Help upgrading to PHP5

Glynn

I need help upgrading this code to php5 but can't work out how to do it please help.

<?php
include "./dbinc.php";

$logonsuccess = 1;
$Message = "";

if (! $email) {
$message = "You must enter an email address";
$logonsuccess = 0;
}

if (! $passwd) {
$message = $message . "You must enter a password";
$logonsuccess = 0;
}

$result = mysql_query("SELECT email,passwd from mx_users where
email =
'$email' and passwd = password('$passwd')",$connection);

if (!$result) {
$logonsuccess = 0;
$message = $message . "Error checking user database";
} else {
$rowcount = mysql_num_rows($result);
}

if ($rowcount <> 1) {
$logonsuccess = 0;
echo $message;
}

if ($logonsuccess) {
session_unset();
session_register("authemail");
$authemail = $email;
echo "Logon successful<a href=\"members-page.php\">Click here to continue</a>";
}
else {
echo "Logon failed<a href=\"login.php\">Click here to try
again</a>";
}
ob_end_flush();
?>
</body>
</html>

sneakyimp

What problem are you having?

Glynn

The problem is it won't let me login since being upgraded to php5 and my hosting company say it is this file that is at fault. They say It's register_gloabals related issues

sneakyimp

Strictly speaking, this is not a PHP 5 issue because register_globals can be turned on in PHP 5. It is completely removed in PHP 6.

register_globals is a setting in PHP that, if on, causes PHP to define all variables POSTed or GETed to a script is global variables. In other words, if I submit a form to some php script and that form has method=POST and my form contains an input with name=my_var then PHP will define $my_var as a global variable in my script. This is really insecure because it means malicious programmers can define any variable they like in your script.

If you can live with that, then you could use this code as a register_globals simulator:

foreach($_REQUEST as $key => $value) {
  $$key = $value;
}

put that at the top of your script.

If you are worried about the security risk (and you should be) then you need to change all those variable names which come from your form from $email to $REQUEST['email'] and from $passwd to $REQUEST['passwd']

Glynn

That fake register globals does not work I thought it did but it says that login is successful and then when you click on a link it asks you to login again.
I would like to do it properly. I had a play around with the code as you advised but can't seem to get it right could you show me so that I can lean how to do this, as I am missing something.

sneakyimp

If you click a link, you are going to another page. I fixed the script you sent me, you are going to have to fix the others too.

You need to understand what register_globals means. Try reading up on it.

If you don't want to edit each and every page on your site, you might ask your sysadmin or hosting provider if you can turn on register_globals. They might let you do it with an htaccess file.

Glynn

The page works fine if I take the login out so it is not a fault of the rest of the pages.
My host will not turn register globals on so until I can fix the code i am stuck.
Since I have just started to learn PHP I just don't understand what you mean and
if I edit the code like this.

<?php
ob_start();
?>
<html><title>Logon result</title>
<body>
<?php
include "./dbinc.php";

$logonsuccess = 1;
$Message = "";

if (! $_REQUEST['email']) {
$message = "<p>You must enter an email address</p>";
$logonsuccess = 0;
} 

if (! $_REQUEST['passwd']) {
$message = $message . "<p>You must enter a password</p>";
$logonsuccess = 0;
}

$result = mysql_query("SELECT email,passwd from mx_users where 
email = 
'$email' and passwd = password('$passwd')",$connection);

if (!$result) {
$logonsuccess = 0;
$message = $message . "<p>Error checking user database</p>";
} else {
$rowcount = mysql_num_rows($result);
}

if ($rowcount <> 1) {
$logonsuccess = 0;
echo $message;
}

if ($logonsuccess) {
session_unset();
session_register("authemail");
$authemail = $email;
echo "<p>Logon successful</p><p><a href=\"members-page.php\">Click here to continue</a></p>";
}
else {
echo "<p>Logon failed</p><p><a href=\"login.php\">Click here to try 
again</a></p>";
}
ob_end_flush();
?>
</body>
</html>

But it won't let me login. I'm tired now as I have spent 8 hours on this and it is 2 am in the UK so I am going to bed. Perhaps someone will be kind enough to help and fix the script?

HalfaBee

Just add these lines after the include()

$email = mysql_real_escape_string( $REQUEST['email'] );
$passwd = mysql_real_escape_string( $REQUEST['passwd'] );

Glynn

I have tried that but get this error.

Parse error: syntax error, unexpected ';' in /var/www/html/centre10/auth.php on line 8

HalfaBee

Sorry, I forgot the closing ).