Re: [PHP] Password Protection] -- My solution

[Christophe Chisogne]

Mailit, LLC a écrit :
   $userName = $_POST[userName];
   $passw= $_POST[passw]; 
(...)
   $cmd = SELECT * FROM theTable 
   .  WHERE userName='$userName' ;
   $res = mysql_query( $cmd ) or die( Password search failed. );
Without validating userName in $_POST, that code is vulnerable
to SQL injection, by example if userName starts by a single quote...
See the PHP Security Guide on 'SQL Injection'
http://phpsec.org/projects/guide/3.html#3.2
   $passe = crypt( $passw, $rec[ePass] );
   if( $passe == $rec[ePass] ) 
I seems that the above vulnerability cant be exploited,
but I think it's better to be aware of it.
Christophe
--
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP] Password Protection] -- My solution

[Mailit, LLC]

---BeginMessage---
Here is the setup that I have used.
Please, adapt to your needs.
Table 'theTable' is supposed to contain columns fname, mname, lname
and ePass (encrypted password). The crypt() function produces a password 
that
cannot be decrypted and really works well.
Of course, you need to use crypt() in the PHP script that creates a row in
'theTable'.

?php
#-- code starts here 
-#
$action = $_POST[action];
if( !empty( $action ) )
{
   $userName = $_POST[userName];
   $passw= $_POST[passw];

   # Bring the encrypted password and creation date from database:
   $cmd = SELECT * FROM theTable 
   .  WHERE userName='$userName' ;
   $res = mysql_query( $cmd ) or die( Password search failed. );
   $numRows = mysql_num_rows( $res );
   if( $numRows == 0 )
   {
   print( $userName not a valid user name.BR );
   exit;
   }
   $rec = mysql_fetch_array( $res );
   $privLevel = $rec[level];
   $nome = $rec[fname]. .$rec[mname]. .$rec[lname];
   # Encrypt the password:
   $passe = crypt( $passw, $rec[ePass] );
   if( $passe == $rec[ePass] )
   {
 /* Bring up the home page */
 print( h2WELCOME TO MY HOME PAGE/h2 );
   exit;
   }
   else
   {
   $retry = 1;
   }
}
   if( $retry )
   print(brh3Incorrect Login - Please, try again./h3br);
   ?
   FORM ACTION=? print( $_SERVER[PHP_SELF] ); ? METHOD=POST 
   INPUT TYPE=hidden NAME=action VALUE=login
   table align=center
   tr
   td
   BUser Name :/B
   /tdtd
   INPUT TYPE=text NAME=userName SIZE=20
   /td
   /trtr
   td
   BPassword :/B
   /tdtd
   INPUT TYPE=password NAME=passw SIZE=20
  /td
   /tr
   /table
   br
   P align=center
   INPUT TYPE=submit VALUE=Login STYLE=width:120;height:25
   /P
   /FORM
!-- - code ends here 
 --
Mario


Kevin Javia wrote:
I am experimenting on my site and I want to make it password protected like
www.realsolution.com.
If any one enters correct user name and password, only then they will be
able to enter into my site.
How can I do that in PHP?
Any ideas? Thanks a ton in advance.
 



---End Message---
-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php