[SOLVED] Login Script Security

[jbingman]

Hi, I have a login script and i would like to know how to make it more secure.

<?
include('/home/fresnosa/public_html/includes/dbConfig.php');
if($_GET['do'] == 'check')
{
$username = $_POST['username'];
$password = $_POST['password'];

$conn = mysql_connect($host, $user, $pass)
  or die('Could not connect: ' . mysql_error());

//select database
mysql_select_db($db, $conn) or die('Could not select database');
$result = mysql_query("SELECT * FROM users WHERE user='$username'") or die(mysql_error()); 
$row = mysql_fetch_array( $result );

if($row['user'] == '')
{
echo "<b>username or password is incorrect</b><br>";
}
else
{
if($row['password'] == $password)
{
$_SESSION['logged'] = "true";
$_SESSION['user'] = $username;
header("location: admin.php");

}
else
{
echo "<b>username or password is incorrect</b><br>";
}
}

}
?>

 

 

[MadTechie]

holly hell.. filter the username for starter...

 

    // incase you have magic quotes on
    if (get_magic_quotes_gpc()) {
        $value = stripslashes($value);
    } 
$username = mysql_real_escape_string($_POST['username']);

 

EDIT: Updated (incase of magic quotes)

 

ALSO, your password should be hashed (readup on MD5)

 

basic idea, when they enter the password you use $newpass = MD5($pass); then do the same when you verify it, (also read up on MD5+SALT) i'm sure other here will give to the info as well

[jbingman]

where would i put that. what does that do?

[MadTechie]

it basically filters, the input.. put it this way.. without the filter i could (without a user account) drop (remove) all your databases from your site..

 

Full code,

 

<?
include('/home/fresnosa/public_html/includes/dbConfig.php');
if($_GET['do'] == 'check')
{
//added
    // incase you have magic quotes on
    if (get_magic_quotes_gpc()) {
        $value = stripslashes($value);
    } 
//updated
$username = mysql_real_escape_string($_POST['username']);

$password = $_POST['password'];

$conn = mysql_connect($host, $user, $pass)
   or die('Could not connect: ' . mysql_error());

//select database
mysql_select_db($db, $conn) or die('Could not select database');
$result = mysql_query("SELECT * FROM users WHERE user='$username'") or die(mysql_error()); 
$row = mysql_fetch_array( $result );

if($row['user'] == '')
{
echo "<b>username or password is incorrect</b><br>";
}
else
{
if($row['password'] == $password)
{
$_SESSION['logged'] = "true";
$_SESSION['user'] = $username;
header("location: admin.php");

}
else
{
echo "<b>username or password is incorrect</b><br>";
}
}

}
?>

[jbingman]

everything else works but i cant find how to incorporate md5+salt and the msyql_real_escape_string() function isn't working.

[MadTechie]

what do you mean by isn't working ?

error message?

[jbingman]

yes it gives me this:

Fatal error: Call to undefined function msql_real_escape_string() in /home/fresnosa/public_html/admin/login.php on line 49

 

[darkfreaks]

try

 

<?php

$username= $_POST[username];

$username= mysql_real_escape_string($username);
?>

 

this should work

[Aureole]

You made a typo, you missed the "y" on mysql_real_escape_string() ...

[darkfreaks]

LOL

[jbingman]

yeah well either way i still get it if i spell it right, now i get:

arning: mysql_real_escape_string() [function.mysql-real-escape-string]: Access denied for user 'fresnosa'@'localhost' (using password: NO) in /home/fresnosa/public_html/admin/login.php on line 50

Warning: mysql_real_escape_string() [function.mysql-real-escape-string]: A link to the server could not be established in /home/fresnosa/public_html/admin/login.php on line 50

 

[MadTechie]

move the code down

//updated - MOVED!
$username = mysql_real_escape_string($_POST['username']);
$password = $_POST['password'];

 

 

full code

<?
include('/home/fresnosa/public_html/includes/dbConfig.php');
if($_GET['do'] == 'check')
{
//added
    // incase you have magic quotes on
    if (get_magic_quotes_gpc()) {
        $value = stripslashes($value);
    } 

$conn = mysql_connect($host, $user, $pass)
   or die('Could not connect: ' . mysql_error());

//select database
mysql_select_db($db, $conn) or die('Could not select database');

//updated - MOVED!
$username = mysql_real_escape_string($_POST['username']);
$password = $_POST['password'];

$result = mysql_query("SELECT * FROM users WHERE user='$username'") or die(mysql_error()); 
$row = mysql_fetch_array( $result );

if($row['user'] == '')
{
echo "<b>username or password is incorrect</b><br>";
}
else
{
if($row['password'] == $password)
{
$_SESSION['logged'] = "true";
$_SESSION['user'] = $username;
header("location: admin.php");

}
else
{
echo "<b>username or password is incorrect</b><br>";
}
}

}
?>

[jbingman]

oh perfect that works thanks for you help!