Help with login script code

[netpumber]

Hello i was watching

video on how to create a login script in php and i thought to use it.

 

So here is the code :

 

<?php

include("config.php");

class login
{
	private $_id;
	private $_username;
	private $_password;
	private $_passmd5;

	private $_errors;
	private $_access;
	private $_login;
	private $_token;
	

	public function __construct()
	{
		$this->_errors 	= 	array();
		$this->_login 	= 	isset($_POST['login']) ? 1 : 0 ;
		$this->_access 	= 	0;
		$this->_token 	= 	($this->_login) ? $_POST['token'] : $_SESSION['token'];

		$this->_id 	= 	0;
		$this->_username	= 	($this->_login) ? $this->filter($_POST['username']) : $this->$_SESSION['username'];
		$this->_password	= 	($this->_login) ? $this->filter($_POST['password']) : '';
		$this->_passmd5		= 	($this->_login) ? md5($this->_password) : $this->$_SESSION['password'];

	}

	public function isLoggedIn()
	{
		($this->_login) ? $this->verifyPost() : $this->verifySession();
		return $this->_access;
	}

	public function filter($var)
	{
		return preg_replace('/[^a-zA-Z0-9]/', '', $var);
	}

	public function verifyPost()
	{
		try
		{
			if(!$this->isTokenValid())
				throw new Exception("Invalid Form Submition");

			if(!$this->isDataValid())
				throw new Exception("Invalid Form Data");

			if(!$this->verifyDatabase())
				throw new Exception("Invalid Username/Password");

		$this->_access = 1;
		$this->registerSession();				
		}

		catch(Exception $e)
		{
			$this->_errors[] = $e->getMessage();
		}
	}

	public function verifySession()
	{
		if($this->sessionExist() && $this->verifyDatabase())
			$this->_access = 1;
	}

	public function verifyDatabase()
	{
		init_mysql();

		$data = mysql_query("SELECT user_id FROM users WHERE user_name = '{$this->_username}' AND user_password='{$this->_passmd5}'");

		if(mysql_num_rows($data))
		{
			$row = mysql_fetch_assoc($data);
			$this->_id = $row['user_id'];
			return true;
		}
		else
		{
			return false;
		}
	
	}

	public function isDataValid()
	{
		return preg_match('/^[a-zA-Z0-9]{5,12}$/', $this->_username) && preg_match('/^[a-zA-Z0-9]{5,12}$/', $this->_password) ? 1 : 0 ;
	}

	public function isTokenValid()
	{
		return (!isset($_SESSION['token']) || $this->_token != $_SESSION['token']) ? 0 : 1;
	}

	public function registerSession()
	{
		$_SESSION['ID'] 		= $this->_id;
		$_SESSION['username'] 	= $this->_username;
		$_SESSION['password']	= $this->_passmd5;
	}

	public function sessionExist()
	{
		return (isset($_SESSION['username']) && isset($_SESSION['password'])) ? 1 : 0;
	}

	public function showErrors()
	{
		echo "<h3>Errors</h3>";

		foreach ($this->_errors as $key => $value) {
			echo $value . "<br>";
		}
	}

}


?>

 

 

Here is the code of login.php

 

<?php
session_start();

$token = $_SESSION['token'] = md5(uniqid(mt_rand(),true));

if(isset($_POST['login']))
{
	include('classes/class.login.php');

	$login = new Login;

	if($login->isLoggedIn())
		header('location: op-index.php');
	else
		$login->showErrors();	
}
?> 

 

 

But it seems that i have a problem with isTokenValid() Function.

 

 

return (!isset($_SESSION['token']) || $this->_token != $_SESSION['token']) ? 0 : 1;
 

If i try to login it returns me this error Invalid Form Submition but i cannot understand why.

 

So if i change the above code into this 

 

 

return (!isset($_SESSION['token'])  ? 0 : 1;
 

everything works like a charm but when is the || operator it returns false.

 

Can someone image why this could happen ?

 

Also $this->_token will be always different from $_SESSION['token'] because the $token variable changes after the form submition.

Edited March 18, 2013 by netpumber

[gergy008]

Change

return (!isset($_SESSION['token']) || $this->_token != $_SESSION['token']) ? 0 : 1;

 

to

 

return (!isset($_SESSION['token']) || $this->_token != $_SESSION['token']) ? 1 : 0;
 

 

And see what happens

[netpumber]

Yes with your change its working but its doing the opposite thing. I mean that if the $_SESSION['token'] doesn't be set or its different from $_token , then the function returns true. Something we don't want to (i think). 

[netpumber]

Any Idea ?