hi every1 my 1st post just need little help to get going

Trev333

hi every1 my 1st post just need little help to get going

the last week or so been using some virtual training company tutorials videos

i come to one tutorial about a login script u get the data base and the script with it. i put the script and the data base on my server and try test it by putting in wrong user name to make sure it will tell me i have put wrong user name in then a user name i know in the database etc

my server running on windows sever 2003 iis 6 php 4 installed and mysql installed

this is the script

<? session_start() ?>
<HTML>
<HEAD>
<TITLE>Login</TITLE>
</HEAD>

<BODY>
<H2>Login</H2>
<?

// keep hyperlinks in a string variable
$links = "<A HREF='main.php'>Click here to proceed to the main page</A><BR><BR><A HREF='logout.php'>Click here to log out.</A>";

// check to see if details have been passed to the script by the form
if ($user && $pass) {

	// if already logged in *as this user*, let them know, and show them the links.
	// .. of course, if they are logged in as someone else, let them log in as a different user
	if ($logged_in_user == $user) {
		echo $user.", you are already logged in.<BR><BR>";
		echo $links;
		exit;
	}

	// connect to database and select 'userlist' database
	$db = mysql_connect("localhost");
	mysql_select_db("userlist", $db);

	// check input variables against database
	$result = mysql_query("SELECT * FROM users WHERE name = '".$user."'
					AND password = PASSWORD('".$pass."')");

	// in case of an error, throw up an error message and exit
	if (!$result) {
		echo "Sorry, there has been a technical hitch. We cannot enter your details.";
		exit;
	}

	// greet valid user and show links
	if (mysql_num_rows($result) > 0) {
		$logged_in_user = $user;
		session_register("logged_in_user");
		echo "Welcome, ".$logged_in_user.". <BR><BR>";
		echo $links;
		exit;

	// on invalid login, show user HTML form to login again
	} else {
		echo "Invalid login. Please try again.<BR><BR>";
	}

// in case user only fills in one field, show error message and HTML form ..
} else if ($user || $pass) {
	echo "Please fill in both fields.<BR><BR>";
}

?>
<FORM METHOD=POST ACTION="login.php">
Your username:
<INPUT NAME="user" TYPE=TEXT MAXLENGTH=20 SIZE=20>
<BR>
Your password:
<INPUT NAME="pass" TYPE=PASSWORD MAXLENGTH=10 SIZE=10>
<BR>
<INPUT TYPE=SUBMIT VALUE="Login">
</FORM>
</BODY>
</HTML>

all that happens is i try a user name and pass press login but it just brings mw back to the same page

just wondering if there a basic error or something

hope some one can help thanks in advance Trev

jamie85


 // check to see if details have been passed to the script by the form
$user = $_POST['user'];
$pass = $_POST['pass'];
if ($user && $pass) {

The username and password are stored in the array $_POST. Unless you have global variables turned on, use this method to get variables from a form.

Pascal_P_

I think you would like to seperate login.html, where you can find your form and your links (logout and main.php) are, and login.php, where you use the $_POST[''] variables to treat the form and authorize or deny access.

But beyond that I think you also may want to take a look at security issues.
For example it seems to me that anyone that enters name AND 1=1"); (for example) as a user login can enter the member area. 😕

You should prevent yourself form input of html caracters and sql injections.

Good luck

Trev333

thanks for the quick reply jamie85 did not exspect b that quick

i put the 3 lines in u surgested and it worked but now i got a new prob

i get the error invalid login ok but when i put a name and password i know to be in the data base i still get invaild login

hope u can help and im not been too much of a pain

hi Pascal P this only a test think so far hopeing sort sequrity soon as well
im quite new to this so im just editing this tutral 1st

im not quite sure what u was saying in the reply cus im am really new to php

im am still working on it so any relpy will b helpful

thanks every1 whos trying help this my 1st question and already got some good ideas love phpbulider.com amzing place to learn

btw the database that came with the tutral is a text file with exstention sql hope that make sence and i put it in the same dir as the login php

it reads

MySQL-Front Dump 2.0

Host: localhost Database: userlist

#--------------------------------------------------------

Server version 3.23.33

DROP DATABASE IF EXISTS userlist;

CREATE DATABASE userlist;

USE userlist;

Table structure for table 'users'

CREATE TABLE users (
userID tinyint(3) unsigned NOT NULL auto_increment,
name char(20) NOT NULL default '',
password char(40) NOT NULL default '0',
PRIMARY KEY (userID),
UNIQUE KEY userID(userID,name)
) TYPE=MyISAM;

Dumping data for table 'users'

#
INSERT INTO users VALUES("2","someone","11c931a873eb2cbd");
INSERT INTO users VALUES("20","Kermit","056244e832268bb0");
INSERT INTO users VALUES("19","Mr X","032c41e8435273a7");

hope this will help

i have been useing Navicat to crate my own databases as well is this best program to use?

Thanks all

Trev

frost110

<? session_start() ?>
<HTML>
<HEAD>
<TITLE>Login</TITLE>
</HEAD>

<BODY>
<H2>Login</H2>
<?

// keep hyperlinks in a string variable
$links = "<A HREF='main.php'>Click here to proceed to the main page</A><BR><BR><A HREF='logout.php'>Click here to log out.</A>";

// check to see if details have been passed to the script by the form
if (isset($_POST['user']) && isset($_POST['pass'])) {
	// Set the variables
	$user = $_POST['user'];
	$pass = $_POST['pass'];

// if already logged in *as this user*, let them know, and show them the links.

if ($_SESSION['logged_in_user'] == $user) {
	echo $user.", you are already logged in.<BR><BR>";
	echo $links;
	exit;
}

// connect to database and select 'userlist' database
$db = mysql_connect("localhost");
mysql_select_db("userlist", $db);

// check input variables against database
$result = mysql_query("SELECT * FROM users WHERE name = '".$user."'
AND password = PASSWORD('".$pass."')");

// in case of an error, throw up an error message and exit
if (!$result) {
	echo "Sorry, there has been a technical hitch. We cannot enter your details.";
	exit;
}

// greet valid user and show links
if (mysql_num_rows($result) > 0) {
	$logged_in_user = $user;
	session_register("logged_in_user");
	echo "Welcome, ".$logged_in_user.". <BR><BR>";
	echo $links;
	exit;

	// on invalid login, show user HTML form to login again
}else {
	echo "Invalid login. Please try again.<BR><BR>";
}

// in case user only fills in one field, show error message and HTML form ..
}else {
	echo "Please fill in both fields.<BR><BR>";
}
?>
<FORM METHOD=POST ACTION="login.php">
Your username:
<INPUT NAME="user" TYPE=TEXT MAXLENGTH=20 SIZE=20>
<BR>
Your password:
<INPUT NAME="pass" TYPE=PASSWORD MAXLENGTH=10 SIZE=10>
<BR>
<INPUT TYPE=SUBMIT VALUE="Login">
</FORM>
</BODY>
</HTML>

Some helpful tips.

Even though register_globals is on, never use them. Meaning do not call $user because you can, first declare $user by $user = $_POST['user']; to help prevent some major exploits.

Same with session variables. use $var = $_SESSION['var']; to instantiate it to help prevent exploits.

I have never used the password function of MySQL. I usually md5 hash up the password then send it to the database. The value in the database is an md5 hashed password. That works very well and is very secure.

Revamped the code, let me know how it goes.

As for navicat...why the heck do you need that? Just use Notepad. Works great and you have full control over what gets done.

--FrosT

Trev333

hi frost110 thanks for the revamp i like it hope it was not too much trouble

i wrote a new user database so i know what it was going just with 1 test user of Trev and password of 123 but it wont login says invaild user

is it right putting the datsbase in the same dir and the php? and do i need put the sql exstention in the php code

hope not been too much of pain just want kearn y it not login lol doing my head in
wondering if it conecting to the database or prob with the database

Trev

frost110

Trev333 wrote:
hi frost110 thanks for the revamp i like it hope it was not too much trouble

i wrote a new user database so i know what it was going just with 1 test user of Trev and password of 123 but it wont login says invaild user

is it right putting the datsbase in the same dir and the php? and do i need put the sql exstention in the php code

hope not been too much of pain just want kearn y it not login lol doing my head in
wondering if it conecting to the database or prob with the database

Trev

Not too bad. But you said some things that concern me.

"is it right puttingthe db same dir as the php"

If you are using mysql, that is not right at all. MySQL is a program and you have to load that .sql file with all your database declarations to it. I do not know what server you are running (Windows or Linux) but you need MySQL. www.mysql.com

I do not know if your hosts supports it or not. Probably the best thing for this would be phpMyAdmin, if you do not have it I would get it some how and use that. That allows you to run sql, add data, modify data etc.

Without a MySQL database, I do not know why you are not getting connection issues.

If you already created the tables in MySQL, than the flatfile of sql statements used to create the tables etc is no longer needed.

The best I can give you is that there is something with the hashes. I would screw the PASSWORD function by mysql and use md5. So update your data in the database with the md5 hash of the password. Then before you check against the data with the password do something like this.

$pass = md5($_POST['pass']);

So that way you know you are checking against similiar values.

--FrosT

Trev333

thanks every1 for all the help

i found out what i was doing wrong with the database

the text file i was on about was just a text dump of the database i was supose to use, so i create it in mysql useing the mysql command line and i could login. Got few other probs but going take a look see i can work few things out

i will prob b back soon Trev

Trev333

hi im back again

1st bad news ive had to format the server and reinstll every thing because i found out my m8s host only surported mysql 3.23 for some reason

but that messed every thing up so i wiped it and put iis6 php 4 and mysql 5 back on

however b4 i wiped mysql and put mysql 3 on (i know it was daft move lol) i got login script working it was a copy and paste of frost110 code just abouve this post

but now ive put iis6 php 4 and mysql 5 back on i run it now and get errors

Warning: mysql_connect(): Access denied for user 'ODBC'@'localhost' (using password: NO) in c:\inetpub\wwwroot\login.php on line 29

Warning: mysql_select_db(): supplied argument is not a valid MySQL-Link resource in c:\inetpub\wwwroot\login.php on line 30

Warning: mysql_query(): Access denied for user 'ODBC'@'localhost' (using password: NO) in c:\inetpub\wwwroot\login.php on line 34

Warning: mysql_query(): A link to the server could not be established in c:\inetpub\wwwroot\login.php on line 34
Sorry, there has been a technical hitch. We cannot enter your details.

i was just wondering what happen ive chaged nothing far as i know just install all back server back to default

hope this all makes sence b glad any help thanks all Trev