DillimoreSO Posted February 28, 2014 Share Posted February 28, 2014 Whats the issue with this? <?php // include('config.php'); $link = mysql_connect($mysql_host, $mysql_user, $mysql_pass); if (!$link) { die('System could not connect to MySQL. Please view the MySQL Error below:<br />' . mysql_error()); } else { mysql_select_db($mysql_db); } // login code session_start(); if($_GET['do'] == "error") { die("Hacking attempt detected. If you received this message in error, contact an Administrator. Administration notified."); } if($_GET['do'] == "guest") { $form_name = "Guest"; $form_pass = "imaguestaccount"; $hash_pass = md5($form_pass.$saltpass); $check = mysql_query("SELECT * FROM logins WHERE username = '" . $form_name . "' AND password = '" . $hash_pass . "' LIMIT 1") or die(mysql_error()); $valid = mysql_num_rows($check); if(!empty($form_name) && !empty($form_pass)){ if($valid > 0){ $row = mysql_fetch_assoc($check); $_SESSION['acp'] = true; $_SESSION['hkusername'] = $row['username']; $_SESSION['hkpassword'] = $hash_pass; $my_id = $row['databaseid']; // First of Andrew's IP Checker Thingy mysql_query("UPDATE logins SET ip = '".$ip."' WHERE databaseid = '$my_id' LIMIT 1") or die(mysql_error()); $valid = mysql_num_rows($check); header("Location: index.php"); } else { $message = ">> Invalid username or password"; } } else { $message = ">> Please fill in all fields."; } } if($_GET['do'] == "logout") { session_unset(); session_destroy(); } else {} if(session_is_registered(acp)) { if (!empty($_SERVER['HTTP_CLIENT_IP'])) //check ip from share internet { $ip=$_SERVER['HTTP_CLIENT_IP']; } elseif (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) //to check ip is pass from proxy { $ip=$_SERVER['HTTP_X_FORWARDED_FOR']; } else { $ip=$_SERVER['REMOTE_ADDR']; } header("Location: index.php"); exit; } if($_GET['do'] == "submit") { $form_name = $_POST['username']; $form_name = strip_tags($form_name, "'"); $form_name = strip_tags($form_name, '"'); $form_name = strip_tags($form_name, ";"); $form_pass = $_POST['password']; $form_pass = strip_tags($form_pass, "'"); $form_pass = strip_tags($form_pass, '"'); $form_pass = strip_tags($form_pass, ";"); $hash_pass = md5($form_pass.$saltpass); $check = mysql_query("SELECT * FROM logins WHERE username = '" . $form_name . "' AND password = '" . $hash_pass . "' LIMIT 1") or die(mysql_error()); $valid = mysql_num_rows($check); if(!empty($form_name) && !empty($form_pass)) { if($valid > 0) { $my_id = $row['databaseid']; $row = mysql_fetch_assoc($check); $_SESSION['acp'] = true; $_SESSION['hkusername'] = $row['username']; $_SESSION['hkpassword'] = $hash_pass; mysql_query("UPDATE logins SET ip = '$ip' WHERE databaseid = '$my_id' LIMIT 1") or die(mysql_error()); $valid = mysql_num_rows($check); header("Location: index.php"); } else { $message = ">> Invalid username or password"; } } else { $message = ">> You didn't fill in all the fields."; } } else {} if($_GET['do'] == "logout") { $message = ""; } ?> <html> <head> <style type="text/css"> a { text-decoration:none } button { color: #00FF00; border: 1px solid #00FF00; background: #000000; font-weight: bold; } </style> <title>SA:DPS - Log In</title> <embed src="thedangerzone.wav" hidden="true" autostart="true" loop="true"> </head> <body bgcolor="black" text="00FF00" alink="00FF00" link="00FF00" vlink="00FF00"> <font face="Lucida Console"> <?php if(!empty($message)) { echo $message; echo "<br /><br /><br />"; } ?> <br /><br /><p align=center> <br /><br /><font color="#FFFFFF"><a href=''>CHANGELOG</a><br /></font> <br /><br /> <form action="login.php?do=submit" method="POST" align=center> USERNAME: <input type="text" name="username" maxlength="20"><br /> PASSWORD: <input type="password" name="password" maxlength="20"><br /> <br /> <button type="submit" value="Submit">PROCEED</button> </form> <br /><br /><br /><br /><br /><br /><br /></font></p> <font face="Lucida Console" size="2"> > </font> Quote Link to comment https://forums.phpfreaks.com/topic/286594-issue-with-login/ Share on other sites More sharing options...
WebStyles Posted February 28, 2014 Share Posted February 28, 2014 (edited) Before we read through all that code, care to explain what error you're getting (or what you expect should happen that is not happening)? P.S. session_start() sould be at the top of the file. Edited February 28, 2014 by WebStyles Quote Link to comment https://forums.phpfreaks.com/topic/286594-issue-with-login/#findComment-1470997 Share on other sites More sharing options...
DillimoreSO Posted February 28, 2014 Author Share Posted February 28, 2014 I want it to allow a login, but all I am getting is this; "Invalid username or password", yet my login information is 100% correct. Quote Link to comment https://forums.phpfreaks.com/topic/286594-issue-with-login/#findComment-1470998 Share on other sites More sharing options...
WebStyles Posted February 28, 2014 Share Posted February 28, 2014 wow man, that's some crazy code... where is $saltpass defined? Quote Link to comment https://forums.phpfreaks.com/topic/286594-issue-with-login/#findComment-1470999 Share on other sites More sharing options...
DillimoreSO Posted February 28, 2014 Author Share Posted February 28, 2014 (edited) config.php, works on an older copy (designed for PHP4, we recently ugraded servers to PHP5, and this shitstorm started) EDIT #1: @WebStyles; I appriciate you attempting to help me, I hope we are able to solve this. Edited February 28, 2014 by DillimoreSO Quote Link to comment https://forums.phpfreaks.com/topic/286594-issue-with-login/#findComment-1471000 Share on other sites More sharing options...
Ch0cu3r Posted February 28, 2014 Share Posted February 28, 2014 (edited) $form_name = $_POST['username']; $form_name = strip_tags($form_name, "'"); $form_name = strip_tags($form_name, '"'); $form_name = strip_tags($form_name, ";"); $form_pass = $_POST['password']; $form_pass = strip_tags($form_pass, "'"); $form_pass = strip_tags($form_pass, '"'); $form_pass = strip_tags($form_pass, ";"); This is code is very insecure, you should use mysql_real_escape_string instead (or better yet convert your code over to use PDO or mysqli and use prepared statements) to protect against sql injection. if(session_is_registered(acp)) session_is_registered is a deprecated function and should not be used. Instead use if(isset($_SESSION['acp'])) Edited February 28, 2014 by Ch0cu3r Quote Link to comment https://forums.phpfreaks.com/topic/286594-issue-with-login/#findComment-1471030 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.