PHP Help

mnceo

I am sorry for duplicating this in multiple catagories, but i am not sure which one is a good catagory to put this in

I have my own web server on this pc (windows xp home edition and works fine).. i'm working on transfering it to a different pc, but until i get that.. i'm doing all my stuff on here..

I am running the Latest Version of Apache, PHP5, MySQL5 and the latest version of phpMyAdmin.

I'm currently in the process in building a simple login system for my site but secure using sessions and when i created it.. it got the data from the database but when i typed the user info correctly and clicked Login.. It said Wrong Password.

my login.php page is just like any other login page.. it asks for a id and password then transfers the data from the form to process-login.php

This is the Script i have for the process-login.php page

<?php
if (empty($password)) { die("No Password specified");}
if ((strlen($password) < 5) || (strlen($password) > 20)) { die("Password too long/short");}
include("include/header.php");

$query="SELECT id,password FROM pilot WHERE id='$id'";
$pilot=mysql_query($query) or die("Could not execute Query");
$row=mysql_fetch_row($pilot);
if(!(md5($password) == $row['password'])) {
die ("Wrong Password");
} else {
die("User does not exist");
}
?>
Welcome <?php echo $id; ?>
<?php
include("include/footer.php");
?>

someone asked me how i get my $id and $password. simple, <input type="text" name="id"> and <input type="password" name="password">

Please help, i dont know what i did wrong if anything. I still have to add the session code but in the mean time.. i need this to work then i'll add the session_start commands.

In the shortest term

this script works but when i type in the correct id and password, it says Wrong Password. if replace die with echo, it allow the person to the private page and says wrong password also.

Please help.. i've been trying to figure this out for hours. I do not want to download a tutorial or anything. I am trying this on my own and need advice/tips or help as you will. Even though i learned how to do this out of a book, now i'm trying this for my actual site.

mjax

Are you sure that the passwords in your database als also MD5()-ed?

Also, are you use the SELECT query has returned a row?

Piranha

To solve problems it's often a good idea to echo the things that get you into trouble. In this case I would do something like this to see if it is the same:

if(!(md5($password) == $row['password'])) {
echo md5($password) . "<br />" . $row['password'];
die ("Wrong Password");
}

There is another thing that will mess the code up, I think it is worth mention at once:

if(!(md5($password) == $row['password'])) {
die ("Wrong Password");
} else {
die("User does not exist");
}

It basically says that if the passwords match then the user does not exist. I'm sure that you can solve it without any big problem, if not post back and I'll help you out with this one.

I also think you should look at mysql_real_escape_string() to make sure that people don't have the possibility to get a backway into your site.

mnceo

thank you, I will post back if i run into any more trouble with the script.

mnceo

ok, I came down to a conclusion, i need a new web server software. i currently use appServ, i might go back to netServ or Xamp. I tried doing the script this way.

<?php
if (empty($password)) { die("No Password specified");}
if ((strlen($password) < 5) || (strlen($password) > 20)) { die("Password too long/short");}
include("include/header.php");

if (isset($_POST['submit'])) {

if (empty($_POST['id'])) {
$id=FALSE;
echo '<p><font color="red">You forgot to enter your ID</font></p>';
} else {
$id=escape_data($_POST['id']);
}

if (empty($_POST['password'])) {
$password=FALSE;
echo '<p><font color="red">You forgot to enter your Password</font></p>';
} else {
$password=escape_data($_POST['password']);
}

if ($id && $password) {

$query="SELECT id, password FROM pilot WHERE id='$id' AND password=PASSWORD('$p')";
$pilot=mysql_query($query);
$row=mysql_fetch_array($pilot, MYSQL_ASSOC);

if ($row) { // A Match was made

// Start the session
$_SESSION['id'] = $row['id'];
$_SESSION['password'] = $row['password'];

ob_end_clean(); // Delete the Buffer

} else { // No Match was made

echo '<p><font color="red">The username and password entered do not match those recorded into the database</font></p>';
}
mysql_close();
} else {
echo '<p><font color="red">Please Try Again</font>';
}
}
?>
Welcome <?php echo $id; ?>
<?php
include("include/footer.php");
?>

everything works, but then the escape_data() function dont work.. that tells me i need a new server that has apache 2.0.59, php4, mysql4, instead of the 5 version for php/mysql.

Plasma

I assume your escape_data function (which is not a native PHP function!) is supposed to prepare the data for use in an SQL query.

You should use mysql_real_escape_string() for this sort of thing.

Additionally, you could cast the value to an integer:
$id = (int) $_GET['id'];

mnceo

Thank you for your guys help