3raser Posted November 23, 2009 Share Posted November 23, 2009 On my site, http://domination.comyr.com/progress/login.php, it's accepting any password. Why is it doing that? <?php require "global_navigation.php"; ?> <?php session_start(); $username = $_POST['username']; $password = $_POST['password']; $secret_password = md5("password"); if ($_SESSION['username']) die("You're currently logged in already! <a href='index.php'>Return home</a>"); if (!$username) die(" <font face='arial' size='2'> <html><center><br /><br /><h3>Login</h3> <form action='login.php' method='POST'> <div class='box'>Username: <input type='text' name='username'></div> <div class='box'>Password: <input type='password' name='password'></div> <div class='box'><input type='submit' value='Login'></div> </form></center> "); //protection $before = array('(', ')', '^', '<', '>', '`', '*', '<script>', '</script>', ';DROP TABLE users;', 'users', 'DROP', 'TABLE'); $after = array('', '', '', '', '', '', '', '', '', '', '', '', ''); $output = str_replace($before, $after, $username); if ($username&&$password) { $connect = mysql_connect("$dbhost","$dbuser","$dbpassword") or die("Connection failed!"); mysql_select_db("$db") or die("Database fail!"); $query = mysql_query("SELECT * FROM users WHERE username='$output'"); $numrows = mysql_num_rows($query); if ($numrows!=0) { while ($row = mysql_fetch_assoc($query)) { $dbusername = $row['username']; $dbpassword = $row['password']; } if ($output==$dbusername&&$secret_password==$dbpassword) { echo "<div class='box'>Successfully logged in! <a href='index.php'>Return home</a></div>"; $_SESSION['username']=$output; } else echo "<div class='box'><span style='color:red'>Incorrect password!</span></div>"; } else die("<div class='box'><span style='color:red'>That user doesn't exist!</span></div>"); } else die("<div class='box'><span style='color:red'>Please enter a username and password</span></div>"); ?><?php require("global_footer.php") ?> Quote Link to comment Share on other sites More sharing options...
Brandon_R Posted November 23, 2009 Share Posted November 23, 2009 Should be $secret_password = md5($password); And not $secret_password = md5("password"); Quote Link to comment Share on other sites More sharing options...
3raser Posted November 23, 2009 Author Share Posted November 23, 2009 Thank you! It works! Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.