Home | Community | Message Board


This site includes paid links. Please support our sponsors.


Welcome to the Shroomery Message Board! You are experiencing a small sample of what the site has to offer. Please login or register to post messages and view our exclusive members-only content. You'll gain access to additional forums, file attachments, board customizations, encrypted private messages, and much more!

Shop: North Spore Injection Grain Bag   Myyco.com Golden Teacher Liquid Culture For Sale

Jump to first unread post Pages: 1
PHP Problem
    #6637959 -

Hi all,

Not sure if it's really appropriate to post this here but judging by the complexity of the site I'm sure somebody can help me.

I am currently playing around with PHP and MySQL trying to create a simple (yeah right...) login script. I have been doing a lot of reading up and trying parts from numerous tutorials, this is the closest I've got.

Alas there seems to be a problem.. :sad:

Quoting Firefox the problem seems to be

Quote:
Firefox has detected that the server is redirecting the request for this address in a way that will never complete.



Seems self-explanatory I admit but when you don't know what you're looking for it's quite difficult to fix it.

Anyway here's the code I have:

Code:
<?php

$username = $_POST["username"];
$password = $_POST["password"];

$members = mysql_connect("localhost", "webuser", "remote213");
if(!$members)
{
echo "<p>Unable to connect...?</p>";
}

mysql_select_db("uremote", $members);


$recieve = sprintf("SELECT * FROM uremoteusers WHERE Username='%s' AND Password='%s'", mysql_real_escape_string($username), mysql_real_escape_string($password));
$query = mysql_query($recieve);

session_start();

if($rows = mysql_num_rows($query))
{
session_register("user");
session_register("pass");

$pass = $password;
$user = $_SESSION["user"] = $username;
header("location: http://localhost/index.php");
}
else
{
@session_destroy();
header("location: http://localhost/login.php");
}

?>



Any suggestions, pointers or condemnations welcome. Also, can anybody recommend a nice, by nice I mean easy to use, PHP editor? At the moment I'm using Notepad  and for someone who is accustomed to VB pointing out errors in syntax it's proving a little arduous.

Thanks


--------------------
The punishment which the wise suffer, who refuse to take part in government, is to live under the government of worse men.

Extras: Filter Print Post Top
Re: PHP Problem [Re: st0nedphucker]
    #6638085 -

That error means your script keeps redirecting to itself. The code above, is it saved as login.php or index.php? If so, that's your problem. It should be something like 'processlogin.php' and not redirect to itself.

I use and (strongly) recommend UltraEdit as a code editor, but if you want a full-featured IDE like Visual Studio then Zend Studio might be worth a look.

Extras: Filter Print Post Top
Re: PHP Problem [Re: Ythan]
    #6638796 -

Quote:
Here's my login script:

//--- If username and password are being submitted from form, check against DB ---/
if (isset($_POST['txtUserName']) && isset($_POST['txtPassword'])) {
// select all entries (1) from database where username and password match
$login_query = "SELECT * FROM `t_users` WHERE user_id = '" . $_POST['txtUserName'] . "' AND user_password = '" . $_POST['txtPassword'] . "'";
$login_result = mysql_query($login_query);

// if there are more than 0 results, set session variables.
if (mysql_num_rows($login_result) > 0) {
$r = mysql_fetch_array($login_result);
$_SESSION['user_id'] = $r['user_id'];
$_SESSION['user_flag'] = $r['user_flag'];
$_SESSION['user_email'] = $r['user_email'];
$_SESSION['user_password'] = $r['user_password'];

// user_flag is a string, but it needs to be parsed into a
// associative array.
$strFlags = $_SESSION['user_flag'];
$arrFlags = explodeAssoc(":",$strFlags);
// the variable uf_status now holds value for user status
$_SESSION['uf_status'] = $arrFlags['status'];

// else, unset all variables.
} else {
unset($_SESSION['user_id']);
unset($_SESSION['user_flag']);
}
}
//--- End: If username and password are being submitted from form, check against DB ---/



obviously, im using it for a few different things, and my database structure is diff, but im not familiar with the sprintf function u were using, and i recommend this method (it requires you to setup a session). Put this at the very top of the PHP file:

Quote:
//--- Setup the Session ---/
$expireTime = 60*60*24*30; // 30 days
session_set_cookie_params($expireTime); // set cookie to expireTime
session_start(); // Start session and set variable.
//--- End: Setup the Session ---/




Once u have that working, just use member-only content like this:

Quote:
<? if (isset($_SESSION['user_id'])) { ?>
PUT HTML HERE
<? } ?>




--------------------
No statements made in any post or message by myself should be construed to mean that I am now, or have ever been, participating in or considering participation in any activities in violation of any local, state, or federal laws. All posts are works of fiction.

Extras: Filter Print Post Top
Re: PHP Problem [Re: kotik]
    #6640354 -

Yum, a hackers dream... no escaping of the variables used in the SQL select leaves the code vulnerable to an SQL injection attack.

As Ythan said, the error is caused by a page redirecting to itself. I usually break things apart into two files... a "login" page and a "welcome" page. The welcome page checks to see if the user is authenticated and forwards them onwards if they are, or backwards if they are not. (The welcome page doesn't actually display anything. It only redirects.) The login page submits the login data (via form, etc) to the welcome page. This breaks the redirect to self loop/error.

Be sure you lookup how SQL injection attacks work and fix your code before going public with it. Imagine what would happen if somebody entered the password of "abc'; drop table t_users; --" as an example...


--------------------
Just another spore in the wind.

Extras: Filter Print Post Top
Re: PHP Problem [Re: Seuss]
    #6641301 -

Thanks all for your replies, I renamed login.php to loginprocess.php and viola it worked! :wink: I really think I'm going to have to go back to basics and do a lot of reading up.

I have noticed a couple of sites describing SQL injection attacks and will read up on them. Currently my site is simply for MySQL & PHP testing, I'm not storing anything remotely useful, so I am not too concerned. Would restricting the IP's allowed to connect to the webserver prevent such an attack?


--------------------
The punishment which the wise suffer, who refuse to take part in government, is to live under the government of worse men.

Extras: Filter Print Post Top
Re: PHP Problem [Re: st0nedphucker]
    #6641477 -

Seuss was talking to kotik, your use of mysql_real_escape_string should protect you from injections. Restricting access by IP would be an effective way of securing the script, but it might not be necessary in this case.

Extras: Filter Print Post Top
Re: PHP Problem [Re: Ythan]
    #6642733 -

yikes!

thanks for that.


--------------------
No statements made in any post or message by myself should be construed to mean that I am now, or have ever been, participating in or considering participation in any activities in violation of any local, state, or federal laws. All posts are works of fiction.

Extras: Filter Print Post Top
Re: PHP Problem [Re: kotik]
    #6644159 -

> Seuss was talking to kotik

To be fair, I was pretty confusing... I started answering to Kotik, the switched to the first post, without context, then back to Kotik...

> thanks for that.

Very welcome.


--------------------
Just another spore in the wind.

Extras: Filter Print Post Top
Jump to top Pages: 1

Shop: North Spore Injection Grain Bag   Myyco.com Golden Teacher Liquid Culture For Sale


Similar ThreadsPosterViewsRepliesLast post
* Bypassing firewalls / redirecting ports and shit. T0aD 1,644 8 09/13/03 05:35 AM
by T0aD
* automated subdomain redirection automanM 322 0 02/03/06 06:01 AM
by automan
* Router-Modem Problem... Help??? Shroomerious 1,058 3 09/25/04 05:12 PM
by discoabe
* The UK has 1.5 million of them..The US is NEXT!!! Lana 2,167 6 08/16/01 08:21 AM
by Phyl
* Problem with mozilla firefox barfightlard 1,109 7 04/17/05 12:57 PM
by BrAiN
* Problems with Samba ummikko 2,558 5 05/09/05 10:24 AM
by ummikko
* The Blackberry battle: Canada Officially Endorses Stealing US Patents
( 1 2 3 all )
Catalysis 3,767 42 01/30/05 11:12 PM
by kadakuda
* Why do I keep having this problem? User Exists 1,999 12 08/22/03 11:08 AM
by User Exists

Extra information
You cannot start new topics / You cannot reply to topics
HTML is disabled / BBCode is enabled
Moderator: trendal, automan, Northerner
1,317 topic views. 0 members, 33 guests and 1 web crawlers are browsing this forum.
[ Show Images Only | Sort by Score | Print Topic ]
Search this thread:

Copyright 1997-2026 Mind Media. Some rights reserved.

Generated in 0.026 seconds spending 0.007 seconds on 14 queries.