Secure Autentication

alabasta

Hi to all,
I am a new php user. I have a problem. I must create a system to secure autentication. I have read this article http://www.phpbuilder.com/columns/tim20000505.php3?page=3 but I have had much problem. 3 of them are:

Notice: Undefined variable: submit in C:\Programmi\EasyPHP 2.0b1\www\login.php on line 12

Notice: Undefined variable: feedback in C:\Programmi\EasyPHP 2.0b1\www\login.php on line 18

Notice: Undefined variable: PHP_SELF in C:\Programmi\EasyPHP 2.0b1\www\login.php on line 26

Please help me... I have done all that described.
Help me.

bretticus

"Notice: Undefined variable:" is not an error. Turn off notices.

If you really feel like you need to address the "problems", you can always set your variables first thing in your script Example...

//login.php
$submit = "";
$feedback = "";

Try using...

$_SERVER['PHP_SELF']

instead of PHP_SELF.

NogDog

bretticus wrote:
"Notice: Undefined variable:" is not an error. Turn off notices....

While you are correct that it is not an error and as such does not necessarily have any negative impact (other than display a notice), it does point to less than optimal coding practices and as such I would recommend fixing it rather than simply hiding it. By fixing such notices/warnings, you then increase the likelihood that you do not have any potential bugs due to misnamed variables and such. Since PHP does not require you to declare variables before using them, it is easy to accidentally try to reference a variable by the wrong name, potentially leading to difficult to debug problems. Fixing your code until there are no such notices removes many possible occurrences of such bugs.

I am therefore in favor of setting error_reporting to E_ALL | E_STRICT in your development environment and fixing all reported notices, though in the production server that's another question, where you then want to turn off display_errors and ensure all errors are being logged to a file, instead.

NogDog

PS: Upon re-reading, my first guess would be that script is depending upon the deprecated [man]register_globals[/man] behavior, which likely has been (correctly) turned off on this host. Therefore you probably need to refer to the applicable super-global array, depending upon the source of the data, e.g. $POST['submit']. (This would jibe with Bretticus's suggestion that you need to reference the $SERVER super-global for $_SERVER['PHP_SELF'].)