Jump to content


Photo

Newbie Problems


  • Please log in to reply
4 replies to this topic

#1 dark dude

dark dude
  • Members
  • PipPipPip
  • Advanced Member
  • 53 posts

Posted 05 June 2006 - 06:42 PM

Hi,

I've recently started on php after html couldnt bear what I needed.

I need to know how to do some things. Here's a small explanation of my problems.

Problem #1 - Sessions, Session IDs and Logins

Ok, I have a login page and a php script that processes it against the variables, and then confirms/declines the login onto a preview page.
Only problem is, when you click the link on the "login success/process!" screen i put in, I had it so you clicked a link to view the "Game overview.php". However, it doesnt show your variables, like username, planet etc. (I am coding an online game).
I need a basic description on how to store the login information into a session/session id, and send it across the other pages, so I can select specific variables on the database that are with the login information.
All I know at the moment is that you start a session with session_start() and end it with session_destroy(), and you do something with $_Session['Username/whatever'].

Putting it simple, I want a focused description on how to properly "login" and then pick up the users variables that exists in the database. I also want to store all this in a "Random Session Id" that can be shown in the URL.

Here are my two scripts at the moment:
The login form (login.php)
[!--quoteo--][div class=\'quotetop\']QUOTE[/div][div class=\'quotemain\'][!--quotec--]<body bgcolor='#000033' text='#CCFFFF'>
<h1>Server 1 Login Page</h1>
<i>Notice: Logins are currently bugged and unfinished. A "Session Id" is still to be created to enable full dynamic use of your account.</br>
Thank you, and enjoy our login</i>
<form name="authenticate" method="post" action="loginprocess.php">
Username: <input name="Username" type="text" value="Username" size="20"/><br>
Password: <input name="Password" type="text" value="Password" size="20"/><br>
<input type="submit" name="submit" value="submit"/>
<input type="reset" name="reset" value="reset"/>
</form>[/quote]

The login process + preview page (loginprocess.php)
[!--quoteo--][div class=\'quotetop\']QUOTE[/div][div class=\'quotemain\'][!--quotec--]<body bgcolor='#000033' text='#CCFFFF'>
<?
$username="Server1Main";
$password="nobodyloses";
$database="Server1";

mysql_connect(localhost,$username,$password);
@mysql_select_db($database) or die( "Unable to select database");

$query="SELECT * FROM Users";
$result=mysql_query($query);

$Status=mysql_result($result,"Status");


$sql="SELECT * FROM Users WHERE Username='$Username' and Password='$Password'";
$r = mysql_query($sql);
if(!$r) {
$err=mysql_error();
print $err;
exit();
}
if(mysql_affected_rows()==0){
print "Invalid Username/Password, Please try again.";
exit();
}
else{
print "Thank you for logging on, ".$Username.". ";
}
if($Status=="Banned"){
print "<br>You have been banned from the server for ".$BannedFor." by ".$BannedBy.".<br>";
print "Your ban will expire on ".$BannedUntil.".";
}
else{
print "Welcome to Adastra Extritium!";
}

?>[/quote]

(Also, it doesnt like the ban check)


Problem #2 - SQL Injections

I am aware of major security holes with both Cookies and Sessions, but I chose to use sessions, for compatibility reasons.
Is there any way of closing the security hole to prevent people from Sql Injecting members Session Ids? Thanks for any help here.


Problem #3 - Server Updating and Times

With this game, you need timers. I want to know how to set it so that when you click a "Build" button, it applies a timer delay. After that timer (it's also displayed to the user) reaches 0, the build is complete, and the build completion script runs. (ie. if ($Timer==00s) set $Woodmill=$Woodmill+1)

Also, I need to know how to set the server to refresh itself (so all the points update at the same time) on regular intervals, like every 4 hrs.



Thanks for any help,

~Dark dude~

#2 poirot

poirot
  • Members
  • PipPipPip
  • Advanced Member
  • 646 posts
  • LocationAustin, TX

Posted 05 June 2006 - 06:49 PM

1. Something like this:

$query = mysql_query("SELECT * FROM users ...");
while ($row = mysql_fetch_array($query)) {
   $_SESSION['planet'] = $row['planet'];
   $_SESSION['weapon'] = $row'[weapon']...

2. SQL Injection may or may not involve the session ID's. It's basically execution of arbitrary SQL queries by using exploits. To avoid them, you must not trust user input, ever. And escape data before querying:

[a href=\"http://www.php.net/mysql_escape_string\" target=\"_blank\"]http://www.php.net/mysql_escape_string[/a]

3. You can use cron jobs for that.

And finally a reminder, games like this usually hog a lot of resources. Be careful to not take down the server.
~ D Kuang

#3 dark dude

dark dude
  • Members
  • PipPipPip
  • Advanced Member
  • 53 posts

Posted 05 June 2006 - 07:03 PM

1. Ok, so how do you convert the session id back? eg. Later on, you want to read the Session['Status'] to see if they should have access to a Moderator area?

2. Ooooh, ok, thanks for answering that for me =]

3. Cron jobs? You mean, like, somebody, say, a friend, goes onto the server database and refreshes the scores?


@Reminder: Yup, I am aware of that, it's text based, and the server I am using is rated one of the top 10 servers on the net. It's only a small game, but we will pay for bigger, better servers when needed.
And yeah, thanks for noting the dangers of it anyway :P

#4 .josh

.josh
  • Staff Alumni
  • .josh
  • 14,871 posts

Posted 05 June 2006 - 07:19 PM

3. no. a cron job is a unix method of executing a script at regular intervals. you would setup a cron job through cpanel or from your server command line. the easier way is to do it through cpanel. you just enter in the path and name of the script you want to be executed and enter in the time interval you want it to be executed. the server will automatically run your script every x amount of time. the script itself would do the updating of your data, and the server will run it.
Did I help you? Feeling generous? Buy me lunch! 
Please, take the time and do some research and find out how much it would have cost you to get your help from a decent paid-for source. A "roll-of-the-dice" freelancer will charge you $5-$15/hr. A decent entry level freelancer will charge you around $15-30/hr. A professional will charge you anywhere from $50-$100/hr. An agency will charge anywhere from $100-$250/hr. Think about all this when soliciting for help here. Think about how much money you are making from the work you are asking for help on. No, we do not expect you to pay for the help given here, but donating a few bucks is a fraction of the cost of what you would have paid, shows your appreciation, helps motivate people to keep offering help without the pricetag, and helps make this a higher quality free-help community :)

#5 dark dude

dark dude
  • Members
  • PipPipPip
  • Advanced Member
  • 53 posts

Posted 05 June 2006 - 08:27 PM

Aaaaah, thanks a lot, and extra thanks for the super-efficient responses =P

I think I remember there being a tutorial here about session ids, so i'll find that to answer my other question =]



~Dark dude~




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users