a simple user authentication script

Anon

Hey there.

How does this piece of code look? I'm trying to slap something together i can stick at the top of my pages to require people to log in to access them.

$uname and $passw are variables submitted to the page via a form. The functions db_connect() and db_query() are properly defined and connect to a database, and feed a query to a database, respectivly.

// authenticate
if ((isset($passw)) && (isset(uname))) {
// connect to the database where users are stored
$db_conn_pnt = db_connect($db_host, $db_user_pass, $db_user_uname, $db_name);
// build & execute query
$db_query_str = "SELECT fname, lname FROM $db_tbl_stu WHERE uname = '$uname' AND passw = '$passw'";
$db_query_pnt = db_query($db_query_str, $db_conn_pnt);
// how many rows in the users table match the uname/passw combo?
$db_rows_match_pnt = mysql_numrows($db_query_pnt, $db_conn_pnt);

if ($db_rows_match_pnt == 1) {
	// start a session & register the uname and passw variables
	session_start();
	session_register('uname', 'passw');
} else {
	session_unset();
	session_destroy();
}

}

both the $uname and $passw variables, as you can see, will be sent via a session to each "secured" page and reverified each time. Though i havn't included it here, i plan to md5() the $passw.

How does this look from a security standpoint? Will it be able to protect my pages? - this is really the first time i've tried to "protect" stuff.

Thanks in advance

--ben

Anon

One tightening of security would be to use $HTTP_POST_VARS instead of globals - otherwise people might stick uname and passwd into the URL.

It's also missing the "guts" of the authentication process - what to do if the person is/is not logged in. I'd do this by adding two lines near the end:

} else {
session_unset();
session_destroy();
}
header('Location:login.php'); //Or whatever your login page is called
exit(); // To end the processing of this page.
}

The redirection will occur if (1) the password and username aren't set, or (2) the username/password combination aren't in the database.

Anon

Take a look at this PHP and MySQL Username / Password validation example. I'm thinking about writing something like this for developers-resources.net but with a sessions blocking feature...

Greg🙂

<?php

/*
SQL to build sample database table named 'your-database-here'
CREATE TABLE user-password-table (
username varchar(12),
password varchar(12),
);

INSERT INTO user-password-table VALUES ('your-username-here','your-password-here');
*/

$username = "your-username-here";

$password = "your-password-here";

$database = "your-database-here";

$db = mysql_connect("localhost", "$username", "$password");

mysql_select_db("$database",$db);

$result = mysql_query("select count(username) as Total from user-password-table where username='$username' and password='$password'",$db);

$row = mysql_fetch_array($result);

if ($row["Total"]=="0"):

echo "<BODY bgcolor=\"#BFBFBF\" link=\"Black\" vlink=\"Black\" alink=\"Black\">";

echo "<FONT FACE=\"Arial\" COLOR=\"#FFFFFF\"> ";

echo "<CENTER><H1>WARNING:<P>USER/PASSWORD Failed!</H1></CENTER>";

else:

echo "<BODY bgcolor=\"#BFBFBF\" link=\"Black\" vlink=\"Black\" alink=\"Black\">";

echo "<FONT FACE=\"Arial\" COLOR=\"#FFFFFF\"> ";

echo "<CENTER><H1>Welcome Back $username.</H1></CENTER>";

endif;

mysql_close($db);