silkfire Posted June 29, 2011 Share Posted June 29, 2011 I have a simple login form with only one input value - the passphrase. But the logic is not working properly and I tried going thru all possible situtations but it just won't do right. [*]If we enter index.php for the first time ($_SESSION['logged_in'] is not set), then show the login page. [*]If we have a $_POST['pass'] and it's not correct, then show the login page again. [*]If we have a $_POST['pass'] and it is correct, then show the main page (www.domain.com/subfolder/). [*]If we're already logged in and come to login page - redirect to subfolder (main page). [*]If we enter subfolder directly and $_SESSION['logged_in'] is not set, then redirect to www.domain.com (my login page.) session_start(); if (!isset($_SESSION['logged_in']) && isset($_POST['pass']) && $_POST['pass'] != '66cfe7ad1ddf5795fb6ccf3577e8....') { // Show login page } else { $_SESSION['logged_in'] = true; header('Location: /subfolder/'); } Currently it fails at 2 and 4. Thanks in advance. Quote Link to comment https://forums.phpfreaks.com/topic/240731-login-logic-confusing-s/ Share on other sites More sharing options...
Maq Posted June 29, 2011 Share Posted June 29, 2011 Looks like you're using a hash, are you hashing the raw password before you compare? Quote Link to comment https://forums.phpfreaks.com/topic/240731-login-logic-confusing-s/#findComment-1236489 Share on other sites More sharing options...
silkfire Posted June 29, 2011 Author Share Posted June 29, 2011 Yes I'm hashing with SHA512 in JavaScript, but that has nothing to do with logic. Do you think you can help me? Quote Link to comment https://forums.phpfreaks.com/topic/240731-login-logic-confusing-s/#findComment-1236506 Share on other sites More sharing options...
Maq Posted June 29, 2011 Share Posted June 29, 2011 EDIT: You need a combination actually. Looking at it now. Quote Link to comment https://forums.phpfreaks.com/topic/240731-login-logic-confusing-s/#findComment-1236517 Share on other sites More sharing options...
silkfire Posted June 29, 2011 Author Share Posted June 29, 2011 The passphrase is static and I've already generated it so I don't need to use the hash function in PHP... Quote Link to comment https://forums.phpfreaks.com/topic/240731-login-logic-confusing-s/#findComment-1236524 Share on other sites More sharing options...
xyph Posted June 29, 2011 Share Posted June 29, 2011 It's kinda neat hashing in JavaScript before sending it. You don't have to worry about someone stealing a raw password if you don't have SSL Simple logic error. I'll take out the redundant info. if ( !isset($_SESSION['logged_in']) || ( isset($_POST['pass']) && $_POST['pass'] != '66cfe7ad1ddf5795fb6ccf3577e8....') ) { Quote Link to comment https://forums.phpfreaks.com/topic/240731-login-logic-confusing-s/#findComment-1236568 Share on other sites More sharing options...
silkfire Posted June 29, 2011 Author Share Posted June 29, 2011 It is truly neat Do you really need those paranthesis? I think && has precedence before ||. Quote Link to comment https://forums.phpfreaks.com/topic/240731-login-logic-confusing-s/#findComment-1236575 Share on other sites More sharing options...
xyph Posted June 29, 2011 Share Posted June 29, 2011 Use the parenthesis Quote Link to comment https://forums.phpfreaks.com/topic/240731-login-logic-confusing-s/#findComment-1236597 Share on other sites More sharing options...
silkfire Posted June 30, 2011 Author Share Posted June 30, 2011 Sorry xyph it didn't work =/. Now I can't login. I know why - if the first part of the || is true - then everything is true. If I'm not logged in, then it will always show me the login page even if I've got correct password. While POSTing, I'm still not logged in, remember. Help me, this is pretty urgent. Quote Link to comment https://forums.phpfreaks.com/topic/240731-login-logic-confusing-s/#findComment-1236707 Share on other sites More sharing options...
EdwinPaul Posted June 30, 2011 Share Posted June 30, 2011 Maybe this will help: <?php session_start(); if ((isset($_SESSION['logged_in']) && $_SESSION['logged_in'] === TRUE){ header('Location: /subfolder/'); exit(); } $_SESSION['logged_in'] = FALSE; if($_SERVER['REQUEST_METHOD'] == 'POST'){ if (isset($_POST['pass']){ if ($_POST['pass'] == 'opensesame'){ // $_SESSION['logged_in'] = TRUE; header('Location: /subfolder/'); exit(); } } } ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Untitled Document</title> </head> <body> <!-- put your login-form here with action="" --> </body> </html> Note: $_POST['pass'] is NOT hashed ! Quote Link to comment https://forums.phpfreaks.com/topic/240731-login-logic-confusing-s/#findComment-1236714 Share on other sites More sharing options...
xyph Posted June 30, 2011 Share Posted June 30, 2011 Yeah, my mistake. It's possible to get your logic, but it's much easier to rewrite your logic like this session_start(); if( (isset($_POST['pass']) && $_POST['pass'] == 'pass') || isset($_SESSION['logged_in']) ) { $_SESSION['logged_in'] = true; echo 'redirect here'; } else { echo '<form action="" method="post"><input type="text" name="pass"><input type="submit"></form>'; } Quote Link to comment https://forums.phpfreaks.com/topic/240731-login-logic-confusing-s/#findComment-1236717 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.