I'm up late working and I stopped by to get some help on a simple issue when I noticed your login script question.
I started using this website about a month ago BECAUSE of this very question...
So, if you don't mind... here is my spill.
I started out with a simple login script that verified a password against a mysql database and let them proceed to other pages buried in my site. I later learned that there a tricks to bypass this security, so I basically made a login script that retained a users login name and password (md5 encrypted) and each page they went to rechecked their information and state to ensure they were indeed logged in.
I'm no PHP expert, so I can't guarantee security -- I just know that nobody has broken anything of mine yet... you know, those foolish hacker types. So, here is my example.
#0. A few notes... I did set PHP to register_globals on. This basically means variables are stored as globals and can be used all over the place.... I think.
#1. Create a database in MySQL to retain user specific information. Basically, use this script (copy and paste into a file and name it test.dbschema) to create the appropriate database for this example :
drop database if exists test;
Checks if database named test exists. If it does, delete it.
create database test;
Create a new datbase called test
grant select, insert, update, delete, file on test.* to user@localhost identified by "password";
Grant access to user namned user with password as its password
use test;
Use the database you just created
drop table if exists users;
create users table
create table users (
user_id int(10) not null, auto_increment,
username varchar(70) not null,
password varchar(70) not null,
realname varchar(70) not null,
primary_key (user_id)
) TYPE = MyISAM;
Now, what you have done is created a database and your users table. The table holds an auto-incremented user id (ie 0,1,2,3,etc), username that is 70 characters long, password that is 70 characters long, and the users real name.
#2. Now, you want to add a user. We also WANT to encrypt their password using md5sum. MD5 is a one way encryption, meaning you can't decode it. I'll explain more later...
So, from your unix prompt, type :
echo dummy | md5sum
It should output the following :
f02e326f800ee26f04df7961adbf7c0a -
f02e326f800ee26f04df7961adbf7c0a is the encrypted password for dummy.
To add a dummy user, execute the following MySQL command :
insert into users values ('','dummy','f02e326f800ee26f04df7961adbf7c0a','Dummy User');
You have just added a user called dummy with password dummy that is encrypted.
#3. Build a webpage with a basic FORM so a user can enter the username and password. Call it index.html :
<html>
<form method="POST" action="validatelogin.php">
Username : <input type="text" name="username" size=20>
Password : <input type="password" name="password" size=20>
<input type="submit" name="submit" value="Submit Login">
</form>
</html>
The above creates a simple HTML page that grabs the users input for their username and password and stores them into the variables username and password.
These variables are sent to your next file called validatelogin.php
#4. Validatelogin.php. Create this file -- it looks like this :
<?php
session_start();
// First, encrypt the password sent from index.html
$password = md5($password);
// now, your password should look like what is stored in the database
// Next, open your database connection
$dbHost = "localhost";
$dbUser = "user";
$dbPass = "password";
$dbDatabase = "test";
$db = mysql_connect("$dbHost", "$dbUser", "$dbPass") or die ("Error connecting to database.");
mysql_select_db("$dbDatabase", $db) or die ("Couldn't select the database.");
// You now have a connection to the database.
// Now, you'll want to scan all of your users in the user table to see if this user exists and has this password
$result = mysql_query("select * from user", $db);
// this runs the select command and stores all the user information in the result array
// run a while loop and check for the valid user.
while ($r = mysql_fetch_array($result)) {
if ($r[1] == $username) {
if ($r[2] == $password) {
echo "we have a match";
$realname = $r[3];
session_register(username);
session_register(password);
session_register(realname);
// this registers the users variables to be used on later
// pages
// now, call your next page... let's call it page1.php
include ("page1.php");
exit;
} else {
echo "Loser - you aren't who you say you are";
}
}
#5. Now, the user has been validated and is to be sent to page1.php... Here is the code for this page. Again, this page's first job is to check session variables and re-check the users username/password. If the user is indeed who they say they are, page1.php tells them their name :
<?php
session_start();
// Again, open your database connection
$dbHost = "localhost";
$dbUser = "user";
$dbPass = "password";
$dbDatabase = "test";
$db = mysql_connect("$dbHost", "$dbUser", "$dbPass") or die ("Error connecting to database.");
mysql_select_db("$dbDatabase", $db) or die ("Couldn't select the database.");
// You now have a connection to the database.
// Now, you'll want to scan all of your users in the user table to see if this user exists and has this password
$result = mysql_query("select * from user", $db);
// this runs the select command and stores all the user information in the result array
// run a while loop and check for the valid user.
while ($r = mysql_fetch_array($result)) {
if ($r[1] == $username) {
if ($r[2] == $password) {
echo "we have a match";
$realname = $r[3];
// this registers the users variables to be used on later
// pages
// Tell the user they are logged in.
echo "You are $realname <br>";
exit;
} else {
echo "Loser - you aren't who you say you are";
}
}
-- Well, its a lame tutorial, but it is 3 in the morning... I just thought my jibberish might help....
Feel free to respond and I'll see what I can help with.
-- Toodles.
