.
5. The user can see how many attempts has left on modal.
Persistence: because the lock is stored in the database row, it survives server restarts, session clears, and IP
changes. The only path to re-access is an admin manually setting status = 'Active' and failed_attempts = 0 in
the admin panel.
Admin unlock: the admin panel's user management page shows each user's attempt count and status badge.
A single "Unlock" button triggers ajax/[Link] which executes UPDATE users SET status='Active',
failed_attempts=0 WHERE id=?.
Role-Based Access Control (RBAC)
The Hotel Management System implements Role-Based Access Control to ensure that users only access
features permitted by their role.
Guest
Access Level: Viewing only
• Permissions:
o View available rooms and facilities
o Browse hotel information and announcements
o Access FAQs and contact information
• Restrictions:
o Cannot book rooms
o Cannot modify or interact with system data
User
Access Level: Booking privileges
• Permissions:
o Register and log in to the system
o Search and view room availability
o Make reservations/book rooms
o Manage personal bookings
o Generate receipts for confirmed bookings
• Restrictions:
o Cannot access system settings
o Cannot manage other users or staff
Admin
Access Level: Full system management
• Permissions:
o Manage users (CRUD operations for accounts)
o Manage rooms and facilities (add, update, delete)
o Approve or cancel bookings
o Access and configure system settings (shutdown mode, site info)
• Restrictions:
o None (highest-level authority)