PHP Simple Security Question...

phakebrill · August 19, 2008

Hi all,

I need my users to be able to access a page via a login form using PHP and a MySQL database. The login part is taken care of (entering the correct credentials is necessary) but I can actually navigate to the target page without supplying login details. I have an HTTP_REFERER script on the target page but it doesn't seem to be working. I'm new to PHP so if someone could point out my faults I would sincerely appreciate it.

Thanks!

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<!-- DW6 -->
<head>
<!-- Copyright 2005 Macromedia, Inc. All rights reserved. -->
<title>SU Calendar System</title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<link rel="stylesheet" href="mm_travel2.css" type="text/css" />
<script type="text/javascript">
//--------------- LOCALIZEABLE GLOBALS ---------------
var d=new Date();
var monthname=new Array("January","February","March","April","May","June","July","August","September","October","November","December");
//Ensure correct for language. English is "January 1, 2004"
var TODAY = monthname[d.getMonth()] + " " + d.getDate() + ", " + d.getFullYear();
//---------------   END LOCALIZEABLE   ---------------
</script>
<style type="text/css">
<!--
.style1 {color: #FFFFFF}
.style2 {color: #666666; }
.style4 {color: #66FF33}
a:link {
color: #093B6D;
}
a:visited {
color: #093B6D;
}
-->
</style>
</head>
<body bgcolor="#C0DFFD">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
  <tr bgcolor="#3366CC">
    <td colspan="2" rowspan="2" bgcolor="#003A6B"><img src="logo.png" alt="sulogo" width="211" height="99" /></td>
    <td width="85%" height="63" align="center" valign="bottom" bgcolor="#003A6B" class="style1" id="logo">Sunderland University Calendar System</td>
    <td width="0%" bgcolor="#003A6B"> </td>
  </tr>
  <tr bgcolor="#3366CC">
    <td height="64" align="center" valign="top" bgcolor="#003A6B" class="style2" id="tagline">Wasting your time since 1979...</td>
<td bgcolor="#003A6B"> </td>
  </tr>
  <tr>
    <td colspan="4" bgcolor="#003366"><img src="mm_spacer.gif" alt="" width="1" height="1" border="0" /></td>
  </tr>

  <tr bgcolor="#CCFF99">
  	<td width="4%" bgcolor="#FFFFFF"> </td>
  	<td height="25" colspan="3" bgcolor="#FFFFFF" id="dateformat"><script type="text/javascript">
      document.write(TODAY);	</script>
      
      <a href="index.html"> home</a>  |  
       
      <a href="login.php">login</a> | <a href="calendar_view.php">calendar</a></td>
  </tr>
<tr>
    <td colspan="4" bgcolor="#003366"><img src="mm_spacer.gif" alt="" width="1" height="1" border="0" /></td>
  </tr>
<tr>
    <td> </td>
    <td colspan="2" valign="top"> <br />
     <br />
    <table border="0" cellspacing="0" cellpadding="2" width="500">
        <tr>
          <td class="pageName">calendar</td>
        </tr>
        <tr>
          <td class="bodyText">
          

<?php
// File: calendar_view.php

error_reporting(E_ALL ^ E_NOTICE);  // Suppresses the piddly little notices that the University PHP server cries about!

//The next line of code ensures that users are referred to this page from the login.php page.
//If not, they are re-directed back to login with correct credentials.

if (!$_SERVER["HTTP_REFERER"] == "http://osiris.sunderland.ac.uk/~bd77gl/login.php")
    header("location: login.php");
    
if ($_POST["Logout"])
    header("location: index.html");

require_once("databaseauth.php");

session_start();
$intId = $_SESSION["Id"];

if ($_POST["Delete"])
    deleteMessage($dbLocalhost);
if ($_POST["Update"])
    updateMessage($dbLocalhost);
if ($_POST["Create"])
    createMessage($dbLocalhost, $intId);
    
displaymessages($dbLocalhost, $intId);
displayCreateNewForm();


///////////////////////////////////////////////////////////////////////////
//
// Function: deleteMessage() - Deletes the selected message					Simon Stobart Lecture Material, 2007/2008
//
///////////////////////////////////////////////////////////////////////////

function deleteMessage($dbLocalhost) {
    $intMessageId = $_POST['intMessageId'];
    $dbMessageRecords = mysql_query("DELETE FROM messages WHERE Id='$intMessageId'", $dbLocalhost)
        or die("Problem deleting record: " . mysql_error());
}


///////////////////////////////////////////////////////////////////////////
//
// Function: updateMessage() - Updates the selected message					Simon Stobart Lecture Material, 2007/2008
//
///////////////////////////////////////////////////////////////////////////

function updateMessage($dbLocalhost) {
    $arrDate = getdate();
    $intHour = $arrDate["hours"];
    $intMinute = $arrDate["minutes"];
    $intDay = $arrDate["mday"];
    $intMonth = $arrDate["mon"];
    $intYear = $arrDate["year"];
    $intMessageId = $_POST['intMessageId'];
    $strMessage = $_POST['strMessage'];
    $dbMessageRecords = mysql_query("UPDATE messages SET Message='$strMessage', Day='$intDay', Month='$intMonth', Year='$intYear', Hour='$intHour', Minute='$intMinute' WHERE Id='$intMessageId'", $dbLocalhost)
        or die("Problem updating record: " . mysql_error());
}


///////////////////////////////////////////////////////////////////////////
//
// Function: createMessage() - Create a new message							Simon Stobart Lecture Material, 2007/2008
//
///////////////////////////////////////////////////////////////////////////

function createMessage($dbLocalhost, $intId) {
    $arrDate = getdate();
    $intHour = $arrDate["hours"];
    $intMinute = $arrDate["minutes"];
    $intDay = $arrDate["mday"];
    $intMonth = $arrDate["mon"];
    $intYear = $arrDate["year"];
    $strMessage = $_POST["strMessage"];
    $dbMessageRecords = mysql_query("INSERT INTO messages VALUES ('', '$intId', '$strMessage', '$intDay', '$intMonth', '$intYear', '$intHour', '$intMinute')", $dbLocalhost)
   or die("Problem writing to table: " . mysql_error());
}


///////////////////////////////////////////////////////////////////////////
//
// Function: displayMessages() - Displays all the messages in the DB		Simon Stobart Lecture Material, 2007/2008
//
///////////////////////////////////////////////////////////////////////////

function displaymessages($dbLocalhost, $intId) {
    $dbMemberRecords = mysql_query("SELECT * FROM members WHERE Id='$intId'", $dbLocalhost)
        or die("Problem reading table: " . mysql_error());
    $arrMemberRecords = mysql_fetch_array($dbMemberRecords);
    $strForename = $arrMemberRecords["Forename"];
    $strSurname = $arrMemberRecords["Surname"];

    echo "<h2>Hello $strForename $strSurname!</h2> <h3>Welcome to the pre-Alpha of the SU Calendar System.</h3>";
echo "<h3>Below you can find all of the meetings taking place over the course of the academic year.</h3>";

    $dbMessageRecords = mysql_query("SELECT * FROM messages", $dbLocalhost)
        or die("Problem reading table: " . mysql_error());
    while ($arrMessageRecords = mysql_fetch_array($dbMessageRecords)) {
        $intMessageId  = $arrMessageRecords["Id"];
        $intmembersId = $arrMessageRecords["members_Id"];
        $strMessage = $arrMessageRecords["Message"];
        $intDay = $arrMessageRecords["Day"];
        $intMonth = $arrMessageRecords["Month"];
        $intYear = $arrMessageRecords["Year"];
        $intHour = $arrMessageRecords["Hour"];
        $intMinute = $arrMessageRecords["Minute"];
        $dbMemberRecords = mysql_query("SELECT * FROM members WHERE Id='$intmembersId'", $dbLocalhost)
            or die("Problem reading table: " . mysql_error());
        $arrMemberRecords = mysql_fetch_array($dbMemberRecords);
        $strForename = $arrMemberRecords["Forename"];
        $strSurname = $arrMemberRecords["Surname"];
        echo "<form action='" . $_SERVER["PHP_SELF"] . "' method='post'>";
    	echo "<fieldset id='ExistingMessage'><legend>";
        echo "Meeting on $intDay/$intMonth/$intYear at $intHour:$intMinute By: $strForename $strSurname</legend>";
        if ($intmembersId == $intId) {
            echo "<p><input type='submit' name='Delete' value='Delete'/>";
            echo "<input type='submit' name='Update' value='Update'/>";
            echo "<input type='hidden' name='intMessageId' value='$intMessageId'/></p>";
        }
        echo "<textarea cols='65' name='strMessage'>$strMessage</textarea>";
        echo "</fieldset></form>";
    }
}


///////////////////////////////////////////////////////////////////////////
//
// Function: displayCreateNewForm() - Creates the new message form			Simon Stobart Lecture Material, 2007/2008
//
///////////////////////////////////////////////////////////////////////////

function displayCreateNewForm() {
    echo "<form action='" . $_SERVER["PHP_SELF"] . "' method='post'>";
    echo "<fieldset id='CreateMessage'><legend>Create New Message ...</legend>";
    echo "<p><textarea cols='65' name='strMessage'></textarea></p>";
    echo "<p><input type='submit' name='Create' value='Create'/>";
    echo "<input type='submit' name='Logout' value='Logout'/><p>";
    echo "</fieldset></form>";
}
?>
      
          
          <p> </p></td>
	</tr>
      </table>	  </td>
<td> </td>
  </tr>

<tr>
    <td> </td>
    <td width="11%"><span class="bodyText">© 2008 brill <span class="style4"><a href="#" id="rw_email_contact">Contact Me</a>
          <script type="text/javascript">var _rwObsfuscatedHref0 = "mai";var _rwObsfuscatedHref1 = "lto";var _rwObsfuscatedHref2 = ":j.";var _rwObsfuscatedHref3 = "gil";var _rwObsfuscatedHref4 = "ber";var _rwObsfuscatedHref5 = "t-1";var _rwObsfuscatedHref6 = "@su";var _rwObsfuscatedHref7 = "nde";var _rwObsfuscatedHref8 = "rla";var _rwObsfuscatedHref9 = "nd.";var _rwObsfuscatedHref10 = "ac.";var _rwObsfuscatedHref11 = "uk";var _rwObsfuscatedHref = _rwObsfuscatedHref0+_rwObsfuscatedHref1+_rwObsfuscatedHref2+_rwObsfuscatedHref3+_rwObsfuscatedHref4+_rwObsfuscatedHref5+_rwObsfuscatedHref6+_rwObsfuscatedHref7+_rwObsfuscatedHref8+_rwObsfuscatedHref9+_rwObsfuscatedHref10+_rwObsfuscatedHref11; document.getElementById('rw_email_contact').href = _rwObsfuscatedHref;</script>
    </span></span></td>
    <td> </td>
<td> </td>
  </tr>
</table>
</body>
</html>

ILYAS415 · August 19, 2008

You need to check if they have a session that is valid.

Also make sure you have assigned them a session in your login.php script.

If you can show me your login.php script ill be glad to help.

phakebrill · August 19, 2008

Wow, thanks for a speedy reply! Here is my login script.

<?php
//login.php

error_reporting(E_ALL ^ E_NOTICE);                     // Suppresses the piddly little notices that the University PHP server cries about!

require_once("databaseauth.php");

if ($_POST["submit"]) {
$strEmail = $_POST["strEmail"];
$strPassword = md5($_POST["strPassword"]);
$dbMemberRecords = mysql_query("SELECT * FROM members WHERE Email='$strEmail' AND Password='$strPassword'", $dbLocalhost)
	or die("Problem reading table: " . mysql_error());
$intMemberCount = mysql_num_rows($dbMemberRecords);
if ($intMemberCount > 0) {
	$arrMemberRecords = mysql_fetch_array($dbMemberRecords);
	session_start();
	$_SESSION["Id"] = $arrMemberRecords["Id"];
	header("location: calendar_view.php");
	}
else
	echo "<p>Incorrect username and/or password.</p>";
}
?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<!-- DW6 -->
<head>
<!-- Copyright 2005 Macromedia, Inc. All rights reserved. -->
<title>SU Calendar System</title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<link rel="stylesheet" href="mm_travel2.css" type="text/css" />
<script type="text/javascript">
//--------------- LOCALIZEABLE GLOBALS ---------------
var d=new Date();
var monthname=new Array("January","February","March","April","May","June","July","August","September","October","November","December");
//Ensure correct for language. English is "January 1, 2004"
var TODAY = monthname[d.getMonth()] + " " + d.getDate() + ", " + d.getFullYear();
//---------------   END LOCALIZEABLE   ---------------
</script>
<style type="text/css">
<!--
.style1 {color: #FFFFFF}
.style2 {color: #666666; }
.style4 {color: #66FF33}
a:link {
color: #093B6D;
}
a:visited {
color: #093B6D;
}
-->
</style>
</head>
<body bgcolor="#C0DFFD">
<table width="100%" border="0" cellspacing="0" cellpadding="0">
  <tr bgcolor="#3366CC">
    <td colspan="2" rowspan="2" bgcolor="#003A6B"><img src="logo.png" alt="sulogo" width="211" height="99" /></td>
    <td width="85%" height="63" align="center" valign="bottom" bgcolor="#003A6B" class="style1" id="logo">Sunderland University Calendar System</td>
    <td width="0%" bgcolor="#003A6B"> </td>
  </tr>
  <tr bgcolor="#3366CC">
    <td height="64" align="center" valign="top" bgcolor="#003A6B" class="style2" id="tagline">Wasting your time since 1979...</td>
<td bgcolor="#003A6B"> </td>
  </tr>
  <tr>
    <td colspan="4" bgcolor="#003366"><img src="mm_spacer.gif" alt="" width="1" height="1" border="0" /></td>
  </tr>

  <tr bgcolor="#CCFF99">
  	<td width="4%" bgcolor="#FFFFFF"> </td>
  	<td height="25" colspan="3" bgcolor="#FFFFFF" id="dateformat"><script type="text/javascript">
      document.write(TODAY);	</script> 
  	<a href="index.html">home</a>  |  
       
      <a href="login.php">login</a> | <a href="calendar_view.php">calendar</a></td>
  </tr>
<tr>
    <td colspan="4" bgcolor="#003366"><img src="mm_spacer.gif" alt="" width="1" height="1" border="0" /></td>
  </tr>
<tr>
    <td> </td>
    <td colspan="2" valign="top"> <br>
     <br>
    <table border="0" cellspacing="0" cellpadding="2" width="500">
        <tr>
          <td class="pageName">login</td>
        </tr>
        <tr>
          <td class="bodyText"><p>Welcome to the Sunderland University staff calendar login. In order to gain access to the SU Calendar System you will need to use the login form below. Please use your email address and password. If you have any problems please contact me using the link below.</p>
          <p>Thank you.</p>
          
          <form action='<?php echo $_SERVER["PHP_SELF"] ?>' method='post'>
          <p><label for="strEmail">Email: </label>
          <input type='text' name='strEmail' value='<?php echo $_POST["strEmail"] ?>' id='strEmail'/></p>
          <p><label for="strPassword">Password: </label>
            <input type='password' name='strPassword' value='<?php echo md5($_POST["strPassword"]) ?>' id='strPassword'/>
          </p>
          <p><input type='submit' name='submit'/></p>
          </form>          
          
          <p> </p></td>
	</tr>
    </table>	  </td>
<td> </td>
  </tr>

<tr>
    <td> </td>
    <td width="11%"><span class="bodyText">© 2008 brill <span class="style4"><a href="#" id="rw_email_contact">Contact Me</a>
          <script type="text/javascript">var _rwObsfuscatedHref0 = "mai";var _rwObsfuscatedHref1 = "lto";var _rwObsfuscatedHref2 = ":j.";var _rwObsfuscatedHref3 = "gil";var _rwObsfuscatedHref4 = "ber";var _rwObsfuscatedHref5 = "t-1";var _rwObsfuscatedHref6 = "@su";var _rwObsfuscatedHref7 = "nde";var _rwObsfuscatedHref8 = "rla";var _rwObsfuscatedHref9 = "nd.";var _rwObsfuscatedHref10 = "ac.";var _rwObsfuscatedHref11 = "uk";var _rwObsfuscatedHref = _rwObsfuscatedHref0+_rwObsfuscatedHref1+_rwObsfuscatedHref2+_rwObsfuscatedHref3+_rwObsfuscatedHref4+_rwObsfuscatedHref5+_rwObsfuscatedHref6+_rwObsfuscatedHref7+_rwObsfuscatedHref8+_rwObsfuscatedHref9+_rwObsfuscatedHref10+_rwObsfuscatedHref11; document.getElementById('rw_email_contact').href = _rwObsfuscatedHref;</script>
    </span></span></td>
    <td> </td>
<td> </td>
  </tr>
</table>
<div id="footer"><!-- Start Footer -->
<p class="bodyText"> </p>
</div>
<!-- End Footer -->
</body>
</html>

ILYAS415 · August 19, 2008

Okay so in your main script (not login.php) you would do something like....

if (!isset($_SESSION['Id'])){
die("You are not logged in!<bR><a href=\"login.php\">Click here to login</a>");
}

phakebrill · August 20, 2008

H ILYAS415,

Thanks for that. It worked a treat!

One other question though -- when I go to my login screen, the password field is full of masked characters...?

Every time a user logs in, they need to enter their username, and then delete everything in the password field before entering their password. Any idea how I can stop the password field showing this stuff please?

Thanks again for your help so far. Much appreciated!

Sign In

PHP Simple Security Question...

Recommended Posts

phakebrill

Link to comment

Share on other sites

ILYAS415

Link to comment

Share on other sites

phakebrill

Link to comment

Share on other sites

ILYAS415

Link to comment

Share on other sites

phakebrill

Link to comment

Share on other sites

Archived

Browse

Activity

Important Information