PHP Code Stopped Working

bprevallet

I hope this could be a simple fix. My site administrators have recently moved my website to another server. For some reason some of my PHP pages are not working properly. The specific example below is just a login page. The user inputs their username and password. They then click the submit button. The submit button is supposed to display whether or not they successfully logged in. However, nothing happens after the button is pressed. There's no messages at all. Not even an error message and the person is not logged in. Please help. This code worked just fine on the last server. You can check it out as well www.secpicks.com/login See code below:

<?php
include ('secpicksdata.php');
ob_start(); ?>
<HTML><HEAD>
<BODY bgcolor="#0000CC" text="#0000CC">
<p align="center"> </p>
<P>
<TABLE border=0>
<TBODY>
<TR>
<TD height=1></TD>
</TR>
</TBODY>
</TABLE>
<table width="640" border="4" align="center" height="480" bordercolor="#FFFF33" bgcolor="#CCCCCC" tracingsrc="secpinwh.gif" tracingopacity="33">
<tr align="center" valign="middle">
<td>
<table border="0" width="275" align="center">
<tr>
<td>
<div align="center"><font color="#000000" size="2" face="Verdana, Arial, Helvetica, sans-serif"><a href="http://www.secpicks.com/signup.php" style="text-decoration:none">SIGNUP</a></font></div>
</td>
<td>
<div align="center"><font color="#000000" size="2" face="Verdana, Arial, Helvetica, sans-serif"><a href="http://www.secpicks.com/login.php" style="text-decoration:none">LOGIN</a></font></div>
</td>
<td>
<div align="center"><font color="#000000" size="2" face="Verdana, Arial, Helvetica, sans-serif"><a href="http://www.secpicks.com/logout.php" style="text-decoration:none">LOGOUT</a></font></div>
</td>
<td>
<div align="center"><font color="#000000" size="2" face="Verdana, Arial, Helvetica, sans-serif"><a href="http://www.secpicks.com/users.php" style="text-decoration:none">MY
PICKS</a></font></div>
</td>
</tr>
</table>
<p align="center"><font size="+3">SEC PICKS</font></p>
<p align="center"><font size="3" face="Verdana, Arial, Helvetica, sans-serif"><?php

echo "
Please log in!<br>
<form action=\"?action=check\" method=\"post\">
Username: <input type=\"text\" name=\"username\" size=\"15\"> <br>
Password: <input type=\"password\" name=\"password\" size=\"15\"> <br>
<input type=\"submit\" value=\"submit\" name=\"submit\">
</form>";

if ($action == check)
{
$result = MYSQL_QUERY("SELECT id, username, id, password from users WHERE username='$username' and password='$password'") or die ("Name and password not found or not matched");
$worked = mysql_fetch_array($result);
$user = $worked[username];
$password = $worked[password];
$id = $worked[id];

if($worked){
echo "Welcome $username, you are logged in with the username:<br>";
echo "<font color=#FF0000>$username</font>";
echo "<br>and with password:<br>";
echo "<font color=#FF0000>$password</font>";
print "<br>You may now enter the <a href=http://www.secpicks.com/users.php>MY PICKS</a> section</br>";
setcookie("loggedin", $loggedin=1, time()+604800);
setcookie("username", $username, time()+604800);
setcookie("password", $password, time()+604800);
setcookie("id", $id, time()+604800);
}
else{ echo "Can't log you in, please try again";}
}

?></font><font size="3"><?php ob_end_flush(); ?></font></p>
<p align="center"><font size="2">Questions: <a href="mailto:bart@secpicks.com">bart@secpicks.com</a></font></p>
</td>
</tr>
</table>
<p> </p>
</BODY></HTML>

frikikip

Hi,

Please check: http://www.php.net/register_globals .

Your script needs register_globals to be on. This is very unsecure however. Is basicly means that php can use variables WITHOUT checking how they were submitted. This is prone to abuse. You need to change al you posted variables like $action to $_POST["action"].

Besides this there is also another MAJOR security hole in this script. You don't validate the users input at all. A person who wants to do wrong could probably delete all your users or even worse. At least check the users input for special characters.

If you change

if ($action == check)
{
$result = MYSQL_QUERY("SELECT id, username, id, password from users WHERE username='$username' and password='$password'") or die ("Name and password not found or not matched");

if ($_POST["action"] == check)
{
$result = MYSQL_QUERY("SELECT id, username, id, password from users WHERE username='".mysql_real_escape_string($_POST["username"])."' and password='".mysql_real_escape_string($_POST["password"])."'") or die ("Name and password not found or not matched");

your script should work. The 'mysql_real_escape_string' function escapes all special characters to avoid sql injections. This is the very minimal check you should perform.

I don't know if you have any more scripts running on your server. If you do I strongly suggest that you check ALL your code. This is bound to go wrong at some point.

Hope I was able to help you.

Greets,

Marv

bprevallet

frikikip,

Thanks for responding to my post. I had my administrator turn register_globals on and I changed the two lines of code per your suggestion. I still do not get the successful or unsuccessful script after hitting the submit button. However, I tried switching the two lines of code to my original text and I do get the unsuccessful script but I get the unsuccessful script even if it "should be" a successful login. Any additional insight you could offer would be appreciated. Thanks again.

bart

Houdini

Turn register_globals off and if $_POST does not work then use $HTTP_POST_VARS as it could be an older version of PHP that is used on that server. Do a phpinfo() to see what version and other matters are going on with the server.