Welcome Guest ( Log In | Register )



 
 Reply to this topicStart new topic
> Authentication Script, PHP Help #2 -- I need help tweaking it - it won't work
Rating 5 V
FirefoxRocks
post Feb 20 2007, 02:27 PM
Post #1


Super Member
Group Icon

Group: [HOSTED]
Posts: 658
Joined: 12-July 06
From: Ontario, Canada
Member No.: 14,464
Okay, my first issue about the MySQL echo problem has been solved, thank you to those who helped. smile.gif
Now I am focusing on the login portion of my site, and I have this so far:
CODE
<?php
// we must never forget to start the session
session_start();

$errorMessage = '';
if (isset($_POST['username']) && isset($_POST['password']))
    {
   $username = $_POST['username'];
   $password = $_POST['password'];
//Connect to database
$con = mysql_connect("localhost","myDatabaseUsername","myDatabasePassword");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }
mysql_select_db("myTable2", $con);
   // check if the user id and password combination exist in database
   $sql = "SELECT name FROM users WHERE name = '$username' AND password = PASSWORD('$password')";
   $result = mysql_query($sql) or die('Query failed. ' . mysql_error());
   if (mysql_num_rows($result) == 1)
     {
      // the user id and password match, check for authorization
            $sql_a = "SELECT auth FROM users WHERE auth = '$auth'";
            $result = mysql_query($sql_a)
             or die('Query failed. ' . mysql_error());
            if ($result == YES)
      // set the session
      $_SESSION['db_is_logged_in'] = true;
      // after login we move to the main page
            header("(anti-spam-content-type:) $mime;charset=$charset");
      header('Location: moderate.php');
      exit;
   }
     else
     {
     $errorMessage = 'Sorry, wrong user id / password';
     header("(anti-spam-content-type:) $mime;charset=$charset");
     }
    }
?>


I cannot figure out what is wrong with this! I tried moving parts around, removing parts, didn't work. It is on XKingdom Moderator Login. I have made an example account user Trap17 password 123 for testing purposes to help if necessary. Feel free to mess around with my code, I'm not very good at PHP. tongue.gif
Go to the top of the page
 
+Quote Post
faulty.lee
post Feb 20 2007, 05:57 PM
Post #2


Premium Member
Group Icon

Group: [HOSTED]
Posts: 478
Joined: 5-November 06
Member No.: 17,016
One of the most important thing to learn in programming is to "Troubleshoot". So you need to first troubleshoot where is your problem. This is where debugging comes in. Simplest way to debug in php is "echo" or "print".

I've tried your link, the the authentication failed. So, you should find out why it fail.
CODE
else
     {
         //Add echo here
     $errorMessage = 'Sorry, wrong user id / password';
     header("(anti-spam-(anti-spam-content-type:)) $mime;charset=$charset");
     }

You should maybe try to echo the number of rows, since you're checking the number of rows to determine the first step of authentication. Maybe it's returning 2 instead of 1. Maybe you have 2 identical record with the same username and password. To prevent identical username, you can either enable "unique" on the username column or do a check before you insert any new username. The later one is preferable, simply because you want to allow deleted/terminated username to be reuse.

On the second check
CODE
$sql_a = "SELECT auth FROM users WHERE auth = '$auth'";

i don't see the var $auth being initialized. What value should it contain?

That should get you started. But before you go futher, i have a few personal tips, might not be the most appropriate one, but should help you in your case.

1. For you second check, $auth, you should do it in 1 query.
CODE
//before
   $sql = "SELECT name FROM users WHERE name = '$username' AND password = PASSWORD('$password')";
  //after
   $sql = "SELECT name FROM users WHERE name = '$username' AND password = PASSWORD('$password') AND auth = '$auth'";

You can do this, since auth is compulsory. Or you can also retrive the value of auth from the db, then compare later.
CODE
//before
   $sql = "SELECT name FROM users WHERE name = '$username' AND password = PASSWORD('$password')";
  //after
   $sql = "SELECT name, auth FROM users WHERE name = '$username' AND password = PASSWORD('$password')";
   $result = mysql_query($sql) or die('Query failed. ' . mysql_error());
   if (mysql_num_rows($result) == 1)
   {
        $row_result = mysql_fetch_array($result)
        if ($row_result['auth'] == $auth)
        {
            //success
        }


Good luck
Go to the top of the page
 
+Quote Post
« Next Oldest · PHP · Next Newest »
 

Reply to this topicStart new topic

Collapse

> Similar Topics

Topics Topics
  1. Trainable Anti-spam Filter Script(3)
  2. Php Script To Download File From Another Site(9)
  3. Need Help With A PHP - MySQL Registration Script(13)
  4. What Would Make A Good Registration Script?(4)
  5. User Authentication Session Handling Problems(14)
  6. Auto Responder Script(6)
  7. Blog Script?(5)
  8. Installed A PR Checker Script - But Not Working Correctly(6)
  9. How To Delete File Using PHP Shell Script(3)
  10. Online Multiplayer Chess Script(2)
  11. Automated File Structure Creation Script(3)
  12. Login Script(5)
  13. Please Help (php Join Script)(5)
  14. Automatic/remote Php Script Execution(9)
  15. Something Wrong With This Script?(9)
  1. Automated Product Suggestion Script(2)
  2. Run A Script When Expires A Session(6)
  3. Php Script Help(1)
  4. SQL Doesn't Connect In PHP Script(19)
  5. Warning: Mysql_result(): Supplied Argument Is Not A Valid Mysql Result Resource In ...(4)
  6. Password Recovery Script(6)
  7. Login Script(8)
  8. Free Forum Hosting Type Script Help!(2)
  9. Script Request(2)
  10. Writing And Testing My Own Login Script [solved](20)
  11. Make A Script Run Even If No User Is Online(6)
  12. Php Login Script(0)
  13. Myspacetv Download Php Script Help(6)


 

Display Mode: Standard · Switch to: Linear+ · Switch to: Outline

Track this topic · Email this topic · Print this topic · Subscribe to this forum

- Lo-Fi Version Time is now: 7th September 2008 - 02:12 AM
Powered By IP.Board 2.2.1 © 2008  IPS, Inc.
Licensed to: Xisto Corporation