ambo Posted May 30, 2016 Share Posted May 30, 2016 <?php session_start(); include_once '/functions/dbconnect.php'; if(isset($_SESSION['user'])!="") { header("Location: home.php"); } if(isset($_POST['btn-login'])) { $email = mysql_real_escape_string($_POST['email']); $uname = mysql_real_escape_string($_POST['uname']); $upass = mysql_real_escape_string($_POST['pass']); $email = trim($email); $uname = trim($uname); $upass = trim($upass); $res=mysql_query("SELECT user_id, user_name, user_pass FROM users WHERE user_name='$uname'"); $row=mysql_fetch_array($res); $count = mysql_num_rows($res); // if uname/pass correct it returns must be 1 row if($count == 1 && $row['user_pass']==md5($upass)) { $_SESSION['user'] = $row['user_id']; header("Location: home.php"); } else { ?> <script>alert('Username / Password Seems Wrong !');</script> <?php } } ?> <html lang="en"> <head> <meta charset="UTF-8"> <title>Runkys Small Engine Repair</title> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> <meta name="description" content="" /> <meta name="keywords" content="" /> <!--[if lte IE 8]><script src="js/html5shiv.js"></script><![endif]--> <script src="js/jquery.min.js"></script> <script src="js/skel.min.js"></script> <script src="js/skel-layers.min.js"></script> <script src="js/init.js"></script> <noscript> <link rel="stylesheet" href="css/skel.css" /> <link rel="stylesheet" href="css/style.css" /> <link rel="stylesheet" href="css/style-xlarge.css" /> </noscript> </head> <body class="landing"> <!-- Header --><!-- Banner --> <section id="banner"> <h2>Runkys</h2> <p>Small Engine Repair</p> <ul class="actions"> <li> <form method="post"> <table id="form" align="center" width="30%" border="0"> <tr id="trlogim"> <td><input type="text" name="uname" placeholder="Username" required /></td> </tr> <tr id="trlogim"> <td><input type="password" name="pass" placeholder="Your Password" required /></td> </tr> <tr id="trlogim"> <td><button type="submit" name="btn-login">Sign In</button></td> </tr> </table> </form> I have a simple login script that I have been playing with and it was working on my local wamp server but when I uploaded it to the web server all works except the login part I know my dbconnect.php file is accurate because I can register new users I just cant sign them in Quote Link to comment Share on other sites More sharing options...
Jacques1 Posted May 30, 2016 Share Posted May 30, 2016 (edited) C'mon. After 8 years, you should have figured out that “doesn't work” is not a valid problem description. Learn to analyze issues and provide relevant information. What exactly happens? Do you see a white page? An error message? An application-specific message? Something else? What does the PHP error log say? Make sure to enable error reporting and logging. A couple of var_dump() calls or a professional debugger like XDebug allow you to analyze the control flow of your program (i. e. what happens where). Right now, all we can do is speculate. Your include statement tries to load a script from /functions/dbconnect.php (note the leading slash). That's an odd location, because it's directly under the root filesystem. I'm fairly sure you want the relative path functions/dbconnect.php which points to a directory next to the current script. Besides that, your code is insecure and weird, and it seems you have ignored every single advice we gave you. You're free to do that, but then we get the impression we're wasting our time with you. Edited May 30, 2016 by Jacques1 Quote Link to comment Share on other sites More sharing options...
ginerjm Posted May 31, 2016 Share Posted May 31, 2016 This is some odd code. Here are my questions: This line: if(isset($_SESSION['user'])!="") What are you trying to determine here? That the 'user' element exists? Or that it is not null/empty? It probably works but as a simple programmer I look at it leerily. IMHO, decide on what you want and code for that. In this case I see a test that yields a Boolean result which you are then testing against (what I call) a null value. Whether it is True or False, the test is either invalid or (due to some PHP rules) not exactly clear. After that first line you then grab 3 inputs and massage them and then put them into a query. Yet - you didn't check to see if they were blank!! Third - you do this query looking for a password. Hmmmm. You didn't hash the input password so it appears that you are storing passwords in clear text in your db. Tsk, tsk, tsk. Not at all a good practice. Even if you were storing it in an encrypted form and using an encrypted input value to query with, you should never return the password value to your script. What for? You aren't going to use it anywhere, are you? (If the answer is yes - it s/b NO.) Next - you run your query (without checking if it ran successfully ) and pull a row from the results. THEN you check to see if there were any rows returned (the count). Doesn't that give you a thoughts about anything? Check the count BEFORE you (try and) fetch a row! Now we get to where you encrypt your user input (which you are not even sure exists!) and test the query result value. As I said before you should not be bringing down a password value into your script. Construct your query to look for that correct record and if you get that 1 record result that you expect you will know that the userid/password combination is correct. Now for the html. You output a script tag to display an error message. Not my choice of actions but to each his own. But - you are clever enough to include a noscript tag in your output, but I see nothing there that makes it necessary. Even more - you already sent out a JS script before knowing if the browser accepts JS. How is that going to work? Even more curious you use the noscript tags to wrap your CSS includes. So - if your browser supports JS, it can't utilize the CSS code, but if it doesn't you will use a well-designed layout based upon those CSS files? Hmmmm. And for my final question. You have a set of inputs that you want to show. First you begin an unordered list element. Then you begin a form which is necessary of course. Then you wrap that form inside an html table element which is a common, though outdated, method for designing an input page. What exactly is this list element doing for you? Things to think about. The multiple uses of an id name will confuse the browser. I don't know why you are assigning them to table row elements, but if you are going to do it use unique values. The use of a button element inside of a form is not the usual way. Why not an input element specifying a 'submit' type? The button element has its uses, but the type='submit' input element is specifically there for this purpose. Quote Link to comment Share on other sites More sharing options...
Jacques1 Posted May 31, 2016 Share Posted May 31, 2016 Third - you do this query looking for a password. Hmmmm. You didn't hash the input password so it appears that you are storing passwords in clear text in your db. Tsk, tsk, tsk. Not at all a good practice. Even if you were storing it in an encrypted form and using an encrypted input value to query with, you should never return the password value to your script. What for? You aren't going to use it anywhere, are you? (If the answer is yes - it s/b NO.) The password is hashed with MD5. A couple of people have already posted long explanations in the previous thread, but the code is still the same. Quote Link to comment Share on other sites More sharing options...
ginerjm Posted May 31, 2016 Share Posted May 31, 2016 I wasn't aware of any previous thread, hence my needless repetition. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.