[SOLVED] LOGIN

[sstangle73]

ahhhhh!

my login allows you to login with for example 'steven' when your username is 'Steven' this throws off some things. how do i make it so when they login its an exact match

 

also the cookies dont set if anyone wants to take a stab at that!

 

<?php

function checkLogin(){
   /* Check if user has been remembered */
   if(isset($_COOKIE['cookname']) && isset($_COOKIE['cookpass'])){
      $_SESSION['username'] = $_COOKIE['cookname'];
      $_SESSION['password'] = $_COOKIE['cookpass'];
      $_SESSION['name'] = $_COOKIE['name'];
      $_SESSION['email'] = $_COOKIE['email'];
      $_SESSION['bdate'] = $_COOKIE['bdate'];
      $_SESSION['sex'] = $_COOKIE['sex'];
      $_SESSION['city'] = $_COOKIE['city'];
      $_SESSION['state'] = $_COOKIE['state'];
      $_SESSION['level'] = $_COOKIE['level'];
      $_SESSION['ID'] = $_COOKIE['ID'];
      $_SESSION['dname'] = $_COOKIE['dname'];
      $_SESSION['quote'] = $_COOKIE['quote'];
      $_SESSION['color'] = $_COOKIE['color'];
   }

   /* Username and password have been set */
   if(isset($_SESSION['username']) && isset($_SESSION['password'])){
      /* Confirm that username and password are valid */
      if(confirmUser($_SESSION['username'], $_SESSION['password']) != 0){
         /* Variables are incorrect, user not logged in */
         unset($_SESSION['username']);
         unset($_SESSION['password']);
 unset($_SESSION['name']);
 unset($_SESSION['email']);
 unset($_SESSION['bdate']);
 unset($_SESSION['sex']);
 unset($_SESSION['city']);
 unset($_SESSION['state']);
 unset($_SESSION['level']);
 unset($_SESSION['ID']);
 unset($_SESSION['dname']);
 unset($_SESSION['quote']);
 unset($_SESSION['color']);
         return false;
      }
      return true;
   }
   /* User not logged in */
   else{
      return false;
   }
}
function displayLogin(){
   global $logged_in;
   if($logged_in){
      echo "<h1>Logged In!</h1>";
      echo "Welcome <b>$_SESSION[username]</b>, you are logged in. <a href=\"logout.php\">Logout</a>";
   }
   else{
?>

<h1>Login</h1>
<form name=v1 action="" method="post">
<table align="center" border="0" cellspacing="0" cellpadding="3">
<tr><td>Username:</td><td><input type="text" name="user" maxlength="30"></td></tr>
<tr><td>Password:</td><td><input type="password" name="pass" maxlength="30"></td></tr>
<tr><td colspan="2" align="left"><input type="checkbox" name="remember">
<font size="2">Remember me next time</font></td></tr>
<tr><td colspan="2" align="center"><input type="submit" name="sublogin" value="Login"></td></tr>
<tr><td colspan="2" align="center" bgcolor="#000000"><a href="register.php"><font color="#FFFFFF"><b>REGISTER!</b></font></a></td></tr>
<tr><td> </td></tr>
<tr><td colspan="2" align="center" bgcolor="#000000"><a href="forgot.php"><font color="#FFFFFF"><b>Forgot Password</b></font></a></td></tr>
</table>
</form>

<?php
   }
}
function confirmUser($username, $password){
   global $conn;
   /* Add slashes if necessary (for query) */
   if(!get_magic_quotes_gpc()) {
$username = addslashes($username);
   }

   /* Verify that user is in database */
   $q = "select password from users where username = '$username'";
   $result = mysql_query($q,$conn);
   if(!$result || (mysql_numrows($result) < 1)){
      return 1; //Indicates username failure
   }

   /* Retrieve password from result, strip slashes */
   $dbarray = mysql_fetch_array($result);
   $dbarray['password']  = stripslashes($dbarray['password']);
   $password = stripslashes($password);

   /* Validate that password is correct */
   if($password == $dbarray['password']){
      return 0; //Success! Username and password confirmed
   }
   else{
      return 2; //Indicates password failure
   }
}

/**
* checkLogin - Checks if the user has already previously
* logged in, and a session with the user has already been
* established. Also checks to see if user has been remembered.
* If so, the database is queried to make sure of the user's 
* authenticity. Returns true if the user has logged in.
*/

/**
* Determines whether or not to display the login
* form or to show the user that he is logged in
* based on if the session variables are set.
*/



/**
* Checks to see if the user has submitted his
* username and password through the login form,
* if so, checks authenticity in database and
* creates session.
*/
if(isset($_POST['sublogin'])){
   /* Check that all fields were typed in */
   if(!$_POST['user'] || !$_POST['pass']){
      die('You didn\'t fill in a required field.');
   }
   /* Spruce up username, check length */
   $_POST['user'] = trim($_POST['user']);
   if(strlen($_POST['user']) > 30){
      die("Sorry, the username is longer than 30 characters, please shorten it.");
   }

   /* Checks that username is in database and password is correct */
   $md5pass = md5($_POST['pass']);
   $result = confirmUser($_POST['user'], $md5pass);

   /* Check error codes */
   if($result == 1){
      die('That username doesn\'t exist in our database.');
   }
   else if($result == 2){
      die('Incorrect password, please try again.');
   }

   /* Username and password correct, register session variables */
   $_POST['user'] = stripslashes($_POST['user']);
   $_SESSION['username'] = $_POST['user'];
   $_SESSION['password'] = $md5pass;

$user=$_POST[user];
$query="SELECT * FROM users WHERE `username` = '$user' ";
$result=mysql_query($query);
while($array=mysql_fetch_assoc($result)){
$_SESSION['name']=$array['name'];
$_SESSION['email']=$array['email'];
$_SESSION['bdate']=$array['bdate'];
$_SESSION['sex']=$array['sex'];
$_SESSION['city']=$array['city'];
$_SESSION['state']=$array['state'];
$_SESSION['level']=$array['level'];
$_SESSION['ID']=$array['ID'];
$_SESSION['dname']=$array['dname'];
$_SESSION['quote']=$array['quote'];
$_SESSION['color']=$array['color'];

   /**
    * This is the cool part: the user has requested that we remember that
    * he's logged in, so we set two cookies. One to hold his username,
    * and one to hold his md5 encrypted password. We set them both to
    * expire in 100 days. Now, next time he comes to our site, we will
    * log him in automatically.
    */
   if(isset($_POST['remember'])){
      setcookie("cookname", $_SESSION['username'], time()+60*60*24*365, "/");
      setcookie("cookpass", $_SESSION['password'], time()+60*60*24*365, "/");
      setcookie("name", $_SESSION['name'], time()+60*60*24*365, "/");
      setcookie("email", $_SESSION['email'], time()+60*60*24*365, "/");
      setcookie("bdate", $_SESSION['bdate'], time()+60*60*24*365, "/");
      setcookie("sex", $_SESSION['sex'], time()+60*60*24*365, "/");
      setcookie("city", $_SESSION['city'], time()+60*60*24*365, "/");
      setcookie("state", $_SESSION['state'], time()+60*60*24*365, "/");
      setcookie("level", $_SESSION['level'], time()+60*60*24*365, "/");
      setcookie("ID", $_SESSION['ID'], time()+60*60*24*365, "/");
      setcookie("dname", $_SESSION['dname'], time()+60*60*24*365, "/");
      setcookie("quote", $_SESSION['quote'], time()+60*60*24*365, "/");
      setcookie("color", $_SESSION['color'], time()+60*60*24*365, "/");
   }

   /* Quick self-redirect to avoid resending data on refresh */
   echo "<meta http-equiv=\"Refresh\" content=\"0;url=$HTTP_SERVER_VARS[php_SELF]\">";
   return;
}
}
/* Sets the value of the logged_in variable, which can be used in your code */
$logged_in = checkLogin();
?>

[nathanmaxsonadil]

why do you use cookies instead of sessions?

[sstangle73]

i use both cookies if they want to be remembered next time they come back session for now if the cookies are set next time they come back it will set the sessions again

[sstangle73]

neone?

[unidox]

Hey steven! WHat things does it throw off?

[kathas]

Besides the following with which i agree

Hey steven! WHat things does it throw off?

 

You dont keep a list of users in a db, do u? Because i dont see you validating the users from there...

That means you cant give privileges to users because everyone can login as everyone...

[sstangle73]

it throws off profiles. and i use dbs? where else would i validate from?and everyone cant login as everyone?

[sstangle73]

anyone?

[chronister]

Well, I would control how the username gets entered in the db. Use some functions like strtolower, or ucfirst to ensure that the usernames are either all lowercase no matter how the user entered it or it's first letter is upper case.

 

String manipulation and controlling the input / output of data is key to PHP.

 

 

nate

[sstangle73]

yes i understand that but how do you check that its a exact match to the db

i login as Steven i want it to make sure Stevens in the db if i login as steven i want it to fail stevens not in the db Steven is

[chronister]

When a user creates their username, run it through strtolower() before inserting into the db. That way you never need to mess with how the user enters it.

 

They never need to know that the created the username Bob, but its actually bob ... passwords I would let them do it as they want as part of security may include uppercase letters.

 

I may be wrong ,but I don't think mysql is case sensitive.

[sstangle73]

???

[chronister]

<?php
$test='Steven';

if('steven'==$test)
{
echo 'They match';
}
else
{
echo 'Dont Match';
}
?>

 

Returns Don't Match

 

Mysql may not be case sensitive, but PHP is. So just incorporate an if / else statement in there and plug in the proper variables.

 

Nate

[sstangle73]

i do that and it still passes

 

function confirmUser($username, $password){
$username == $username1;

   global $conn;
$query="SELECT * FROM users WHERE username = '$username1' LIMIT 1"; 
$result=mysql_query($query); 
while($array=mysql_fetch_assoc($result)){
$username2 == $array['username'];
}
   /* Add slashes if necessary (for query) */
   if(!get_magic_quotes_gpc()) {
$username = addslashes($username);
   }

   /* Verify that user is in database */
   $q = "select password from users where username = '$username'";
   $result = mysql_query($q,$conn);
   if(!$result || (mysql_numrows($result) < 1)){
   if($username1 != $username2){
      return 1; //Indicates username failure
   }
   }
   /* Retrieve password from result, strip slashes */
   $dbarray = mysql_fetch_array($result);
   $dbarray['password']  = stripslashes($dbarray['password']);
   $password = stripslashes($password);
   /* Validate that password is correct */
   if($password == $dbarray['password']){
      return 0; //Success! Username and password confirmed
   }
   else{
      return 2; //Indicates password failure
   }
}

[chronister]

Then echo the 2 usernames. This is not the same as this. Chances are you'll see that they are equal

 

What is the 2nd line $username==$username1?? Your using the comparison operator in that statement.

 

Why are you checking the username and password in a seperate step?? You should run 1 query to check both

 

$query="SELECT * FROM users WHERE username='$username' && password='$password'";

 

 

Nate

[sstangle73]

Thanks nate case sensitive works now just gotta figure out them cookies

final function:

function confirmUser($username, $password){
$query="SELECT * FROM users WHERE username='$username'";  
$result=mysql_query($query); 
while($array=mysql_fetch_assoc($result)){
$uname=$array['username'];
}
if($uname==$username){
   global $conn;
   /* Add slashes if necessary (for query) */
   if(!get_magic_quotes_gpc()) {
$username = addslashes($username);
   }

   /* Verify that user is in database */
   $q = "select password from users where username = '$username'";
   $result = mysql_query($q,$conn);
   if(!$result || (mysql_numrows($result) < 1)){
      return 1; //Indicates username failure
   }

   /* Retrieve password from result, strip slashes */
   $dbarray = mysql_fetch_array($result);
   $dbarray['password']  = stripslashes($dbarray['password']);
   $password = stripslashes($password);

   /* Validate that password is correct */
   if($password == $dbarray['password']){
      return 0; //Success! Username and password confirmed
   }
   else{
      return 2; //Indicates password failure
   }
}
return 3; //case fail
}

 

yeah i know i didnt combind the querys but idc

 

 

if anyone can figure out theese cookies i would be realllly happy!

 

 if(isset($_POST['remember'])){
      setcookie("cookname", $_SESSION['username'], time()+60*60*24*365, "/");
      setcookie("cookpass", $_SESSION['password'], time()+60*60*24*365, "/");
      setcookie("name", $_SESSION['name'], time()+60*60*24*365, "/");
      setcookie("email", $_SESSION['email'], time()+60*60*24*365, "/");
      setcookie("bdate", $_SESSION['bdate'], time()+60*60*24*365, "/");
      setcookie("sex", $_SESSION['sex'], time()+60*60*24*365, "/");
      setcookie("city", $_SESSION['city'], time()+60*60*24*365, "/");
      setcookie("state", $_SESSION['state'], time()+60*60*24*365, "/");
      setcookie("level", $_SESSION['level'], time()+60*60*24*365, "/");
      setcookie("ID", $_SESSION['ID'], time()+60*60*24*365, "/");
      setcookie("dname", $_SESSION['dname'], time()+60*60*24*365, "/");
      setcookie("quote", $_SESSION['quote'], time()+60*60*24*365, "/");
      setcookie("color", $_SESSION['color'], time()+60*60*24*365, "/");
   }