whats wrong?

[Anon]

whats wrong in my script?
<?php
If($login =="ja"){
if(file_exists("login/members/$gebruikersnaam.php")){include("login/members/$gebruikersnaam.php");}
if($wachtwoord == "$Password"){
// Het geheime woord
$secretword = "eengoedgeheimwoord";

// Oke eerst maar eens de hash maken, en de cookies zetten.

$hash = md5($gebruikersnaam.$wachtwoord.$secretword);

Setcookie("username", $gebruikersnaam, Time()+3600);
Setcookie("userpass", $wachtwoord, Time()+3600);
Setcookie("userhash", $hash, Time()+3600);
echo"alles ging goe";
}
}
else{
?>

<p><b>Login</b></p>

<p>Om in te loggen op uw account moet u hieronder uw
gebruikersnaam en wachtwoord invoeren</p>

<form method="POST">
<input type="hidden" name="login" value="ja"><table
border="0" cellpadding="0" cellspacing="0" width="400"
background="http://www.sanderklijn.nl/betaalmij/images/bg_lock2.gif" height="245">
<tr>
<td align="middle"
style="font-family: Verdana,Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 11px"><table
border="0" cellpadding="4" width="100%" height="216">
<tr>
<td align="middle" colspan="2"
style="font-family: Verdana,Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 11px"
height="32"><h1><font size="3"><b>Login
Interfase</b></font></h1>
</td>
</tr>
<tr>
<td align="middle" colspan="2"
style="font-family: Verdana,Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 11px"
height="13">&nbsp;</td>
</tr>
<tr>
<td valign="bottom"
style="font-family: Verdana,Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 11px"
height="118"><a
href="http://www.sanderklijn.nl/betaalmij/pages/home.asp"
target="hoofd8"><img
src="http://www.phpsecurepages.f2s.com/test/phpSecurePages/images/cancel.gif"
alt="Cancel" align="left" border="0"
hspace="10" vspace="4" width="22" height="23"></a>
</td>
<td align="right" valign="bottom"
style="font-family: Verdana,Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 11px"
height="118"><table border="0"
cellpadding="4" cellspacing="1" width="231">
<tr>
<td width="59"
style="font-family: Verdana,Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 11px"><font
size="2"
face="Arial,Helvetica,sans-serif"><b><font style="font-family: Verdana,Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 11px">
Login: </b></font><font size="2"><b></font></b></font></td>
<td width="153"
style="font-family: Verdana,Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 11px"><input
type="text" size="20"
name="gebruikersnaam"
style="font-family: Verdana,Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 11px"></td>
</tr>
<tr>
<td width="59"
style="font-family: Verdana,Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 11px"><font
size="2"
face="Arial,Helvetica,sans-serif"><b><font style="font-family: Verdana,Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 11px">
Password: </b></font><font size="2"><b></font></b></font></td>
<td width="153"
style="font-family: Verdana,Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 11px"><input
type="password" size="20"
name="wachtwoord"
style="font-family: Verdana,Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 11px"></td>
</tr>
</table>
<p><input type="image" name="submit"
src="http://www.phpsecurepages.f2s.com/test/phpSecurePages/images/enter.gif"
alt="Enter &gt;&gt;&gt;" align="bottom"
border="0" hspace="7" vspace="4" width="26"
height="23" tabindex="1"> </p>
</td>
</tr>
<tr>
<td valign="bottom" colspan="2"
style="font-family: Verdana,Arial; font-style: normal; font-variant: normal; font-weight: normal; font-size: 11px"
height="13"><p align="center"><span lang="en-us"><span style="font-size: 7pt"> ©2001
BetaalMij.com</span></span></p>
</td>
</tr>
</table>
</td>
</tr>
</table>
</form>
<?
}
?>

[[deleted]]

Uhm.. ya...

it would help if you at least give us a clue about your problem....

[toma42]

I know! I know!

if(file_exists("login/members/$gebruikersnaam.php")){include("login/members/$gebruikersnaam.php");}

This is a huge security hole, that's what's wrong!

[thomas2]

What is the security hole?
I am interesting in learning.

Another thing in the script is that setcookies must be placed in the header.

[toma42]

include ("login/members/$sadf.php");

ah, a bit less of one that I originally thought, my bad, but could be a problem. if $sadf = '../../admin/index';
the user may be able to learn about the system from any errors.

basicly, including a file based on a user submitted variable is a bad idea.