Search & Compare Help

[silverthorn]

Hi all. I am working on a online gaming website site that requires the user to enter his/her character name and password then, through php, was hoping to use it to do a series of steps to verify the user before proceeding to the next webpage.

The example login screen of the website can be seen at:
http://stormbringer.sysconn.com/magi/new_layout/rotm.html

Now for the problem...

1) Ability to see a file located in a special directory
(ie. /users/first-letter-of-last-name/name.o) like /users/g/guest.o

2) Ability to 'grep' the file and look for the 'password' string.

3) Compare the user's password that was entered on the website to the one in the stored file. Password is in crypt() format. I know the password is in a one-way encryption, but I would at least use the password entered via the form to compare what the user has in their data file.

Sample user file below:

#0:0
name "guest"
password "7744xh0gOK23s"
mailaddr "[e-mail]"

Anyone know the best (or at least most effective) way to do this?

-- Michael

[vsego]

So, the user provides $UserName and $UserPassword.

1. $filename = "/users/".$UserName[0]."/".$UserName.".o";

I've used the first letter of the $UserName as last name is unknown.

2. $f = fopen($filename, "r");
   if ($f) {
   while ($line = fgets($f))
   if (ereg("^password \"(.*)\"$", trim($line), $reOut)) {
   $password = $reOut[1];
   break;
   }
   if (!isset($password)) <no password in file>
   } else
   <file does not exist>

3. Why not crypting $UserPassword and comparing it with $password?

[Anon]

How do I crypt the $UserPassword to do the comparison?

[Anon]

Okay, this is the layout I tried out for testing. I added in the echo statements for debugging purposes.

From login form:

Username = $character
Password = $password

<?
$new_character = strtolower($character);

$filename = "/rpg/mud/lib/people/".$new_character[0]."/".$new_character.".o";

echo $new_character;
echo "<br>";
echo $filename;
echo "<br>";

if(file_exists($filename)) {

$f = fopen($filename, "r");

echo $filename;
echo "<br>";
echo $f;
echo "<br>";

if ($f) {

while ($line = fgets($f))

if (ereg("^password \"(.*)\"$", trim($line), $reOut)) {
$password = $reOut[1];
break;
}

// if (!isset($password))
// } else

}
}
else
if(file_exists($filename)) {
echo "
<p>
Welcome back, $character.<BR><BR>
";
}

?>

Now this is the result I am getting:

mystic
/rpg/mud/lib/people/m/mystic.o
/rpg/mud/lib/people/m/mystic.o
Resource id #1

Warning: Wrong parameter count for fgets() in
/rpg/public_html/new_layout/character.php on line 116

---

Is there something here I am missing?

-- M

[vsego]

Urgh. I always forget that second argument. Check the manual next time.

fgets($f, 1024); // set to more if your lines can get longer than 1024

"How do I crypt the $UserPassword to do the comparison?"

How did you crypt it the first time, when you put it in the file? Use the same function and whatever you get should be equal to what's in the file. Right? (I use md5() function for this purpose)

[silverthorn]

Well it took a bit of time and some real hacking at the code, but thanks to Vedran and a couple of others... I got it working! =)

$filename = "/users/".$new_character[0]."/".$new_character.".o";

if(file_exists($filename)) {

$f = fopen($filename, "r");

if ($f) {

while (!$done) {

$line = fgets($f, 1000);
if (ereg("^password (.*)", $line, $reOut)) {

$stored_password = $reOut[1];

$encrypted_password = crypt($new_password, $stored_password);

if ($encrypted_password = $stored_password) $done = true;

}
}

echo "Password Accepted.";
fclose($f);
}
}

[vsego]

Nice. :-)

Only one thing. Since you're not reporting errors in case file cannot be opened, consider replacing

if(file_exists($filename)) {
$f = fopen($filename, "r");
if ($f) {
...
}
}

with

$f = @fopen($filename, "r");
if ($f) {
...
}

You see, if the file can be opened for reading it exists, so we don't need the first if(). If it doesn't exist, fopen() will return 0, so again we don't need to check file existence.

"@" tells PHP not to report any errors or warnings produced by fopen(). Something like "quiet mode".

Good work (and quite clean code)!