Register

If this is your first visit, please click the Sign Up now button to begin the process of creating your account so you can begin posting on our forums! The Sign Up process will only take up about a minute of two of your time.

Results 1 to 7 of 7
  1. #1
    Member KillaTeddyX's Avatar
    Join Date
    Dec 2006
    Posts
    81
    Member #
    14455
    Hi I am currently working on a site and am trying to get the log in form to refrence to a mysql table where the data is stored but I can't seem to get it to work help would be appreciated.

    PHP Code:
    <?php
    require ("config.php");

    $link mysql_connect(SQL_HOSTSQL_USERSQL_PASS)
    or die (
    "Cannot connect: " mysql_error());

    mysql_select_db(SQL_DB);

    if (
    $_POST['user'] == "admin.admin_name" && $_POST['password'] == "admin.admin_pass")
    {
    echo 
    "Thanks for logging in Admin!";
    ?>
    <html>
    <head>
    <title>Admin Main Page</title>
    </head>
    <body>
    <p>What would you like to do?</p>
    <br />
    <table>
    <tr>
    <td><a href="">[EDIT]</a></td>
    <td><a href="">[DELETE]</a></td>
    <td><a href="">[ADD]</a></td>
    </tr>
    </table>
    <?php
    }
    else
    {
    echo 
    "Sorry you don't have the correct privilages to acess this page!";
    }
    ?>
    </body>
    </html>
    Whenever I use the data I stored in the admin table I keep reciveing the else message I guess there is something wrong with my syntax as if there wasn't it would work help please.

  2.  

  3. #2
    Senior Member Steax's Avatar
    Join Date
    Dec 2006
    Location
    Bandung, Indonesia
    Posts
    1,207
    Member #
    14572
    Huh? I don't understand your mechanism here. Firstly, why are details for logging in saved in a POST header? That's very, very, bad. Use a session instead. Second, where's the query to get the information off the database? It should be something like

    PHP Code:
    $loginname "blah";
    $pass "password";
    $query mysql_query("SELECT * FROM `admins` WHERE `name`='$loginname'");
    if(
    mysql_num_rows($query) == 0){
      
    // Someone tried logging in as admin without a proper name!
    }else{
      
    // Someone has attempted a login with a proper name.
      // Check password here.
      
    if(mysql_result($query,0,"password") == $pass){
         
    // Correct password!
         
    SESSION['logged_in'] = true;
         
    SESSION['name'] = $loginname;
      }else{
         
    // Someone tried logging in but incorrect password!
      
    }

    This should only be done in one page (the login page) - elsewhere you can now use the SESSION['logged_in'] variable to check if you're logged in. Oh, and it's probably safer not to keep the actual password. It's safer to keep an encrypted version (like one that's MD5-ed) on the database, and compare that to an encrypted version of the given password.
    Note on code: If I give code, please note that it is simply sample code to demonstrate an effect. It is not meant to be used as-is; that is the programmer's job. I am not responsible to give you support or be held liable for anything that happens when using my code.

  4. #3
    Member KillaTeddyX's Avatar
    Join Date
    Dec 2006
    Posts
    81
    Member #
    14455
    Thanks for the help I am still new to php and mysql thats probably why I tried the POST header way as I have used this method to test passing information between 2 pages before but thanks again I will use the session method. Also can you check your code again as I am getting this message
    Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in C:\Program Files\xampp\htdocs\samp\Admin\login.php on line 10

  5. #4
    Senior Member filburt1's Avatar
    Join Date
    Jul 2002
    Location
    Maryland, US
    Posts
    11,774
    Member #
    3
    Liked
    21 times
    PHP Code:
    $query mysql_query("SELECT * FROM `admins` WHERE `name`='$loginname'"); 
    SQL injection vulnerability. Log in as "'; DROP TABLE admins --" to have a hacker blow away your user table.
    filburt1, Web Design Forums.net founder
    Site of the Month contest: submit your site or vote for the winner!

  6. #5
    Member KillaTeddyX's Avatar
    Join Date
    Dec 2006
    Posts
    81
    Member #
    14455
    filburt1 I am confused are you saying that the information that Steax supplied is wrong? If so I think that I probably didn't explain myself enough. I want to store the admin username and password in a mysql table and then use that table to check with what the user inputs in the login page to check if they are indeed the admin. I want to use this as I believe it would improve secruity instead of having that information(Username/Password) on the actually page
    I know you are going to say use encryption but I don't know how you do this yet as the "sites" I am doing are for testing my own theories out and want to get used to the correct way to do things before I do them for someone else.
    If anyone could help beyond the advice Steax has supplied please help me thanks.

  7. #6
    Senior Member filburt1's Avatar
    Join Date
    Jul 2002
    Location
    Maryland, US
    Posts
    11,774
    Member #
    3
    Liked
    21 times
    I'm saying the code that was provided has a security vulnerability that lets anybody run arbitrary SQL queries.

    http://en.wikipedia.org/wiki/SQL_Injection
    filburt1, Web Design Forums.net founder
    Site of the Month contest: submit your site or vote for the winner!

  8. #7
    Senior Member Steax's Avatar
    Join Date
    Dec 2006
    Location
    Bandung, Indonesia
    Posts
    1,207
    Member #
    14572
    Yes I am aware of that, sorry. I was kind of in a rush. Usually for security, I grab the entire array of the table entries and check for the username in question tn that array. I find it most secure to keep out as many user-inputted variables from queries when possible. Otherwise, use addslashes().

    Ok now that aside, I think that method of using mysql_num_rows is correct - I'm checking it as I type, I'll tell you if I find any incorrections.

    What filburt was saying is that someone could pass that string as the loginname, and when the variables come together it says

    PHP Code:
    "SELECT * FROM `admins` WHERE `name`=''; DROP TABLE admins --'" 
    Which means two things: Get the admin table entries where name equals an empty string, and also Drops (erases) the table entirely. Bad, eh?

    Btw, don't use POST to pass things between pages. It's very possible that someone can modify that, or even read it. Using sessions it's still possible for hijacking, but it's more complex that way. Users never know what session variables he has, and has no control over them.

    Edit: I can't find anything wrong with the mysql_num_rows above. Here is the example in the PHP manual:
    PHP Code:
    <?php

    $link 
    mysql_connect("localhost""mysql_user""mysql_password");
    mysql_select_db("database"$link);

    $result mysql_query("SELECT * FROM table1"$link);
    $num_rows mysql_num_rows($result);

    echo 
    "$num_rows Rows\n";

    ?>
    Note on code: If I give code, please note that it is simply sample code to demonstrate an effect. It is not meant to be used as-is; that is the programmer's job. I am not responsible to give you support or be held liable for anything that happens when using my code.


Remove Ads

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
All times are GMT -6. The time now is 12:20 AM.
Powered by vBulletin® Version 4.2.3
Copyright © 2019 vBulletin Solutions, Inc. All rights reserved.
vBulletin Skin By: PurevB.com