Help please

Anon

Ok here is my PHP

<?php
$file = file("users.dat");
foreach ($file as $line) ) {
$auth = explode(":", $username);
}
if ( ( $array[0] == $username ) && ( $array[1] == $password ) ) {

echo '<P>You are logged in</P>';

}else {

 echo '<P>You are not logged in</P>';

}
?>

$username and $password are passed to the PHP via from.

the data in the users.dat looks like this
user:pass:3hui312
bob:pass:3n43n

How can I get the array to do this?
If I send user and pass via the form

Array[0]= user Array[1]pass Array[2]=3hui312

Thanks in advance

Claude

Anon

Some comments below:

$file = file("users.dat");
foreach ($file as $line) ) {
$auth = explode(":", $username);
// why assign it to $auth? Don't you want to
// assign it to an array?
}

if ( ( $array[0] == $username ) && ( $array[1] == $password ) ) {
// where does $array come from? You need a for
// loop that loops from all the users
// in the array and see if anyone of them
// equals $username and $password.

Diego

Anon

Some comments below:

$file = file("users.dat");
foreach ($file as $line) ) {
$array = explode(":", $username);
// Opps I was tring to make this work.. your right it should be thios way
}

if ( ( $array[0] == $username ) && ( $array[1] == $password ) ) {
//array should come from above but I dont know how to loop it

Anon

Well, the only line you actually check is the last one - all the others get read into the $array array, but then you throw immediately throw them away when you read the next line.

Check before going on to the next line of the file, if you find a match, set a $match variable to true (set it to false before you start the loop) and break;. (When you find a match, you don't want to waste your time searching through the rest of your file, hence the break).

Once out of the loop, check $match to see if it's true (at the point where you're currently checking $array). If it's true then a match was found.

That said, you still seem to be a bit confused about what your $username is. I guess you're actually wanting to explode() $line.

$match = false;
$file = file('users.dat');
foreach ($file as $line) ) {
$array = explode(':', $line);
if($array[0]==$username && $array[2]==$password) // You don't really mean $array[1], do you?
{
$match=true;
$break;
}
}

if($match)
{logged in}
else
{not logged in}

if ( ( $array[0] == $username ) && ( $array[1] == $password ) ) {

Anon

That leaves a secuirty hole, if you run login.php=TRUE your logged in weather you match the login names or not.

Anon

i think you mean login.php?match=1

Anyway, yes it is a security hole, but that's why PHP now ships with register_globals off (in fact, it is deprecated).

Anyway, one way to do what Gumbler was doing, without the security hole is:
you make a function with a static variable $match. That $match will be local to the function, so any hackers won't be able to alter it thru the query string or whatever.

Diego

Anon

No, it's not a security hole; $match is explicitly set to false at the start of the script, overwriting such funny business on the part of the user.

One thing that will have to be noted is that $line will have to be trimmed before it's exploded, otherwise there'll be a stray "\n" to bollix the password equality test.