Hi all,

 

I am creating for myself a website (just a video listing website), and I have run into some problems.

 

What I am trying to acheive is a website with administrative and standard user access, where admins can add and remove video titles, and users can view the titles in the list. Right now, I am working on the login portion of the website.

 

The problem is, I have two user accounts, one admin and one user. When I enter the details for either one, it behaves as though I entered the wrong details (I will attach my HTML and PHP scripts so you can see). Entering incorrect or blank details (which should in fact generate the error message) goes to a blank page.

 

The coding seems fine from my point of view, but I need some more expert opinions with this. Thank you in advanced.

At the time I've read this, there is no code attachment available.

Hi all,

 

I am creating for myself a website (just a video listing website), and I have run into some problems.

 

What I am trying to acheive is a website with administrative and standard user access, where admins can add and remove video titles, and users can view the titles in the list. Right now, I am working on the login portion of the website.

 

The problem is, I have two user accounts, one admin and one user. When I enter the details for either one, it behaves as though I entered the wrong details (I will attach my HTML and PHP scripts so you can see). Entering incorrect or blank details (which should in fact generate the error message) goes to a blank page.

 

The coding seems fine from my point of view, but I need some more expert opinions with this. Thank you in advanced.

 

if the page goes blank it may be a PHP error try making sure error reporting is turned on

 

error_reporting(E_ALL);
ini_set('display_errors',1);

At the time I've read this, there is no code attachment available.

 

Ah. That was probably me. I got it here.

 

webdesigner93 - I'll check that out. That should be in the PHP.INI file, yes?

login.zip

Well, I managed to solve the problem with the login page (after some trial and error, but having the PHP errors show helped as well), which is now working perfectly (admin, user and non-existent).

 

My next issue is with user creation. I made a simple page for users to create an account, which apparently works, but it does not create the account in MySQL. I will attach the PHP and HTML scripts.

 

Thank you again for your help.

 

Update: Another problem which has arisen with the page is that it is proceeding like normal, even with blank fields. I tried changing things like the $go variable in my script to use boolean TRUE/FALSE values (which is what I used to fix my login page), but this did not work.

adduser.zip

Edited October 16, 201213 yr by techkid

MySQL injection - Google it and adjust your code accordingly. I'm sure wouldn't want to jump on your site one day to find is been hacked or the entire database has been deleted

 

Also, you should be really validating the data you want to insert. As this is an adduser you may want to think about:

• Username policy - length, uppercase, lowercase restraints, length etc. IF the site needs to be PCI compliant, you'll need specific patterns for user passwords for example.
  
• Username - you'll need to perform another MySQL query to check if the username is unique in your database - if it exsists, don;t create the user and display a message
  

Thanks for the info. I had few things to read up on and no mistake! Things are running much smoother. I'm not so concerned about PCI compliance, though.

 

In all honestly, I;d never try to write my own user system because it's mind numbingly boring and has been done to death. Why not download a decent user management class from phpclasses.org and start from there? At least the code will work and be secure.

 

I wanted to create my own code, mostly because I'm so out of practice. This is just a home project, I doubt I will create anything for live use anytime soon.

 

Needless to say, though, I got things up and running. I have set up a somewhat smart username and password policy (minimum 5 characters username, minimum 6 characters password, username primary key and outputs a MySQL error for duplicates entry attempts).

 

I'm going to call this done. Thanks for all the tips and info

When verifying the username and the password we received and then look up those in the database. Here is the code:

 

function Login()

{

if(empty($_POST['username']))

{

$this->HandleError("UserName is empty!");

return false;

}

if(empty($_POST['password']))

{

$this->HandleError("Password is empty!");

return false;

}

$username = trim($_POST['username']);

$password = trim($_POST['password']);

if(!$this->CheckLoginInDB($username,$password))

{

return false;

}

session_start();

$_SESSION[$this->GetLoginSessionVar()] = $username;

return true;

}

 

In order to identify a user as authorized, we are going to check the database for his combination of username/password, and if a correct combination was entered, we set a session variable.

 

Here is the code to look up the username and password.

function CheckLoginInDB($username,$password)

{

if(!$this->DBLogin())

{

$this->HandleError("Database login failed!");

return false;

}

$username = $this->SanitizeForSQL($username);

$pwdmd5 = md5($password);

$qry = "Select name, email from $this->tablename ".

" where username='$username' and password='$pwdmd5' ".

" and confirmcode='y'";

$result = mysql_query($qry,$this->connection);

if(!$result || mysql_num_rows($result) <= 0)

{

$this->HandleError("Error logging in. "."The username or password does not match");

return false;

}

return true;

}

 

Try this one...i used this code in my database project