Find user name and password for register

rockofaith

I can't seem to make this code retrieve a user name and password in the directory it's looking up.

Any ideas why?

 <?php // Script 11.7 - login.php
// This script displays and handles an HTML form. 
// This script logs a user in by check the stored values in text file.

// Address error handing.
ini_set ('display_errors', 1);
error_reporting (E_ALL & ~E_NOTICE);

session_name('YourVisit');
session_start();

if (isset ($_POST['submit'])) { // Handle the form.

$loggedin = FALSE; // Not currently logged in.

// Open the file.
$fp = fopen ('users/accounts.txt', 'rb');

// Loop through the file.
while ( $line = fgetcsv ($fp, 100, "\t")) {

	// Check the file data against the submitted data.
	if ( ($line[0] == $_POST['user_name']) AND ($line[1] == crypt ($_POST['password'], $line[1]) ) ) {

		$loggedin = TRUE; // Correct username/password combination.

		// Stop looping through the file.
		break;

	} // End of IF.

} // End of WHILE.

fclose ($fp); // Close the file.

// Print a message.
if ($loggedin) {
	print '<p>You are now logged in.</p>';
} else {
	print '<p>The username and password you entered do not match those on file.</p>';	
}

} else { // Display the form.

// Leave PHP and display the form.
?>

<form action="index.php" method="post">
Username: <input type="text" name="username" size="20" /><br />
Password: <input type="password" name="password" size="20" /><br />
<input type="submit" name="submit" value="Login" />
</form>
<?php
}// End of SUBMIT IF.
?>

Thank you in advance!

Weedpacket

What is it doing instead? Have you done any debugging?

suomynonA

I'm not sure if I got it right, but are you using as salt for the crypt() function the same hash that you compare it against?

rockofaith

Hello, sorry the response took so long. I was otherwise occupied.

I'm just getting the error saying it doesn't recognize the username and password. Go ahead and register...then try your username and password and see it's not there. So I don't know why that is.

I don't know what that salt thing is that was mentioned.

Weedpacket

Well, I can see this test being made:

($line[1] == crypt ($_POST['password'], $line[1]) ) )

and I wonder how often that's going to be true. It has to be true, or $loggedin won't be set to true. It's anyone's guess what is supposed to be getting compared here, but I'm pretty sure that this doesn't do it.