HELLO ALL.
PROFESSIONALS... I NEED YOUR HELP.
I HAVE RECENTLY GOT A JOB AT A DECENT PLACE THAT HIRED ME TO ADMIN THEIR NETWORK...AND... CODING A DYNAMIC WEBSITE WITH PHP AND MYSQL. WELL... IM A NEWBIE...IVE ONLY BEEN LOOKING AT MYSQL AND PHP FOR A WEEK. ANYHOW.. IVE BEEN CODING SOME STUFF FOR OUR WEBSITE. RIGHT NOW .. IM ONLY AT THE USER AUTHENTICATION PART. GIVEN THAT IM AN EXTREME NEWBIE... I DONT KNOW SECURITY...AT ALL ACTUALLY.
SO... FOR YOU PROFESSIONALS OUT THERE... I KNOW YOU ALL KNOW WHAT THINGS TO LOOK FOR WHEN IT COMES TO DEVEL0PING DYNAMIC PAGES FOR WEBSITES THAT NEED TO BE PRETTY SECURE. PLEASE LOOK AT MY CODE AND TELL ME IF THIS IS WORTHY OR BEING PUT UP AS A CORPORATE WEBSITE (CODE WISE... I'VE YET TO START CONSIDERING HARDWARE SECURITY AND ALL THAT.) PLEASE HELP...ALL THIS CODE IVE PUT TOGETHER IS FROM TEXT BOOKS AND ONLINE HELP...I HAVE GOT ONLY ABOUT 2 SEMESTERS OF PROGRAMMING COURSEWORK UNDER MY BELST...SO IM REALLY WEARY OF PUTTING ANYTHING UP THAT HASNT BEEN CRITIQUED BY A SEASONED PROFESSIONAL.
ANY INPUT WOULD BE REALLY HELPFUL.
THANK YOU ALL SO MUCH.
HERE IT GOES.
GATEWAY.PHP is the page that recieves user input
AUTHENTICATION.PHP is the php page that verifies user input with the database.
//GATEWAY.PHP
<html>
<body
<br /><br />
<p> my company name</p>
<form action = "AUTHENTICATION.PHP" method=post>
<input type="text" name="username">
USERNAME
<br>
<input type="text" name="password">
PASSWORD<br>
<input type="image" src="login.gif">
</form>
</body>
</html>
//AUTHENTICATION.PHP
<?
echo "MYCOMPANY INC. User Authentication routine.<br /><br />";
//RETRIEVING VARS FROM GATEWAY.PHP VIA POST
$username =$POST['username'];
$password = $POST['password'];
//CONNECTING TO DATABASE
$link = mysql_connect ('localhost', 'spinsykel', 'spinsykel');
if ($link)
{
echo "error: could not connect to database <br /><br />";
exit;
}
//RETRIEVING DATA FROM DATABASE
mysql_select_db('users');
$sql = "SELECT lastname FROM users WHERE password = '$password' AND firstname = '$username'";
$result = mysql_query($sql) or die (mysql_error());
//IF FINDS NO MATCHING PASSWORD AND USERNAME
if (mysql_num_rows($result) == 0)
{
echo "INVALID USERNAME AND/OR PASSWORD.
PLEASE CLICK BACK ON YOUR BROWSER AND
ENTER A VALID USERNAME AND PASSWORD.
THANK YOU.";
}
//IF FINDS NO MATCHING PASSWORD AND USERNAME
if (mysql_num_rows($result) ==1)
{
$row = mysql_fetch_array($result);
list(,$lastname) + each ($row);
echo 'RECORD FOUND! <br /><br />';
$username = ucfirst ($username);
$lastname = ucfirst ($lastname);
echo "$lastname, $username;
$found =1;
}
//IF FINDS MORE THAN ONE MATCHING PASSWORD AND USERNAME (BIG TROUBLE!)
if (mysql_num_rows($result) > 1)
{
echo "WE ARE HAVING TECHNICAL DIFFICULTIES AND
ARE UNABLE TO RETRIEVE YOUR USER INFORMATION AT
THIS TIME. PLEASE COME BACK AT A LATER TIME.
THANK YOU - INFORMATION SYSTEMS DEPRTMENT";
}
?>
