PHP - Like System

hello dear PHP-Fans - greetings to you - and a happy new year!!


i set up a WAMP-System on my openSuse 11.4 system.  In order to learn as much as i can bout PHP i want to do some tests and write some scripts.

Well the WAMP is allready up and running.  Now i try to give the writing access to the folder

mkdir /srv/www/

where the php-scripts should go in...

i want  to give write permission to all to all files in /srv/www

As root I generally:

mkdir /srv/www/
chown <webmaster usrername> /srv/www/

/srv/www/ should be readable and traversable by all, but only writeable by it's owner (the user designated as the webmaster.)

can i do this like mentioned above,...

Love to hear from you

greetings
db1

  Hi this is my login script i do have the html if you need to see it please ask & i was wondering if anyone would be kind enough to tell me how i can get my ban system to work Thanks

<?php

require 'connect.php';

if(isset($_POST['submit'])) {

	$username = $_POST['username'];
	$password = $_POST['password'];

	//Prevent hackers from using SQL Injection
	$username = stripslashes($username);
	$password = stripslashes($password);
	$username = mysql_real_escape_string($username);
	$password = mysql_real_escape_string($password);

	$sql = "SELECT * FROM $tbl_name WHERE username='$username' AND password='$password'";
	$result = mysql_query($sql);
	$count = mysql_num_rows($result);

	$user_level = $_GET['user_level'];

	$_SESSION['user_level'] = $user_level;

	if($count == 1) {

		$_SESSION['username'];
		$_SESSION['password'];
		header("Location: index.php");
	} else {

		echo "Please check the username and password you entered is correct.";
	} if($_SESSION['user_level'] == 0) {
		$_SESSION['username'];
		$_SESSION['password'];
		header("Location: index.php");
		
	} else if($_SESSION['user_level'] == -1) {

		die();
		header("Location: banned.php");

	} else if($_SESSION['user_level'] < -1) {
		die();
		echo "An error has occurred please contact your administrator.";

	} else if($_SESSION['user_level'] == 1) {
		$_SESSION['username'];
		$_SESSION['password'];
		header("Location: admin.php");

	}


}

?>

Edited by Tom8001, 23 November 2014 - 12:18 PM.

Hi all

I have been looking though loads of tutorials regarding log in method for websites (not APIs), and cant help find that they are outdated.

So I am asking what is the correct way to create a log in system using php?

Modern websites use JavaScript for asynchronous web requests so this requirement should also be catered for. APIs and mobile apps use access tokens which is very secure if implemented correctly.

Can we use the token principle for websites? As the way I see it that most php log in systems use php sessions and they create a session and save some data in this session when the user successfully authenticates, however the session id is held in a cookie so if the cookie is stolen then they have access to your account.

API access tokens are expired and refreshed periodically so is there such a implementation method for web sites too?

I'm trying to build a login system and alot of the code is similar to what i used to make my news cms. basically all i wanna accomplish right now is to get the user input inserted into my database. I've already tested it out, and I get no errors, but like with the cms, the database isn't getting queryed.

Here's the code:
(process.php)
Code: [Select]
<?php
 $first_name=$_POST['first_name']; 
 $last_name=$_POST['last_name']; 
 $age=$_POST['age']; 
 $city=$_POST['city']; 
 $state=$_POST['state']; 
 $country=$_POST['country']; 
 $zip=$_POST['zip']; 
 $birthdate=$_POST['birthdate']; 
 $gender=$_POST['gender']; 
 $sexuality=$_POST['sexuality']; 
 $race=$_POST['race']; 
 $religion=$_POST['religion']; 
 $status=$_POST['status']; 
 $about=$_POST['about']; 
 $website=$_POST['website']; 
 $user_name=$_POST['user_name']; 
 $password=$_POST['password']; 
 $email=$_POST['email']; 
 mysql_connect("your hostname", "your database name", "your password") or die(mysql_error()); 
 mysql_select_db("your database name") or die(mysql_error()); 
 
 $sql = sprintf("INSERT INTO Users (first_name, last_name, age, city, state, country, zip, birthdate, gender, sexuality, race, religion, status, about, website, user_name, password, email)
VALUES ('%s', '%s', '%s', '%s', '%s')",
mysql_real_escape_string($first_name),
mysql_real_escape_string($last_name),
mysql_real_escape_string($age),
mysql_real_escape_string($city),
mysql_real_escape_string($state),
mysql_real_escape_string($country),
mysql_real_escape_string($zip),
mysql_real_escape_string($birthdate),
mysql_real_escape_string($gender),
mysql_real_escape_string($sexuality),
mysql_real_escape_string($race),
mysql_real_escape_string($religion),
mysql_real_escape_string($status),
mysql_real_escape_string($about),
mysql_real_escape_string($website),
mysql_real_escape_string($user_name),
mysql_real_escape_string($password),
mysql_real_escape_string($email));
$result = mysql_query($sql); 
 
 
 Print "Congratulations! You are now a registered member on yourwebsite.com!"; 
 ?>
(register/index.php)
Code: [Select]
<script language = "Javascript">
 
function Validate()
{
    if (document.register.first_name.value == '')
    {
        alert('You have not specified your first name!');
        return false;
    }
if (document.register.last_name.value == '')
    {
        alert('You have not specified your last name!');
        return false;
    }
if (document.register.age.value == '')
    {
        alert('You have not specified your age!');
        return false;
    }
if (document.register.country.value == '')
    {
        alert('You have not entered a country!');
        return false;
    }
if (document.register.birthdate.value == '')
    {
        alert('You have not entered your date of birth!');
        return false;
    }
if (document.register.gender.value == '')
    {
        alert('You have not specified your gender!');
        return false;
    }
if (document.register.user_name.value == '')
    {
        alert('You have not entered a username!');
        return false;
    }
if (document.register.email.value == '')
    {
        alert('You have not entered an email!');
        return false;
    }
if (document.register.password.value == '')
    {
        alert('You have not entered a password!');
        return false;
    }
    return true;
}
</script>
      <form name="register" method="post" action="http://www.djsmiley.net/register/process.php" onsubmit="return Validate();">
                    <table width="100%" border="0">
                      <tr>
                        <td>First Name:</td>
                        <td><label>
                          <input type="text" name="first_name" id="first_name" />
                        </label></td>
                      </tr>
                      <tr>
                        <td>Last Name:</td>
                        <td><input type="text" name="last_name" id="last_name" /></td>
                      </tr>
                      <tr>
                        <td>Age:</td>
                        <td><input type="text" name="age" id="age" /></td>
                      </tr>
                      <tr>
                        <td>City:</td>
                        <td><input type="text" name="city" id="city" /></td>
                      </tr>
                      <tr>
                        <td>State:</td>
                        <td><input type="text" name="state" id="state" /></td>
                      </tr>
                      <tr>
                        <td>Country:</td>
                        <td><input type="text" name="country" id="country" /></td>
                      </tr>
                      <tr>
                        <td>Zip:</td>
                        <td><input type="text" name="zip" id="zip" /></td>
                      </tr>
                      <tr>
                        <td>Birthdate:</td>
                        <td><input type="text" name="birthdate" id="birthdate" /></td>
                      </tr>
                      <tr>
                        <td>Gender:</td>
                        <td><input type="text" name="gender" id="gender" /></td>
                      </tr>
                      <tr>
                        <td>Sexuality:</td>
                        <td><input type="text" name="sexuality" id="sexuality" /></td>
                      </tr>
                      <tr>
                        <td>Race:</td>
                        <td><input type="text" name="race" id="race" /></td>
                      </tr>
                      <tr>
                        <td>Religion:</td>
                        <td><input type="text" name="religion" id="religion" /></td>
                      </tr>
                      <tr>
                        <td>Marital Status:</td>
                        <td><input type="text" name="status" id="status" /></td>
                      </tr>
                      <tr>
                        <td>About You:</td>
                        <td><label>
                          <textarea name="about" id="about" cols="45" rows="5"></textarea>
                        </label></td>
                      </tr>
                      <tr>
                        <td>Website:</td>
                        <td><input type="text" name="website" id="website" /></td>
                      </tr>
                      <tr>
                        <td width="13%">Username: </td>
                        <td width="87%"><input type="text" name="user_name" id="user_name" /></td>
                      </tr>
                      <tr>
                        <td>Email: </td>
                        <td><input type="text" name="email" id="email" /></td>
                      </tr>
                      <tr>
                        <td>Password: </td>
                        <td><input type="password" name="password" id="password" /></td>
                      </tr>
                      <tr>
                        <td>&nbsp;</td>
                        <td><input name="Register Button" type="submit" class="Button1" id="Register Button" value="Register" />
                        <input name="Reset Button" type="reset" class="Button1" id="Reset Button" value="Clear" /></td>
                      </tr>
                    </table>
                    <label></label>
      </form>

Hello,

I have the following code


Code: [Select]
class Uploads extends Controller
{
 public function __construct()
 {
  parent::__construct();

  if (empty($_FILES))
  {
   log_message('error', 'Uploads - files empty');
   exit('No files uploaded');
  }

  ini_set('memory_limit', '128M');

  $this->load->helper('file');
  $this->load->helper('helpers');
  $this->load->model('uploads_model');

 }

 public function font_handler()
 {
  $this->uploads_model->font_handler();
 }

}

class Uploads_model extends Model
{
    public function font_handler()
    {
  $config = array(
   'max_size'     => '8388',
   'allowed_types' => 'ttf',
   'upload_path'   => 'assets/fonts/'
  );

  $this->load->library('upload', $config);

  if ($this->upload->do_upload('Filedata'))
  {
   $file = $this->upload->data();
   $jsFile = $file['raw_name'].'.js';
   $query = $this->db->where('location', 'menuFont')->get('fonts')->row();

   if ($query->customFile != '' && file_exists('assets/fonts/'.$query->customFile))
         {
    unlink('assets/fonts/'.$query->customFile);
   }

   $path    = getcwd() . '/assets/fonts/cufon/convert.php';
   $command = 'php ' . $path . ' -u "U+??" ' . $file['full_path'] . ' 1> ' . getcwd() . '/assets/fonts/' . $jsFile;

   system($command);
  }
 }

}


Ok so, the ttf file is uploaded correctly and I can run $command from the command promt in putty and it works perfect, but when I try to run the same command from system() the js file just contains (from the controller) "No files uploaded" I have no idea why this is happening? Anyone have any ideas?  Also one thing i'm not sure about is if it should be 1> or > when creating the js file?!?


Thanks guys!