Increasing security - Login problem.

Smeep

Hi all, it's me again.

I've been building a page updater thingy (blog, i guess) and I've been working on a login script for it.

the basic gist of what if have is this:

loginfields.php (user, pass etc)
login.php
if login correct creat cookie and forward to posting screen
else error message
posting
check for cookie
if no cookie error message
if cookie then show form

The problem I have, is that if you just point the broswer to login.php, it automatically logs you in, despite having not entered anything in to the loginfields.

Can I prevent people navigating to login.php?

mrhappiness

Smeep wrote:
Can I prevent people navigating to login.php?

No, but you can check in login.php whether the user provided some credentials
(you stated "if login correct", how do you verify that?)

how does your login work?
are you working with sessions?

justsomeone

blocking people navigating to login.php isn't really the answer here. Your question should be why is it logging people in when no (or no valid) login details are being passed to it?

Smeep

<html>
<head>
<meta HTTP-EQUIV="REFRESH" content="5; url=http://www.paint-zone.co.uk/post.php">
<link rel="stylesheet" type="text/css" href="stylesheet.css" />

<title>Paint-Zone</title>
</head>

<?php 

$dbcnx = @mysql_connect('mysql.lcn.biz', 'myuser', 'mypass');
if (!$dbcnx) {
 echo 'Unable to connect to the ' .
     'database server at this time.' ;
 exit();
}

// Select the database
if (!@mysql_select_db('paintzone')) {
 exit('<p>Unable to locate the ' .
     'database at this time.</p>');
} 

$username = $_POST['username'];
$password = $_POST['password'];
$query = "SELECT password FROM login  WHERE username ='$username'";

		$result = mysql_query($query);
		if (!$result)
		 {
			 echo 'Username or Password Incorrect';
			 }
			else
		   {
			 	$password = mysql_result($result, 0, 'password');
				if ($password == $_POST['password'])
				{

				 setcookie ("pzcookie", "you are logged in", time()+3600);  


					echo 'login success <br />';
					echo 'attemtping to redirect <br />';
					echo '<p>Click <a href=http://www.paint-zone.co.uk/post.php>here</a> if you do not wish to wait</p>';

				}
				else
				{
					echo 'login failed';
			 }

			 }

?>

</body>
</html>

Very simple, i've only just started this kind of thing you see 😉

but if you navigate to login.php

"Warning: mysql_result(): Unable to jump to row 0 on MySQL result index 5 in /home/.sites/145/site327/web/login.php on line 49
login success
attemtping to redirect

Click here if you do not wish to wait"

justsomeone

$username = $_POST['username'];
$password = $_POST['password'];

You need to at least check that these fields are not empty.

A very basic check would look something like


if ((!isset($_POST['username'])) || (!isset($_POST['password']))){
    echo 'Username or Password Incorrect';
    exit();
}
$username = $_POST['username'];
$password = $_POST['password'];

That should address your immediate problem. You may want to introduce more sophisticated checks here as well. Do a search on your favourite engine for "SQL injection attacks".

Smeep

Will do, thanks for the help. I'll post back to let you know how it goes.

EDIT: Hmm, It half works.

The problem is, my "refresh to" is in the meta tag.

Is there a way to put the "refresh to" inside an if statement?

justsomeone

Also you may want to consider using...


$query = "SELECT password FROM login  WHERE username ='$username' and password='$password'";

		$result = mysql_query($query);
		if (!$result)
		 {
			 echo 'Username or Password Incorrect';
		 }
		 else
		 {
                            setcookie ("pzcookie", "you are logged in", time()+3600);  
			echo 'login success <br />';
			echo 'attemtping to redirect <br />';
			echo '<p>Click <a href=http://www.paint-zone.co.uk/post.php>here</a> if you do not wish to wait</p>';
		}

ie - let the the database check the password instead of asking the code to.

Smeep

Alright, I'll look in to that (it's a bit much for me and my primitive brain right now) I'll work on getting this auto login problem solved first 😉

So, is there a way to but the "Refresh to" part inside an If tag instead of the meta tag?

EDIT: On a further note - if you don't have the cookie, when it refreshes, you get the error message, which is good. But it would still be nice to get it to ONLY refresh if you log in.

justsomeone

Good grief! I onlyjust notice you were doing that! So you were redirecting anyway, regardless of what happened with the database search.

Lose that meta refresh.

So long as your PHP hasn't already sent anything to the browser, you can use a header redirect.

header("Location: http://www.example.com/"); /* Redirect browser */

Check the header command out for full details.

Smeep

Alright, sweet that's what I was looking for.

Can I put a delay on that? Because as it is it does it so fast that it doesn't display the redirecting message.

I looked in the link you posted, but I didn't see the answer to my question.

thorpe

the header function cant be called after any output is sent to the browser, so trying to display a redirect message would just cause another error.

LoganK

Use JavaScript:

Now, I'm not sure what the exact syntax for setTimeout() is (it might not be setTimeout), but that's the basics of what you need.