3raser Posted November 23, 2009 Share Posted November 23, 2009 On my site, http://domination.comyr.com/progress/login.php, it's accepting any password. Why is it doing that? <?php require "global_navigation.php"; ?> <?php session_start(); $username = $_POST['username']; $password = $_POST['password']; $secret_password = md5("password"); if ($_SESSION['username']) die("You're currently logged in already! <a href='index.php'>Return home</a>"); if (!$username) die(" <font face='arial' size='2'> <html><center><br /><br /><h3>Login</h3> <form action='login.php' method='POST'> <div class='box'>Username: <input type='text' name='username'></div> <div class='box'>Password: <input type='password' name='password'></div> <div class='box'><input type='submit' value='Login'></div> </form></center> "); //protection $before = array('(', ')', '^', '<', '>', '`', '*', '<script>', '</script>', ';DROP TABLE users;', 'users', 'DROP', 'TABLE'); $after = array('', '', '', '', '', '', '', '', '', '', '', '', ''); $output = str_replace($before, $after, $username); if ($username&&$password) { $connect = mysql_connect("$dbhost","$dbuser","$dbpassword") or die("Connection failed!"); mysql_select_db("$db") or die("Database fail!"); $query = mysql_query("SELECT * FROM users WHERE username='$output'"); $numrows = mysql_num_rows($query); if ($numrows!=0) { while ($row = mysql_fetch_assoc($query)) { $dbusername = $row['username']; $dbpassword = $row['password']; } if ($output==$dbusername&&$secret_password==$dbpassword) { echo "<div class='box'>Successfully logged in! <a href='index.php'>Return home</a></div>"; $_SESSION['username']=$output; } else echo "<div class='box'><span style='color:red'>Incorrect password!</span></div>"; } else die("<div class='box'><span style='color:red'>That user doesn't exist!</span></div>"); } else die("<div class='box'><span style='color:red'>Please enter a username and password</span></div>"); ?><?php require("global_footer.php") ?> Link to comment https://forums.phpfreaks.com/topic/182565-md5-accepts-any-password-why/ Share on other sites More sharing options...
Brandon_R Posted November 23, 2009 Share Posted November 23, 2009 Should be $secret_password = md5($password); And not $secret_password = md5("password"); Link to comment https://forums.phpfreaks.com/topic/182565-md5-accepts-any-password-why/#findComment-963570 Share on other sites More sharing options...
3raser Posted November 23, 2009 Author Share Posted November 23, 2009 Thank you! It works! Link to comment https://forums.phpfreaks.com/topic/182565-md5-accepts-any-password-why/#findComment-963571 Share on other sites More sharing options...
Recommended Posts
Archived
This topic is now archived and is closed to further replies.