Jump to content

bytephp

New Members
  • Posts

    2
  • Joined

  • Last visited

Profile Information

  • Gender
    Not Telling

bytephp's Achievements

Newbie

Newbie (1/5)

1

Reputation

  1. Thanks for the advise guys. The reason for doing this is to remove the first 29 characters (the salt) from the hash and return what is left, which is the actual password that will be stored in the database. The salt is used and generated in real time based on the username and password. More details on how and why this is done can be found here. Anyone able to provide feedback on other areas please? My main concern is how I'm deleting users and if I can make the code can be refactored by storing more bits in a function.
  2. Hi all. I'm pretty new to PHP and am trying to write a simple CMS using procedual PHP and MySQLi. Thought I'd build a CMS just to get a basic understanding of how things work. I know this would be better done with OOPHP and using PDO for databases interaction, however would appreciate any advice on how what I've done could be improved. The main areas I'm unsure on is..... Am I using mysqli_real_escape_string(); ok? When updating and deleteing users, is using the GET method ok as it seems a little unsafe when deleting users? Is the sanitization ok? Could I be making more use of functions, say for the session? If so how would you advise. Anything else that need improving? register.php - this is where I'm unsure on sanitization. Functions page is below this block of code. <?php require ('db-connection.php'); require ( 'functions.php' ); $pageTitle = 'Register'; if ( isset( $_POST['submitForm'] ) ) { $errors = array(); // puts errors into array if ( empty( $_POST['name']) ) { $errors['name'] = 'Please enter a name'; } else { $name = sanitize( $_POST['name'] ); $name = mysqli_real_escape_string( $dbc, $name ); } if ( empty ( $_POST['email'] ) ) { $errors['email'] = 'Please enter an email address'; } else { $email = sanitize( $_POST['email'] ); $email = mysqli_real_escape_string( $dbc, $email ); } if ( empty( $_POST['username']) ) { $errors['username'] = 'Please enter a username'; } else { $username = sanitize( $_POST['username'] ); $username = mysqli_real_escape_string( $dbc, $username ); } if ( empty( $_POST['password'] ) ) { $errors['password'] = 'Please enter a password'; } elseif ( $_POST['password'] !== $_POST['confirm_password'] ) { $errors['password'] = 'Passwords do not match'; } else { $salt = generateSalt( $_POST['username'] ); $password = generateHash( $salt, $_POST['password'] ); } $telephone = sanitize( $_POST['telephone'] ); $telephone = mysqli_real_escape_string( $dbc, $telephone ); $postcode = sanitize( $_POST['postcode'] ); $postcode = mysqli_real_escape_string( $dbc, $postcode ); if ( empty( $errors ) ) { $db_insert = "INSERT INTO users VALUES ( NULL, '$name', '$email', '$username', '$password', '$telephone', '$postcode' )"; mysqli_query( $dbc, $db_insert ); // performs query on db header( 'Location: login.php' ); } } require( 'header.php' ); ?> <h1>Register</h1> <form action="register.php" method="post" class="form-horizontal"> <?php if ( !empty ( $errors ) ) : ?> <div class="alert alert-error"> <button type="button" class="close" data-dismiss="alert">×</button> <p> <?php foreach ( $errors as $msg ) { echo $msg .'<br />'; } ?> </p> </div> <?php elseif ( empty( $errors ) && isset( $_POST['submitForm'] ) ) : ?> <p>Thank you for completing the form.</p> <?php endif; ?> <div class="control-group"> <label class="control-label" for="name">Name *</label> <div class="controls"> <input type="text" id="name" name="name" placeholder="Email" value="<?php echo isset($_POST['name']) ? $_POST['name'] : ""; ?>"> </div> </div> <div class="control-group"> <label class="control-label" for="email">Email *</label> <div class="controls"> <input type="text" id="email" name="email" placeholder="Email" value="<?php echo isset($_POST['email']) ? $_POST['email'] : ""; ?>"> </div> </div> <div class="control-group"> <label class="control-label" for="username">Username *</label> <div class="controls"> <input type="text" id="username" name="username" placeholder="Username" value="<?php echo isset($_POST['username']) ? $_POST['username'] : ""; ?>"> </div> </div> <div class="control-group"> <label class="control-label" for="username">Password *</label> <div class="controls"> <input type="password" id="password" name="password" placeholder="Password" value="<?php echo isset($_POST['password']) ? $_POST['password'] : ""; ?>"> </div> </div> <div class="control-group"> <label class="control-label" for="confirm_password">Confirm Password *</label> <div class="controls"> <input type="password" id="cofirm_password" name="confirm_password" placeholder="Confirm Password" value="<?php echo isset($_POST['confirm_password']) ? $_POST['confirm_password'] : ""; ?>"> </div> </div> <div class="control-group"> <label class="control-label" for="telephone">Telephone</label> <div class="controls"> <input type="text" id="telephone" name="telephone" placeholder="Telephone" value="<?php echo isset($_POST['telephone']) ? $_POST['telephone'] : ""; ?>"> </div> </div> <div class="control-group"> <label class="control-label" for="postcode">Postcode</label> <div class="controls"> <input type="text" id="postcode" name="postcode" placeholder="Postcode" value="<?php echo isset($_POST['postcode']) ? $_POST['postcode'] : ""; ?>"> </div> </div> <div class="control-group"> <div class="controls"> <button type="submit" class="btn btn-large btn-primary" name="submitForm">Register</button> </div> </div> </form> <?php require( 'footer.php' ); ?> functions.php <?php function generateSalt( $username ) { $salt = '$2a$10$'; $salt = $salt . md5(strtolower( $username )); return $salt; } function generateHash( $salt, $password ) { $hash = crypt( $password, $salt ); $hash = substr($hash, 29); return $hash; } function sanitize( $input ) { return htmlspecialchars(trim( $input )); } view-users.php - when displaying data from the database, do I need to run it through mysqli_real_escape_string(); before outputting to the user? How would that be done, just on the $result variable? Also with the delete user, I'm using the GET method, is this ok? This is opening the page which I've put the code below this block. <?php session_start(); if ( !isset( $_SESSION['username'] ) ) { header ( 'Location: login.php' ); } else { // set time-out period (in seconds) $inactive = 300; if (isset($_SESSION["timeout"])) { // calculate the session's "time to live" $sessionTTL = time() - $_SESSION["timeout"]; if ($sessionTTL > $inactive) { session_destroy(); header( 'Location: logout.php' ); } } $_SESSION["timeout"] = time(); } require( 'db-connection.php' ); require( 'functions.php' ); // $query = "SELECT * FROM users"; $query = "SELECT id, name, email, username, telephone, postcode FROM users"; $result = mysqli_query( $dbc, $query ); require( 'header.php' ); ?> <p><a href="logout.php">Logout</a></p> <table class="table table-striped"> <tr> <th>ID</th> <th>Name</th> <th>Email</th> <th>Username</th> <th>Telephone</th> <th>Postcode</th> <th>Edit User</th> </tr> <?php while ( $row = mysqli_fetch_array( $result, MYSQLI_ASSOC ) ) : ?> <?php $username = $row['username']; ?> <tr> <td><?php echo $row['id']; ?></td> <td><?php echo $row['name']; ?></td> <td><?php echo $row['email']; ?></td> <td><?php echo $row['username']; ?></td> <td><?php echo $row['telephone']; ?></td> <td><?php echo $row['postcode']; ?></td>> <td> <div class="btn-group"> <a class="btn" href="edit-user.php?username=<?php echo $username; ?>"><i class="icon icon-edit"></i></a> <a class="btn" href="delete-user.php?username=<?php echo $username; ?>"><i class="icon icon-trash"></i></a> </div> </td> </tr> <?php endwhile; ?> </table> <p><?php printf("Select returned %d rows.\n", mysqli_num_rows($result)); ?></p> <?php require( 'footer.php' ); ?> delete-user.php <?php session_start(); if ( !isset( $_SESSION['username'] ) ) { header ( 'Location: login.php' ); } require( 'db-connection.php' ); require( 'functions.php' ); if ( isset( $_GET['username'] ) ) { $username = $_GET['username']; $query = "DELETE FROM users WHERE username = '$username'"; $result = mysqli_query( $dbc, $query ); header( 'Location: view-users.php' ); } mysql_close( $dbc ); Thanks in advance.
×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.