This is a script to take a user's username and password, compare it with what is in the database, and then set a cookie with the user's username in place. I'm having a problem with the password function though. The username is compared with that in the database correctly, but when using the PASSWORD() function to encrypt the password data, it causes problems.
I have made sure that the password in the database is the same (pass) and that it is also encrypted the same so that the two can be compared.
I know that the PASSWORD function encrypts the data permenantly, so I assume that here the new data would be encrypted in the same way, then compared to make a match. Sadly, know matter what I do it doesn't work. I have tried comparing non-encrypted passwords and it sets the cookie okay so I have pinned down the problem to the password function.
Here is my script:
<?php # Script 7.16 - login.php
if (isset($_POST['submit']))
{
$odbc = odbc_connect('ownpage', 'root', 'pass') or die( "Could Not Connect to ODBC Database!");
/*function escape_data ($data)
{
global $odbc;
if (ini_get('magic_quotes_gpc'))
{
$data = stripslashes($data);
}
return odbc_real_escape_string($data, $odbc);
}//end function*/
$message = NULL;
if (empty($_POST['username']))
{
$u = FALSE;
$message = '<p>You forgot to enter your username!</p>';
}
else
{
//$u = escape_data($_POST['username']);
$u = $_POST['username'];
}
if (empty($_POST['password']))
{
$p = FALSE;
$message .= '<p>You forgot to enter your password!</p>';
}
else
{
//$p = escape1_data($_POST['password']);
$p = $_POST['password'];
}
[b]
if($u && $p)
{ // If everything's OK.
$input = "SELECT uname FROM ownpage.users where uname = '$u' and pass = PASSWORD('$p')";
echo "<p/>Input: $input <p/>";
$query = odbc_exec($odbc,$input);
$record = odbc_fetch_array($query);
//echo "cookie set to".$record[0]."<p/>";
//if we have a matching username record, create the username cookie
if($record)//if we just pulled out a record, set the cookie to the user's username
{
setcookie('uname',$record['uname']);
exit();//exit the script
}[/b]
else
{
$message = "Your username and/or password were incorrect.";
}
}//end user and password having data
//odbc_close();//close connection to db server.
}//end isset if
else
{
$message = "<p>Please try again.<p/>";
}
$page_title = 'Login';
//include ('templates/header.inc');
if(isset($message))
{
echo '<font color="red">', $message, '</font>';
}
?>
<form action="
<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
<fieldset><legend>Enter your information in the form below:</legend>
<p><b>User Name:</b>
<input type="text" name="username" size="10" maxlength="20" value="<?php if (isset($_POST['username']))
echo $_POST['username'];
?>" /></p>
<p><b>Password:</b>
<input type="password" name="password" size="20" maxlength="20" /></p>
<div align="center"><input type="submit" name="submit" value="Login" /></div>
</form>
<!-- End of Form -->
<?php
//include ('templates/footer.inc');
?>
I hope that makes it clear what the problem is, any replies appreciated.
Daniel.
