Problems with cookies, passwords and alike

rollosb

<?php
$passw = $_REQUEST["passw"];
$savpw = md5($passw);
if ($passw) setcookie("savpw", $savpw, time() + 7200);
?>

<?php

if ($savpw == md5("password")) {

echo "<a href=index.php>All</a> ";
$alph = "abcdefghijklmnopqrstuvwxyz";
for ($f = 1; $f <= 26; $f++) {
$g = $f - 1;
echo "<a href=\"?sort=" . $alph[$g] . "\">" . strtoupper($alph[$g]) . "</a>";
if ($f < 26) echo " ";
if ($f == 26) echo "<p>";
}

$sort = $_REQUEST['sort'];
if (strtoupper($sort) != $sort) $sort = strtoupper($sort);
$music = file('muscoldb.csv');
$n = count($music) - 1;
sort($music);

for ($i = 0; $i <= $n; $i++) {
if (!$sort || $music[$i][0] == $sort) {
$a[$i] = explode(";", $music[$i]);
$c = $i - 1;
if ($i != 0) $d[$i] = explode(";", $music[$c]);
$b = $i + 1;

if ($a[$i][3] == $d[$i][3]) {
	echo $b . ". " . $a[$i][1] . " (" . $a[$i][2] . ")<br>";
} else {
	echo "<font size=4>";
	echo $a[$i][3];
	echo "</font><br>" . $b . ". " . $a[$i][1] . " (" . $a[$i][2] . ")<br>";
   	}	
}

}
} else {
?>
Feel free to type in a password...as long as it is the <b>right</b> one.<p>
<form method="post" action="<?=$PHP_SELF;?>">
<input type="password" name="passw">
<input type="submit" value="Let's look at some music!">
</form><?php } ?>

This is the code for my PHP music database. PHP loads a file, organizes it, and sets it up like a wonder. Now, in order to make this thing secure (so people can't find a specific record and then steal it), I've wanted to password-protect it. As you can see, I've inserted a form at the bottom, it sends a typed password to the very same page, the cookie's apparently conceived, the password test and the page then shows. However, this only lasts for one view of page. Whenever I click one of the letter links, I return to the form immediately. I've concluded it must be something with the cookies, but I don't know exactly. Is somebody able to help me?

drew010

<?php

if (isset($_COOKIE['savpw'])) {
  if ($_COOKIE['savpw'] == md5("password")) {
    show_record();
  } else {
    echo "Incorrect password.";
    exit;
  }
} else {
  show_pw_form();
}

?>

using a structure like that above may be a little clearer and easier to follow, as well as cleaner and easier to manage.

rollosb

The page shows nothing now...

rollosb

Alright, the code is now like this:

<?php
$passw = $_REQUEST["passw"];
$savpw = md5($passw);
if ($passw) setcookie("savpw", $savpw, time() + 7200);

function show_record() {
echo "<a href=index.php>All</a> ";
$alph = "abcdefghijklmnopqrstuvwxyz";
for ($f = 1; $f <= 26; $f++) {
$g = $f - 1;
echo "<a href=\"?sort=" . $alph[$g] . "\">" . strtoupper($alph[$g]) . "</a>";
if ($f < 26) echo " ";
if ($f == 26) echo "<p>";
}

$sort = $_REQUEST['sort'];
if (strtoupper($sort) != $sort) $sort = strtoupper($sort);
$music = file('muscoldb.csv');
$n = count($music) - 1;
sort($music);

for ($i = 0; $i <= $n; $i++) {
if (!$sort || $music[$i][0] == $sort) {
$a[$i] = explode(";", $music[$i]);
$c = $i - 1;
if ($i != 0) $d[$i] = explode(";", $music[$c]);
$b = $i + 1;

if ($a[$i][3] == $d[$i][3]) {
	echo $b . ". " . $a[$i][1] . " (" . $a[$i][2] . ")<br>";
} else {
	echo "<font size=4>";
	echo $a[$i][3];
	echo "</font><br>" . $b . ". " . $a[$i][1] . " (" . $a[$i][2] . ")<br>";
   	}	
}

}
}

function show_pw_form() { ?>
Feel free to type in a password...as long as it is the <b>right</b> one.<p>
<form method="post" action="<?=$PHP_SELF;?>">
<input type="password" name="passw">
<input type="submit" value="Let's look at some music!">
</form><?php }

if (isset($COOKIE['savpw'])) {
if ($COOKIE['savpw'] && $_COOKIE['savpw'] == md5("password")) {
show_record();
} else {
echo "Incorrect password.<p>";
show_pw_form();
exit;
}
} else {
show_pw_form();
}
?>

When I type the password, I receive "Warning: Cannot modify header information - headers already sent by (output started at c:\apache\htdocs\muscol\index.php:3) in c:\apache\htdocs\muscol\index.php on line 6"...now what to do?

drew010

you must set your cookies before ANY content is sent to the browser, including whitespaces.

rollosb

<?php

$passw = $REQUEST["passw"];
$logout = $REQUEST["logout"];

$savpw = md5($passw);
if ($passw) {
setcookie("savpw", $savpw, time() + 7200);
header("Location: index.php"); exit;
}

if ($logout == 1) {
setcookie("savpw", $savpw, time() - 7200);
header("Location: index.php"); exit;
}

<?php

$sort = $_REQUEST['sort'];
if (strtoupper($sort) != $sort) $sort = strtoupper($sort);
$music = file('muscoldb.csv');
$n = count($music) - 1;
sort($music);

for ($i = 0; $i <= $n; $i++) {
if (!$sort || $music[$i][0] == $sort) {
$a[$i] = explode(";", $music[$i]);
$c = $i - 1;
if ($i != 0) $d[$i] = explode(";", $music[$c]);
$b = $i + 1;

if ($a[$i][3] == $d[$i][3]) {
	echo $b . ". " . $a[$i][1] . " (" . $a[$i][2] . ")<br>";
} else {
	echo "<font size=4>";
	echo $a[$i][3];
	echo "</font><br>" . $b . ". " . $a[$i][1] . " (" . $a[$i][2] . ")<br>";
   	}	
}

}
}

<?php
}

if (isset($COOKIE['savpw'])) {
if ($COOKIE['savpw'] == md5("password")) {
show_record();
} else {
echo "Incorrect password.<p>";
show_pw_form();
exit;
}
} else {
show_pw_form();
}
?>

Works now. Thanks!