Parse error hrmmm..

[crawfd]

Getting the following error with the script below. Not sure what it is though .....

Parse error: syntax error, unexpected T_LNUMBER in cookie.php on line 48

<?

$cookie_name = 'punbb_cookie';
$cookie_domain = '';
$cookie_path = '/';
$cookie_secure = 0;
$cookie_seed = '68f9d001';


$form_username = trim($_POST['NewUsername']);
$form_password = trim($_POST['p1']);

$q8 = "select id, username, group_id, password, save_pass from punbb_users WHERE username=".$form_username."";
$r8 = mysql_query($q8) or die(mysql_error());

list($user_id, $group_id, $db_password_hash, $save_pass) = mysql_fetch_row($r8);

$authorized = false;

if (!empty($db_password_hash))
{
	$sha1_in_db = (strlen($db_password_hash) == 40) ? true : false;
	$sha1_available = (function_exists('sha1') || function_exists('mhash')) ? true : false;

	$form_password_hash = hash($form_password);	// This could result in either an SHA-1 or an MD5 hash (depends on $sha1_available)

	if ($sha1_in_db && $sha1_available && $db_password_hash == $form_password_hash)
		$authorized = true;
	else if (!$sha1_in_db && $db_password_hash == md5($form_password))
	{
		$authorized = true;

		if ($sha1_available)	

		// There's an MD5 hash in the database, but SHA1 hashing is available, so we update the DB
		$q1 = "UPDATE punbb_users set password=".$form_password_hash." WHERE id=".$user_id."";
		mysql_query($q1);

	}
}

if (!$authorized)
echo "not authorized";

// Update the status if this is the first time the user logged in
if ($group_id == PUN_UNVERIFIED)

$q1 = "UPDATE punbb_users set group_id = "4" WHERE id=".$user_id."";
mysql_query($q1);

// Remove this users guest entry from the online list
$q2 = "UPDATE punbb_online WHERE ident=".get_remote_address()."";
mysql_query($q2);

$expire = ($save_pass == '1') ? time() + 31536000 : 0;
setcookie($user_id, $form_password_hash, $expire);



?>

[bradgrafelman]

1. You should never use the <? tags - these have been deprecated for some time now; use the full <?php tag.

2. Look at the syntax coloring on the line that the error message refers to. Notice something awry? Watch your quotes inside of strings!

3. It looks like your script is vulnerable to MySQL injection attacks. You should always escape user-supplied data with a function such as [man]mysql_real_escape_string/man before using it in a query!

[halojoy]

bradgrafelman wrote:

Watch your quotes inside of strings!

$q1 = "UPDATE punbb_users set group_id = "4" WHERE id=".$user_id."";

$q1 = "UPDATE punbb_users set group_id = '4' WHERE id='.$user_id.'";

double quotes inside string can be replace with single quotes