Page 1 of 1

Logging in doesn't work???

Posted: Mon Oct 16, 2006 4:15 pm
by cturner
After logging in the username displays 1 and not the real username. Can someone please tell me why and how I can fix it? Thanks in advance.

Here is the code for the login page:

Code: Select all

require "config2.php";
$arrErrors = array();
// login button has been pressed
if (isset($_POST['login'])) {
$username = mysql_real_escape_string($_POST['username']);
$password = md5(mysql_real_escape_string($_POST['password']));
if ($username == '') {
	$arrErrors['username'] = 'Please enter your username.';
}
if ($password == '') {
	$arrErrors['password'] = 'Please enter your password.';
}
$login_check = "SELECT * FROM users WHERE username= '$username'" or die ("Could not select database because: " . mysql_error());

$login_query = mysql_query ( $login_check ) or die ( 'Query failed because: ' . mysql_error () );

$login_result = mysql_result ( $login_query, 0, 0 );

if ($login_result == 1) {
	setcookie ("username", $login_result[username]);
	setcookie ("password", $login_result[password]);
	header('Location: add_a_comment.php');
	exit;	
} else {
	echo "<center>Sorry, you don't know who you are!</center>";
}
}
mysql_close();
and here is the code for the page after loggin in:

Code: Select all

session_start();
if (isset($_COOKIE['username']) && ($_COOKIE['password'])) {
	print "You are logged in as: ".$_COOKIE['username'];
	print "<a href=logout.php>Logout</a>";
} else {
	print "You are not logged in. Please <a href=login.php>click here</a> to login.";
}

Posted: Tue Oct 17, 2006 1:16 am
by is_null
Please try this code :

Code: Select all

require "config2.php";
$arrErrors = array();
// login button has been pressed
if (isset($_POST['login'])) {
$username = mysql_real_escape_string($_POST['username']);
$password = md5(mysql_real_escape_string($_POST['password']));
if ($username == '') {
        $arrErrors['username'] = 'Please enter your username.';
}
if ($password == '') {
        $arrErrors['password'] = 'Please enter your password.';
}
$login_check = "SELECT * FROM users WHERE username= '$username'" or die ("Could not select database because: " . mysql_error());

$login_query = mysql_query ( $login_check ) or die ( 'Query failed because: ' . mysql_error () );

//debug purpose
print_r($login_query);

$login_result = mysql_result ( $login_query, 0, 0 );

//debug purpose
print_r($login_result);

if ($login_result == 1) {
        setcookie ("username", $login_result[username]);
        setcookie ("password", $login_result[password]);
        header('Location: add_a_comment.php');
        exit;   
} else {
        echo "<center>Sorry, you don't know who you are!</center>";
}
}
mysql_close();

Posted: Tue Oct 17, 2006 1:23 am
by Christopher
Shouln' t this:

Code: Select all

$login_check = "SELECT * FROM users WHERE username= '$username'" or die ("Could not select database because: " . mysql_error());
just be:

Code: Select all

$login_check = "SELECT * FROM users WHERE username= '$username'";

Posted: Tue Oct 17, 2006 1:42 am
by ZephyrWest
You are using mysql_result() incorrectly; it is used to fetch a single cell from a MySQL result set which does not seem to be what you are doing. Try using something like mysql_fetch_row().

Code: Select all

list( $username, $password ) = mysql_fetch_row( $login_query );

Posted: Tue Oct 17, 2006 2:14 am
by thomas777neo
Just a couple of tips regarding your script:

1. You don't identify the user using both the username and password. Making things much easier to gain access to your system.
2. Opinion: use addslashes instead of mysql_real_escape_string.
3. You have the die() function after a string?
4. Using a deprecated method regarding cookies / sessions
5. Lacking security basics

Not bad for a first attempt, just keep in mind that authentication is discussed in great depth on this site, so do search to further your security and use better authentication principles.

Here is an example that should sort out your problem and make life a bit easier:

Code: Select all

// script not tested

session_start();

// build the sql query to execute
$sql = "SELECT username, password 
		FROM users 
		WHERE username = '".addslashes($_POST['username']."' 
		AND password = '".addslashes($_POST['password'])."'";

// execute the query
$check = mysql_query($sql) 
			or die("Authentication SQL Failed ".mysql_error()); // notice the die location
			
$rows = mysql_num_rows($check); // get the number of rows returned

// if the forced integer rows is greater than 0, the user exists
if ((int)$rows > 0)
{
	/*
		* easier way to store variables
		* don't store login information in the session
	*/
	
	$_SESSION['authenticated'] = "yes";
	
               // if you were to store the variables in the session...
               // $_SESSION['username'] = mysql_result($check,0,"username"); 

	header('Location: add_a_comment.php'); // better to put full path here
} // if ((int)$rows > 0)
	else
	{
		$_SESSION['authenticated'] = "no";
		
		echo "<div align=\"center\"><p>Authorisation Failed</p></div>";
	} // else for if ((int)$rows > 0)
	
// after logging in

session_start();	

if ($_SESSION['authenticated'] == "yes")
{
	// ....
} // if ($_SESSION['authenticated'] == "yes")
	else
	{
		// ....
	} // else for if ($_SESSION['authenticated'] == "yes")

Posted: Tue Oct 17, 2006 2:22 am
by jmut
thomas777neo wrote: ...
2. Opinion: use addslashes instead of mysql_real_escape_string.
...
mysql_real_escape_string is the correct way to escape data for mysql db. Although addslashes will probably be good enough in most cases.

Posted: Tue Oct 17, 2006 2:28 am
by ZephyrWest
There are ways to get around addslashes()... always use mysql_real_escape_string() for sanitizing data before insertion into a database.

Posted: Tue Oct 17, 2006 2:31 am
by thomas777neo
hence, my opinion