Page 1 of 1

User login page not redirecting..

Posted: Mon Jan 21, 2013 4:44 am
by greatme
I am developing a simple application whereby users will need to log in before having access to the pages. At the point of testing my scripts on live server i discover that the login page is not redirecting to the specified page after successful login. meanwhile it worked perfectly on my local server (WAMP). Please what do i need to do. here is my script.

Code: Select all

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>WTListing- Login</title>
</head>

<?php require_once( 'header.php' ); 
error_reporting(E_ALL - (E_NOTICE + E_WARNING));
include('conection/gen_conn.php' );
include('includes/signup_failure.php' );
?><P><br />
<table width="450" border="&frac12;" frame="box" rules="none" align="center" bgcolor="#E9E9E9" bordercolor="#666666">
	<tr>
		<td align="center">
				<?php 
				 //Checks if there is a login cookie
				 if(isset($_COOKIE['ID_my_site']))
				 
				 //if there is, it logs you in and directes you to the members page
				 { 
					$username = $_COOKIE['ID_my_site']; 
					$pass = $_COOKIE['Key_my_site'];
					$check = mysql_query("SELECT * FROM wtl_reg_posters WHERE username = '$username'")
					or die(mysql_error());
					while($info = mysql_fetch_array( $check )) 	
						{
						if ($pass != $info['password']) 
							{
				
										}
				
						}
				 }
				
				 //if the login form is submitted 
				 if (isset($_POST['submit'])) { // if form has been submitted
				
				 // makes sure they filled it in
					if(!$_POST['username'] | !$_POST['pass']) {
						header('Location: login.php');
					}
				
					// checks it against the database
					if (!get_magic_quotes_gpc()) {
						$_POST['email'] = addslashes($_POST['email']);
					}
					$check = mysql_query("SELECT username, password FROM wtl_reg_posters WHERE username = '".trim($_POST['username'])."'")or die(mysql_error());
				
				 //Gives error if user dosen't exist
				 $check2 = mysql_num_rows($check);
				 if ($check2 == 0) {
						die($failure_username_notexist);
				  }
				 while($info = mysql_fetch_array( $check ))  {
				 	$password = md5($_POST['pass']);
				 	$password = stripslashes($password);
					$info['password'] = stripslashes($info['password']);
					$password_md5= substr($password, 0, 15);
				
				 //gives error if the password is wrong
					if ($password_md5 != $info['password']) {
						die($failure_password_nomatch);
						
					} else { 
							// if login is ok then we add a cookie 
					 		$_POST['username'] = stripslashes($_POST['username']); 
							$hour = time() + 3600; 
				 			setcookie(ID_my_site, $_POST['username'], $hour); 
				 			setcookie(Key_my_site, $_POST['pass'], $hour);	 
							//then redirect them to the members area 
							header("Location: add_posting.php"); 
							 } 
			     }// End of while loop 
				
			}//eEnd of if for form submission 
				 else {	 
						// if they are not logged in 
				      ?>
				  <form action="<?php echo $_SERVER['PHP_SELF']?>" method="post"> <br /><br />
				  <table border="&frac12;" bgcolor="#E9E9E9" class="selectfirst" frame="void" rules="none"> 
					 <tr>
					 	<td><font color="#006699">Username:</font></td>
						<td><input type="text" name="username" maxlength="40" class="inputreg"></td>
					 </tr> 
					 <tr>
						<td><font color="#006699">Password:</font></td>
					    <td><input type="password" name="pass" maxlength="50" class="inputreg"> 
						</td>
					</tr> 
					 <tr>
						 <td align="left"><br /><input type="submit" name="submit" value="Login" class="selectfirst"></td>
						 <td align="right"><br /><strong>
						 	<font face="Vani" color="#993300" size="2">Don't have an account?</font> <a href="signup.php">Signup Now</a></strong>
						 </td>
					</tr>
				 </table> 
				 </form><div align="left">
				 <h3>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
				 <a href="password_reset.php">Forgot your Passoword?</a><br />
				 &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
				 <a href="user_reset.php">Forgot your Username?</a></h3></div>
				 <?php 
				 } 
				
				 ?> 
			</td>
		</tr>
</table></P><br />
<?php
include('footer.php');
?>
</html>

Re: User login page not redirecting..

Posted: Mon Jan 21, 2013 6:18 am
by twinedev
My best guess would be that your WAMP server was set to auto-buffer the output (output is not sent to browser until script ends or is specified), therefore the headers being sent work just fine, however on the live server (as with most hosting configurations) output is sent unbuffered (sent to browser as it is given), thus you are getting an error as such, however you are telling it not to show you that.

A good rule in setting up scripts if you are not using a MVC style framework, is to have all logic preformed before any output. Then when you do start outputting the page, the only PHP code in it should be simple echos of variables, loops through data to display, and simple logic checks (ie. <? echo ($bLoggedIn) ? "Hello $name" : "Login"; ?> ) This way there is no chance of accidentally sending any output before the need to send a header.

There are also other issues to consider in your code:

1. You are storing the raw password in a cookie, which is a security risk as you are giving more chances for someone to grab the username/password since it is sent on every request (vs. just the login and/or password reset page). Also, that means the username password is set and saved for an hour on the users browser. If they are using a public computer, the next person could steal it.

2. In general the password should be hashed in the database, too many people out there use the same password on multiple systems, and sadly also the same for the e-mail account they use to register for sites. MD5 is outdated, look at SHA256 with both Salt and Pepper (check under the "Security" section of this site for goo discussion on this)

3. You are directly using information from a cookie in a query, which fully opens you up to a SQL Injection. Remember, all of $_POST, $_GET, $_REQUEST, $_COOKIE, and some of $_SERVER can be set by the visitor of the site, and thus should never be trusted to use without validating values and/or protecting it:
-Database calls: Use PDO or if using mysql_ functions, wrap it with mysql_real_escape_string($var);
-Display on page: wrap it with htmlspecialchars($var,ENT_QUOTES);
-Using in a SRC or HREF value, wrap it with urlencode($var);

The big change you should make though is to keep all primary logic before any output. This also makes the code with the output way more readable.

-Greg