[RESOLVED] Help with a user authentication system

Durendal

Hey, ive been trying to get my user authentication system working but for some reason it just wont work. i tinkered with it for a while and it began allowing anyone to sign in with any username and password(even random jibberish) so i tinkered some more and now nothing will sign in properly. the code im using is from O'Reillys Learning PHP 5 I've edited it a bit because i cant get my PEAR repositories to work. If anyone can spot any errors in it please let me know, the connection to the MySQL database is contained in the file db.php and i know thats not the problem because i use the same connection on other pages that are functioning 100%

<?php 
session_start();
require 'formhelpers.php';


if ($_POST['_submit_check']) {
	if ($form_errors = validate_form()) {
		show_form($form_errors);
	} else {
		process_form();
	}
} else{
	show_form();
}

function show_form($errors = ''){
               print '<form method="POST" action="'.$_SERVER['PHP_SELF'].'">';
               print 'Username: '
    .'<input name="user" type="text" size="25" maxlength="25" />';
	print '<br>';
	print 'Password: ';
	print '<input name="pass" type="password" size="25" maxlength="25" />';
	print '<br>';
	input_submit('submit','Log In');
	print '<input type="hidden" name="_submit_check" value ="1">';
	print '</form>';
		if ($errors){
		print '<ul><li>';
		print implode('</li><li>',$errors);
		print '</li></ul>';
	}

}

function validate_form() {	
	$errors = array();
	include('db.php');
	$username = $_POST['user'];
	$result = "SELECT password FROM users WHERE username = '$username';" or die(mysql_error()); 
	$password = mysql_query($result);						   

	if ($password != $_POST['pass']) {
		$errors[] = 'Please enter a valid username and password.';
		}
	return $errors;
}
function process_form() {
	$_SESSION['username'] = $_POST['user'];
                print "Welcome $_SESSION[username]<br>";
	print "Click <a href='logout.php'>Here</a> To Log Out";
}
?>

thanks for your time.

Regards,
Durendal

YAOMK

Please edit your post and enclose your code using the appropriate php vB code. Thank you.

Quadodo

No error is output I take it? It just won't do what it's supposed to? If there is an error please post it 😮

Durendal

it would appear to be a logical error, i use the username and password i have stored in the database and it just says invalid username or password. theres no syntax errors though

YAOMK

EDIT: double post, see below.

YAOMK

This is a minor syntax error:

$result = "SELECT password FROM users WHERE username = '$username';"

delete the semicolon at the end of the query, it is not needed.

Quadodo

Actually the error I see now is this:

    $result = "SELECT password FROM users WHERE username = '$username';" or die(mysql_error());
    $password = mysql_query($result);

Should be:

    $result = "SELECT password FROM users WHERE username = '$username'";
    $password = mysql_query($result) or die(mysql_error()); 
    $password = mysql_fetch_row($password);
    $password = $password[0];

Also:

 print "Welcome $_SESSION[username]<br>";

Should be:

 print "Welcome {$_SESSION['username']}<br>";

bradgrafelman

YAOMK wrote:
This is a minor syntax error:

I disagree - that's not an error at all. Sure, it's superfluous, but it's definitely not an error.

The real error is that [man]mysql_query/man doesn't return data from MySQL - it returns a resource. What you need to do is actually retrieve the password and compare it, such as by using [man]mysql_result/man.

Note however that storing passwords in a DB in an unencrypted fashion is not very secure. Considering using a hashing algorithm such as SHA1 to secure them.

Durendal

thanks guys it works great now 😃 i really appreciate it.

Regards,
Durendal

Horizon88

Don't forget to mark this resolved using the Thread Tools menu. 😉