PHP - Need Help Implementing Safe Method

Hi guys, I have been using the same code for years now to include my default page and pull content into my layouts.   I found the code online and its a bit confusing so was just wondering if its still safe to use, and is it all needed nowadays? or is there a simpler way i could be doing this?   Thanks for any help

<?php

    if (isset($_GET['nav'])) 
{
    if (strpos($_GET['nav'], "/")) 
{
    $direc = substr(str_replace('..', '', $_GET['nav']), 0, strpos($_GET['nav'], "/")) . "/";
    $file = substr(strrchr($_GET['nav'], "/"), 1);
    if (file_exists($direc.$file.".php")) 
{
    require($direc.$file.".php");
} else {
    require("error.php");
}
} else {
    if (file_exists(basename($_GET['nav']).".php")) 
{
    require(basename($_GET['nav']).".php");
} else {
    require("error.php");
}
}
} else {
    require("links.php");
}
?>

Can someone help me please?....

I'm using this
Code: [Select]
<form name="form1" method="post" action="create-b.php" enctype="application/x-www-form-urlencoded" style="margin:0px">
<input name="name" value="Anonymous" type="text" MAXLENGTH="15" style="position:absolute;width:650px;left:67px;top:142px;z-index:4">
<input name="subject" value="(No subject)" MAXLENGTH="15" type="text" style="position:absolute;width:650px;left:67px;top:166px;z-index:5">
<textarea name="body" MAXLENGTH="255" type="text" style="position:absolute;left:67px;top:191px;width:650px;height:98px;z-index:6"></textarea>
<div id="captcha" style="position:absolute; overflow:hidden; left:10px; top:296px; z-index:8">
<input name="submit" type="submit" value="Create thread" style="position:absolute;left:614px;top:291px;z-index:7">
<?php
  require_once('captc/recaptchalib.php');
  $publickey = "**************************************";
  echo recaptcha_get_html($publickey);
?>
</form>On the HTML side and this

  require_once('captc/recaptchalib.php');
  $privatekey = "************************";
  $resp = recaptcha_check_answer ($privatekey,
                                $_SERVER["REMOTE_ADDR"],
                                $_POST["recaptcha_challenge_field"],
                                $_POST["recaptcha_response_field"]);

  if (!$resp->is_valid) {
    // What happens when the CAPTCHA was entered incorrectly
    die ("<font color='red'><font size='12'><strong><center>The verification code you entered appears to be incorrect!");
  } else {
CONTENT CONTENT CONTENT CONTENT CONTENT ETC

But it always returns "The verification code you entered appears to be incorrect!" Any idea what I'm doing wrong?...

I am trying to write a PHP script that implements the MD5 algorithm just so that I can better understand MD5's inner-workings. For those of you already familiar with how MD5 works, could you help me figure out why my script is not producing the correct output?

<?php
$string = "";

$a = "01100111010001010010001100000001"; // 0x67452301
$b = "11101111110011011010101110001001"; // 0xEFCDAB89
$c = "10011000101110101101110011111110"; // 0x98BADCFE
$d = "00010000001100100101010001110110"; // 0x10325476

$aa = $a;
$bb = $b;
$cc = $c;
$dd = $d;

// PADDED BINARY FOR NULL STRING, I.E.: ""
$binary_md5 = "10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000";
$binary_md5_words = strlen($binary_md5) / 32;

// SPLIT BINARY INTO 16 32-BIT WORDS
for($i = 1; $i <= $binary_md5_words; $i++) {
    $m[] = substr($binary_md5, ($i - 1) * 32, 32);
}

// GENERATE T-VALUES
for($i = 0; $i < 64; $i++) {
    $T[] = Pad(decbin(floor(4294967296 * abs(sin($i+1)))), 32);
}

/*
// PRINT THE M[K] ARRAY
echo "<h1>m[k] Array</h1><br>";
print_r($m);
echo "<br><br>";

// PRINT THE T[t] ARRAY
echo "<h1>T[t] Array</h1><br>";
print_r($T);
echo "<br><br>";

// TEST ANDxy
echo "<h1>Test ANDxy</h1><br>";
echo "$m[0]<br>$T[0]<br>";
echo ANDxy($m[0], $T[0]);
echo "<br><br>";

// TEST ORxy
echo "<h1>Test ORxy</h1><br>";
echo "$m[0]<br>$T[0]<br>";
echo ORxy($m[0], $T[0]);
echo "<br><br>";

// TEST ADDxy
echo "<h1>Test ADDxy</h1><br>";
echo "$m[0]<br>$T[0]<br>";
echo ADDxy($m[0], $T[0]);
echo "<br><br>";

// TEST XORxy
echo "<h1>Test XORxy</h1><br>";
echo "$m[0]<br>$T[0]<br>";
echo XORxy($m[0], $T[0]);
echo "<br><br>";

// TEST NOTx
echo "<h1>Test NOTx</h1><br>";
echo "$m[0]<br>";
echo NOTx($m[0]);
echo "<br><br>";

// TEST SHIFTleft
echo "<h1>Test SHIFTleft</h1><br>";
echo "$m[0]<br>";
echo SHIFTleft($m[0], 1);
echo "<br><br>";

// TEST F
echo "<h1>Test F</h1><br>";
echo "X = $m[0]<br>Y = $m[1]<br>Z = $m[2]<br>F = ";
echo F($m[0], $m[1], $m[2]);
$step1 = ANDxy($m[0], $m[1]);
$step2 = ANDxy(NOTx($m[0]), $m[2]);
$step3 = ORxy($step1, $step2);
echo "<br>F = $step3";
echo "<br><br>";

// TEST H
echo "<h1>Test H</h1><br>";
echo "X = $m[0]<br>Y = $m[1]<br>Z = $m[2]<br>F = ";
echo H($m[0], $m[1], $m[2]);
echo "<br><br>";
*/

// ROUND 1
$a = ff($a, $b, $c, $d, $m, 0, 7, $T[0]);
$d = ff($d, $a, $b, $c, $m, 1, 12, $T[1]);
$c = ff($c, $d, $a, $b, $m, 2, 17, $T[2]);
$b = ff($b, $c, $d, $a, $m, 3, 22, $T[3]);

$a = ff($a, $b, $c, $d, $m, 4, 7, $T[4]);
$d = ff($d, $a, $b, $c, $m, 5, 12, $T[5]);
$c = ff($c, $d, $a, $b, $m, 6, 17, $T[6]);
$b = ff($b, $c, $d, $a, $m, 7, 22, $T[7]);

$a = ff($a, $b, $c, $d, $m, 8, 7, $T[8]);
$d = ff($d, $a, $b, $c, $m, 9, 12, $T[9]);
$c = ff($c, $d, $a, $b, $m, 10, 17, $T[10]);
$b = ff($b, $c, $d, $a, $m, 11, 22, $T[11]);

$a = ff($a, $b, $c, $d, $m, 12, 17, $T[12]);
$d = ff($d, $a, $b, $c, $m, 13, 12, $T[13]);
$c = ff($c, $d, $a, $b, $m, 14, 17, $T[14]);
$b = ff($b, $c, $d, $a, $m, 15, 22, $T[15]);

// ROUND 2
$a = gg($a, $b, $c, $d, $m, 1, 5, $T[16]);
$d = gg($d, $a, $b, $c, $m, 6, 9, $T[17]);
$c = gg($c, $d, $a, $b, $m, 11, 14, $T[18]);
$b = gg($b, $c, $d, $a, $m, 0, 20, $T[19]);

$a = gg($a, $b, $c, $d, $m, 5, 5, $T[20]);
$d = gg($d, $a, $b, $c, $m, 10, 9, $T[21]);
$c = gg($c, $d, $a, $b, $m, 15, 14, $T[22]);
$b = gg($b, $c, $d, $a, $m, 4, 20, $T[23]);

$a = gg($a, $b, $c, $d, $m, 9, 5, $T[24]);
$d = gg($d, $a, $b, $c, $m, 14, 9, $T[25]);
$c = gg($c, $d, $a, $b, $m, 3, 14, $T[26]);
$b = gg($b, $c, $d, $a, $m, 8, 20, $T[27]);

$a = gg($a, $b, $c, $d, $m, 13, 5, $T[28]);
$d = gg($d, $a, $b, $c, $m, 2, 9, $T[29]);
$c = gg($c, $d, $a, $b, $m, 7, 14, $T[30]);
$b = gg($b, $c, $d, $a, $m, 12, 20, $T[31]);

// ROUND 3
$a = hh($a, $b, $c, $d, $m, 5, 4, $T[32]);
$d = hh($d, $a, $b, $c, $m, 8, 11, $T[33]);
$c = hh($c, $d, $a, $b, $m, 11, 16, $T[34]);
$b = hh($b, $c, $d, $a, $m, 14, 23, $T[35]);

$a = hh($a, $b, $c, $d, $m, 1, 4, $T[36]);
$d = hh($d, $a, $b, $c, $m, 4, 11, $T[37]);
$c = hh($c, $d, $a, $b, $m, 7, 16, $T[38]);
$b = hh($b, $c, $d, $a, $m, 10, 23, $T[39]);

$a = hh($a, $b, $c, $d, $m, 13, 4, $T[40]);
$d = hh($d, $a, $b, $c, $m, 0, 11, $T[41]);
$c = hh($c, $d, $a, $b, $m, 3, 16, $T[42]);
$b = hh($b, $c, $d, $a, $m, 6, 23, $T[43]);

$a = hh($a, $b, $c, $d, $m, 9, 4, $T[44]);
$d = hh($d, $a, $b, $c, $m, 12, 11, $T[45]);
$c = hh($c, $d, $a, $b, $m, 15, 16, $T[46]);
$b = hh($b, $c, $d, $a, $m, 2, 23, $T[47]);

// ROUND 4
$a = ii($a, $b, $c, $d, $m, 0, 6, $T[48]);
$d = ii($d, $a, $b, $c, $m, 7, 10, $T[49]);
$c = ii($c, $d, $a, $b, $m, 14, 15, $T[50]);
$b = ii($b, $c, $d, $a, $m, 5, 21, $T[51]);

$a = ii($a, $b, $c, $d, $m, 12, 6, $T[52]);
$d = ii($d, $a, $b, $c, $m, 3, 10, $T[53]);
$c = ii($c, $d, $a, $b, $m, 10, 15, $T[54]);
$b = ii($b, $c, $d, $a, $m, 1, 21, $T[55]);

$a = ii($a, $b, $c, $d, $m, 8, 6, $T[56]);
$d = ii($d, $a, $b, $c, $m, 15, 10, $T[57]);
$c = ii($c, $d, $a, $b, $m, 6, 15, $T[58]);
$b = ii($b, $c, $d, $a, $m, 13, 21, $T[59]);

$a = ii($a, $b, $c, $d, $m, 4, 6, $T[60]);
$d = ii($d, $a, $b, $c, $m, 11, 10, $T[61]);
$c = ii($c, $d, $a, $b, $m, 2, 15, $T[62]);
$b = ii($b, $c, $d, $a, $m, 9, 21, $T[63]);

$a = ADDxy($a, $aa);
$b = ADDxy($b, $bb);
$c = ADDxy($c, $cc);
$d = ADDxy($d, $dd);

// ECHO RESULTS
echo "<h1>String</h1><br>";
echo "String: '$string'<br>";
$md5 = md5($string);
echo "MD5: $md5<br><br>";
$md5_1 = substr($md5, 0, 8);
$md5_2 = substr($md5, 8, 8);
$md5_3 = substr($md5, 16, 8);
$md5_4 = substr($md5, 24, 8);
echo "A = $md5_1<br>B = $md5_2<br>C = $md5_3<br>D = $md5_4<br><br>";
$md5_bin_a = Pad(decbin(hexdec($md5_1)), 32); 
$md5_bin_b = Pad(decbin(hexdec($md5_2)), 32); 
$md5_bin_c = Pad(decbin(hexdec($md5_3)), 32); 
$md5_bin_d = Pad(decbin(hexdec($md5_4)), 32); 
echo "A = $md5_bin_a<br>B = $md5_bin_b<br>C = $md5_bin_c<br>D = $md5_bin_d<br><br>";
echo "<h1>Results</h1><br>";
echo "A = $a<br>B = $b<br>C = $c<br>D = $d<br><br>";
$a_dec = bindec($a);
$b_dec = bindec($b);
$c_dec = bindec($c);
$d_dec = bindec($d);
$a_hex = dechex($a_dec);
$b_hex = dechex($b_dec);
$c_hex = dechex($c_dec);
$d_hex = dechex($d_dec);
echo "A = $a_hex<br>B = $b_hex<br>C = $c_hex<br>D = $d_hex<br><br>";

// FUNCTIONS
function ff($a, $b, $c, $d, $m, $k, $s, $t) {
    //a = b + ((a + F(b,c,d) + X[k] + T[i]) <<< s)
    return ADDxy($b, SHIFTleft(ADDxy(ADDxy(ADDxy($a, F($b, $c, $d)), $m[$k]), $t), $s));
}

function gg($a, $b, $c, $d, $m, $k, $s, $t) {
    //a = b + ((a + G(b,c,d) + X[k] + T[i]) <<< s)
    return ADDxy($b, SHIFTleft(ADDxy(ADDxy(ADDxy($a, G($b, $c, $d)), $m[$k]), $t), $s));
}

function hh($a, $b, $c, $d, $m, $k, $s, $t) {
    //a = b + ((a + H(b,c,d) + X[k] + T[i]) <<< s)
    return ADDxy($b, SHIFTleft(ADDxy(ADDxy(ADDxy($a, H($b, $c, $d)), $m[$k]), $t), $s));
}

function ii($a, $b, $c, $d, $m, $k, $s, $t) {
    //a = b + ((a + I(b,c,d) + X[k] + T[i]) <<< s)
    return ADDxy($b, SHIFTleft(ADDxy(ADDxy(ADDxy($a, I($b, $c, $d)), $m[$k]), $t), $s));
}

function F($X, $Y, $Z) {
    //return ($X & $Y) | ((~$X) & $Z);
    return ORxy(ANDxy($X, $Y), ANDxy(NOTx($X), $Z));
}

function G($X, $Y, $Z) {
    //return ($X & $Z) | ($Y & (~$Z));
    return ORxy(ANDxy($X, $Z), ANDxy($Y, NOTx($Z)));
}

function H($X, $Y, $Z) {
    //return $X ^ $Y ^ $Z;
    return XORxy(XORxy($X, $Y), $Z);
}

function I($X, $Y, $Z) {
    //return $Y ^ ($X | (~$Z));
    return XORxy($Y, ORxy($X, NOTx($Z)));
}

function Pad($binary, $pad_length) {
    $pad_length = $pad_length - strlen($binary);
    for($i = 0; $i < $pad_length; $i++) {
        $padding .= '0';
    }
    return $padding . $binary;
}

function mod($val, $div) {
    $r = $val - (floor($val/$div)*$div);
    return $r;
}
function ANDxy($x, $y) {
    $x_dec = bindec($x);
    $y_dec = bindec($y);
    
    $result = $x_dec & $y_dec;
    $result = Pad(decbin($result), strlen($x));
    
    return $result;   
}

function ORxy($x, $y) {
    $x_dec = bindec($x);
    $y_dec = bindec($y);
    
    $result = $x_dec | $y_dec;
    $result = Pad(decbin($result), strlen($x));
    
    return $result;   
}

function ADDxy($x, $y) {
    $x_dec = bindec($x);
    $y_dec = bindec($y);
    
    $result = mod($x_dec + $y_dec, pow(2, 32));
    $result = Pad(decbin($result), strlen($x));
    
    return $result;   
}

function XORxy($x, $y) {
    $x_dec = bindec($x);
    $y_dec = bindec($y);
    
    $result = $x_dec ^ $y_dec;
    $result = Pad(decbin($result), strlen($x));
    
    return $result;   
}

function NOTx($x) {
    $x_dec = bindec($x);
    
    $result = ~$x_dec;
    $result = Pad(decbin($result), strlen($x));
    
    return $result;
}

function SHIFTleft($x, $y) {
    $x_dec = bindec($x);
    
    $result = $x_dec << $y;
    $result = Pad(decbin($result), strlen($x));
    
    return $result;   
}

function SHIFTright($x, $y) {
    $x_dec = bindec($x);
    
    $result = $x_dec >> $y;
    $result = Pad(decbin($result), strlen($x));
    
    return $result;   
}
?>

Hello all.

Just wanted to run this past you guys to see if I am missing anything important. I am making a script that I plan to allow a lot of other people around the web to use, so I want to make sure it's as bullet proof as possible.

I am passing two values and grabbing them with a _GET, one is a big number, and the other is only letters and 8 characters long.

her's my code so far.

Code: [Select]
<?php
    $clan = $_GET['clanid'];
    // make sure its an INT
        //if(isint($clan)){
        if(ereg("[^0-9]", $clan)){
            //im an int.
            echo ("ERROR Invalid CLANID");
            die;          
        }
    
    // make sure its a 8 letter only word.
    $style=$_GET['style'];
        
        // cut style down to 8 characters long.
        $style=substr($style, 0, 8);
        
        if(ereg("[^a-zA-Z]+", $style)) {
            // Contains only letters.
            echo("ERROR Invalid STYLE NAME");
            die;          
        }   
    
?>

to my noob php eye's it looks pretty solid, I cant think of any way a malicious user could get past it, but like I said, thought I would run it past you guys first , you can never be to careful.

I have a button that uses $_POST to send information to another page.  The data is in a hidden input so it's not possible for users to change information.  I have nothing to check if the data is correct on the other page.  Is it still possible for people to change the $_POST data though?  Or somehow send false $_POST data to the other page?

Like 6 years ago I had made a forum software for me and my buddies to post on. It had worked all great until my friend had posted a character that skewed my whole database, unintentionly, he knew nothing about computers. But I really haven't dabbed in PHP since 2008, I'm just now getting back into it again.

I need to know how I can make data from an input to be put into an MySQL database and not screw up my code. So something along the lines that make the code safe and not exploitable.

Also any third party scripts on captcha would be great!

I am using seo friendly urls so when someone makes a post named "this is a post" the url will point to www.example.com/topic/this_is_a_post

But when the user enters a character in their post name that means something in a url(? /) it obviously breaks. How can i make the urls safe from this without str_replace as i want to keep the characters.

Hi,

I am using parameterized queries on my code, here's the relevant part

Code: [Select]
$params=$_POST['ITGtable'];

$tsql2 = "SELECT COLUMN_NAME, DATA_TYPE, ORDINAL_POSITION,
  COLUMN_DEFAULT, CHARACTER_MAXIMUM_LENGTH, IS_NULLABLE
  FROM INFORMATION_SCHEMA.COLUMNS
  WHERE TABLE_NAME=?";

/* Execute the statement with the specified parameter value.
Display the returned data if no errors occur. */
$stmt2 = sqlsrv_query( $conn, $tsql2, $params);
if( $stmt2 === false )
{
     echo "Statement 2 could not be executed.\n";
     die( print_r(sqlsrv_errors(), true));
}
else
{
     $qty = sqlsrv_fetch_array( $stmt2);
}
Do I really have to sanitize $_POST['ITGtable'] for apostrophe, semicolon, etc, to avoid SQL injection problems? Or just with above code I should be safer (I did not say safe) against SQL injection? And if the answer is "No", what could be the sanitize code of function? I am using sqlsrv and MS-SQL database engine; most of the functions we have for sanitize inputs on MySQL are not available for MS-SQL.

Thanks in advance,

I am using this script for "remember me" option:
                      if (isset($_POST['rememberme']))
                        {
                          /* Set cookie to last 1 year */
                          setcookie('username', $_POST['user_name'], time() + 60 * 60 * 24 * 365);
                          setcookie('password', sha1($_POST['user_pass']), time() + 60 * 60 * 24 * 365);
                        }

Is it safe to save user data in cookie or there is better way? Can somebody steal password if there is more than one user at same computer? What do you suggest?

I have created this login class (In all honesty this is the most commented and well structured class I have ever written, I usualy just use random functions in a functions.php file, which works but this felt good when I finished it )

I just wanted some advice to how safe and whether the way I have done this is 'good practise', or if there is anything I should add to future proof it.

This is the class:
Code: [Select]
<?php
/* 
Author: Craig Dennis
File: user_session.class.php
Purpose: Flexible user login class that handles logging in, checking a user is logged in, and logging out.

NOTE TO USE THIS CLASS YOU MUST ALREADY HAVE ALREADY CONNECTED TO THE DATABASE

Include this file at the top of each page you wish to protect
 include("inc/user_session.class.php"); //(This could be put at the top of a global include file)
 
Use the following code to check the user is logged in:
 $user_session = new user_session; //(This could be put at the top of a global include file)
 $user_session->validate_user(); //(This should only be left on the pages you wish to check for user validation)
 
You will want to use the public redirect_if_logged_in() function instead of validate_user() on the login page like this:
 $user_session->redirect_if_logged_in(); //(This will redirect a user from the current page to the specified landing page)
*/
class user_session{
// Change these variables below if the table and fields in your database do not match
public $t_name = "admins";
public $t_user = "username";
public $t_pass = "password";
public $t_lastlogin = "last_login"; //set $t_lastlogin = NULL if you do not have this field in your database

//Change $login_page and $landing_page if your page names are different to this one
public $login_page = "login.php";
public $landing_page = "logged_in.php";

//Change $log_in_error_msg if you wish to change the general error message when the user is unable to log in
public $log_in_error_msg = "The username or password you have entered is incorrect or does not exist";

//Do not touch anything below unless you know what your doing

/*
 * logged_in_user()
 * Returns value of the current logged in username
 */
public function logged_in_user(){
return $_SESSION['user_username'];
}

/*
 * log_in()
 * Takes 2 parameters ($username, $password)
 * Attempts to log in with the provided credentials, on success, the username and password are saved in the session for future testing
 */
public function log_in($username, $password){
$username = stripslashes(mysql_real_escape_string($username));
$password = stripslashes(mysql_real_escape_string($password));

$query_login = mysql_query("SELECT * FROM ".$this->t_name."
  WHERE ".$this->t_user."='$username' AND ".$this->t_pass."='$password'");;

$login_accepted = mysql_num_rows($query_login);

if($login_accepted == 1){
if($t_lastlogin != NULL){
$query_update_last_login = mysql_query("UPDATE ".$this->t_name." SET ".$this->t_lastlogin."='".time()."'
WHERE ".$this->t_user."='$username'");
}
$_SESSION['user_username'] = $username;
$_SESSION['user_password'] = $password;
return true;
}else{
return false;
}
}

/*
 * check_user()
 * Returns true if the current session credentials can be found in the database, otherwise returns false
 */
public function check_user(){
$query_login = mysql_query("SELECT * FROM ".$this->t_name."
  WHERE ".$this->t_user."='".$_SESSION['user_username']."' 
AND ".$this->t_pass."='".$_SESSION['user_password']."'");

$login_accepted = mysql_num_rows($query_login);

if($login_accepted == 1){
return true;
}else{
return false;
}
}

/*
 * validate_user()
 * Returns true if the current session credentials can be found in the database, otherwise logs user out and returns false
 */
public function validate_user(){
$login_accepted = $this->check_user();

if($login_accepted == 1){
return true;
}else{
$this->log_out();
return false;
}
}

/*
 * redirect_if_logged_in()
 * Redirects the user to the specified landing page if the user is logged in
 */
public function redirect_if_logged_in(){
if($this->check_user()){
header("Location: ".$this->landing_page);
}
}

/*
 * log_out()
 * Logs the user out by setting the session credentials to an empty string and redirecting them to the specified login page
 */
public function log_out(){
$_SESSION['user_username'] = "";
$_SESSION['user_password'] = "";
header("Location: ".$this->login_page);
}
}
?>

Any comments or advice are appreciated.

Hey guys!
I have a doubt and this is a question that relates Flash and PHP...

I have a flash (swf) file that grabs/sends variables from/to php.
That swf file is FULLY encrypted and the paths to the PHP urls are also encrypted.

Is there any other way a hacker could find out where and which my PHP files are located/named?

Any ideas, suggestions?
Thanks in advance!
Cheers,

I registered a few days ago for help on this thread but didn't post again on it now because it has been marked answered and I thought I'd better not bump it.  I received help in a way that has been the most encouraging since I began my calendar project.  I'm wondering, though, if you would help me understand why I'm not successful at implementing the advice to the point that events are inserting into my calendar.    My testing database has only one table:  events and in events, only two columns (other than id):  "startdt" and "description".  This is a screenshot of how the table's columns are set upL    screenshot.jpg   37.21KB   0 downloads   This is a screenshot of the table content:    screenshot2.jpg   9.35KB   0 downloads   This is my code with the edits added from the support thread:

<?PHP

$var = mysql_real_escape_string($_GET['startdt, description']);

$con=mysql_connect("localhost","user","password");
// Check connection
if (mysql_connect_error()) {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
    //select a database to work with
    $selected = mysql_select_db("mydatabase_",$con) 
      or die("Could not select mydatabase_");

    //execute the SQL query and return records
    $result = mysql_query("SELECT information FROM events WHERE value='$startdt', 'description'");
    //fetch tha data from the database
    while ($row = mysql_fetch_array($result)) {
       echo $row{'startdt, description'};
    }

    //close the connection
    mysql_close($con);

?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rel="stylesheet" href="css/master.css" type="text/css" media="all">
<meta http-equiv="Content-Type" content="text/html" />
<title>Yet Another Test</title>
</head>
<body>
<?php
    $currMonth = isset($_GET['month']) ? $_GET['month']  : date('n');
    $currYear  = isset($_GET['year'])  ? $_GET['year']   : date('Y');
    $today = (($currYear == date('Y')) && ($currMonth == date('n'))) ? date('j') : 0;

    $prevMonth = $currMonth==1 ? 12 : $currMonth-1;
    $nextMonth = $currMonth==12?  1 : $currMonth+1;
    $prevYear = $currMonth==1 ? $currYear-1 : $currYear;
    $nextYear = $currMonth==12? $currYear+1 : $currYear;

    $day1 = mktime(0,0,0,$currMonth,1,$currYear);
    $dim = date('t', $day1);
    $dayN = mktime(0,0,0,$currMonth,$dim,$currYear);
    $dow1 = (date('w',$day1)+0) % 7;
    $dowN = (date('w',$dayN)+0) % 7;
    $calHead = date('F Y',$day1);
    	echo <<<EOT
    	<div class="calwrapper">
    	<div class="caltitle"><h1>Calendar</h1></div>
    	<div class="container">
    	<div class="fnl first"></div>
    	<div class="adjust"></div>
    	<div class="fnl last"></div>
    	</div>
    	<div class="caldisplay">
        <table cellspacing="0">
        <tr>
        <td class="hd"><a class="cal_button" href="$_SERVER[PHP_SELF]?year=$prevYear&month=$prevMonth"> Prev </a></td>
        <td colspan="5" class="adjust">$calHead</td>
        <td class="hd"><a class="cal_button" href="$_SERVER[PHP_SELF]?year=$nextYear&month=$nextMonth"> Next </a></td>
        </tr>
        <tr>
          <th class="we">Sun</th>
          <th class="wd">Mon</th>
          <th class="wd">Tue</th>
          <th class="wd">Wed</th>
          <th class="wd">Thu</th>
          <th class="wd">Fri</th>
          <th class="we">Sat</th>
         </tr>
        <tr>
EOT;
    for ($d=0;$d<$dow1;$d++) echo "<td class=\"hd\"> </td>";
    $c = $dow1;
    for ($d=1; $d<=$dim; $d++, $c++) {
        if ($c%7==0) echo "</tr><tr>";
        $cl = ($c%7==5) || ($c%7==6) ? 'we' : 'wd';
        $st = ($d == $today) ? "style='padding: 0px;'" : '';
        echo "<td class=\"$cl\" $st>\n";
        echo "$d" ;
        echo "</td>\n";
    }
    while ($c++ % 7 != 0) echo '<td class=\"hd\"> </td>';
    echo "</tr></table>\n";
    echo '</div></div>';
    
// calander entries. Use the date as the key (in YYYY/MM/DD format)
$entries = array(
	'2014/8/16' => array(
        				'Event',
					),
	
);
    for ($d=1; $d<=$dim; $d++, $c++) {

        if ($c%7==0) echo "</tr><tr>";

        $cl = ($c%7==5) || ($c%7==6) ? 'we' : 'wd';

        $st = ($d == $today) ? "style='padding: 0px;'" : '';

        echo "<td class=\"$cl\" $st>\n";

        echo "$d" ;

        echo "</td>\n";

    }

// construct the date, this will be used to check to if the key exists in the $entries array
        $dateKey = "$currYear/$currMonth/$d";
        // check if the key exists in the $entries array
        if(array_key_exists($dateKey, $entries)) {
            // for each event, list it in a seperate tool tip
            foreach($entries[$dateKey] as $entry) {
                echo '<div class="has-tooltip">
           Event
            <span class="tooltip">'.$entry.'</span>
        </div>';
            }
        }    
    
?>
</body>
</html>

I am not getting any errors in the PHP Code Checker (although I am receiving the notice that these functions are now deprecated): mysql_close() mysql_connect() mysql_fetch_array() mysql_query() mysql_real_escape_string() mysql_select_db() When I upload my page to the server, everything seems fine, except that no information is added to the table.  When I check the page source, I see this:

 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
 <meta http-equiv="content-type" content="text/html; charset=utf-8" />
<link rel="stylesheet" href="css/master.css" type="text/css" media="all">
<meta http-equiv="Content-Type" content="text/html" />
<title>Yet Another Test</title>
</head>
<body>
    	<div class="calwrapper">
    	<div class="caltitle"><h1>Calendar</h1></div>
    	<div class="container">
    	<div class="fnl first"></div>
    	<div class="adjust"></div>
    	 <div class="fnl last"></div>
    	 </div>
    	 <div class="caldisplay">
        <table cellspacing="0">
        <tr>
          <td class="hd"><a class="cal_button" href="/1cal/calendar.php?year=2014&month=7"> Prev </a></td>
          <td colspan="5" class="adjust">August 2014</td>
          <td class="hd"><a class="cal_button" href="/1cal/calendar.php?year=2014&month=9"> Next </a></td>
        </tr>
        <tr>
          <th class="we">Sun</th>
          <th class="wd">Mon</th>
          <th class="wd">Tue</th>
          <th class="wd">Wed</th>
          <th class="wd">Thu</th>
          <th class="wd">Fri</th>
          <th class="we">Sat</th>
         </tr>
        <tr><!--DEBUG: year=$currYear and month=$currMonth<hr/--><td class="hd">&nbsp;</td><td class="hd">&nbsp;</td><td class="hd">&nbsp;</td><td class="hd">&nbsp;</td><td class="hd">&nbsp;</td><td class="we" >
1</td>
<td class="we" >
2</td>
</tr><tr><td class="wd" >
3</td>
<td class="wd" >
4</td>
<td class="wd" >
5</td>
<td class="wd" >
6</td>
<td class="wd" >
7</td>
<td class="we" >
8</td>
<td class="we" >
9</td>
</tr><tr><td class="wd" >
10</td>
<td class="wd" >
11</td>
<td class="wd" >
12</td>
<td class="wd" >
13</td>
<td class="wd" >
14</td>
<td class="we" style='padding: 0px;'>
15</td>
<td class="we" >
16</td>
</tr><tr><td class="wd" >
17</td>
<td class="wd" >
18</td>
<td class="wd" >
19</td>
<td class="wd" >
20</td>
<td class="wd" >
21</td>
<td class="we" >
22</td>
<td class="we" >
23</td>
</tr><tr><td class="wd" >
24</td>
<td class="wd" >
25</td>
<td class="wd" >
26</td>
<td class="wd" >
27</td>
<td class="wd" >
28</td>
<td class="we" >
29</td>
<td class="we" >
30</td>
</tr><tr><td class="wd" >
31</td>
<td class=\"hd\"> </td><td class=\"hd\"> </td><td class=\"hd\"> </td><td class=\"hd\"> </td><td class=\"hd\"> </td><td class=\"hd\"> </td></tr></table>
</div></div></body>
</html>

I don't have an understanding of what the Debug is telling me although I note the number "1" within the tag and find that interesting because on those occasions, earlier today, when the file upload would result in a white page, viewing the page source would reveal nothing but the numeral "1" in the upper left top.   Are the deprecated functions enough to cause the event not to insert into the calendar?  I'd appreciate any help in sorting why I'm not succeeding.  As you see so often around here, I'm not a coder.  I'm just forced into a position to have to fend for myself, as of late, and so I'm trying to learn what I can.  Thank you for any help. 
Edited by Izzy-B, 15 August 2014 - 07:24 PM.

Hey sup guys i need help Implementing top 10 users script into index.php. I got a screen shot of where it needs to go.



I need to Implement it so its inside the grey container as in the picture.

Here is the php for the top 10 users :

Code: [Select]
         <span style="float:right;">

        <table width="200">
        <tr><td colspan="2" align="center">TOP 10 USERS</td></tr>
        <tr><td align="left"><b>Username<b></td><td align="left"><b>Points</b></td></tr>
        <?php $i=0;
        if($num>0){
while ($i < $num) {
$username6=mysql_result($result4,$i,"username");
$points6=mysql_result($result4,$i,"points");
$i++;
echo "<tr><td>".$username6."</td><td>".$points6."</td></tr>";
Here is the image file for the graphic :

Code: [Select]
<table width="165" height="236" bgcolor="#FFFFFF" td background="images/tablebg.png" >
And here is the index.php :

Code: [Select]
<?
session_start();
include_once"config.php";
if(isset($_POST['login'])){
$username= trim($_POST['username']);
$password = trim($_POST['password']);
if($username == NULL OR $password == NULL){
$final_report.="Please complete both fields";
}else{
$check_user_data = mysql_query("SELECT * FROM `members` WHERE `username` = '$username'") or die(mysql_error());
if(mysql_num_rows($check_user_data) == 0){
$final_report.="This username does not exist";
}else{
$get_user_data = mysql_fetch_array($check_user_data);
if($get_user_data['password'] == $password){
$start_idsess = $_SESSION['username'] = "".$get_user_data['username']."";
$start_passsess = $_SESSION['password'] = "".$get_user_data['password']."";
$final_report.="<meta http-equiv='Refresh' content='0; URL=members.php'/>";
}}}}
if(isset($_SESSION['username']) && isset($_SESSION['password'])){
header("Location: members.php");
}

?>
<?php include("includes.php");?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head>

  <title><?php echo $title ?> | #1 Spot for Free Paid Surveys</title>
     <link rel="shortcut icon" href="favicon.ico" >
   <link rel="icon" type="image/gif" href="animated_favicon1.gif" >
  <meta http-equiv="content-type" content="text/html; charset=utf-8" />
  <meta name="description" content="Get free vouchers for online stores such as Amazon, ASOS, iTunes and more. It takes a few seconds to get started. Register now to start shopping for free." />
  <link rel="stylesheet" href="style.css" type="text/css" />
   <script type="text/javascript" src="js/jquery-1.4.2.min.js"></script>
    <script type="text/javascript" src="js/script.js"></script>
    <script type="text/javascript" src="js/dimensions.min.js"></script>
    <script type="text/javascript" src="js/func.js"></script>
    <script type="text/javascript" src="js/SHA1.js"></script>
 <script>var _wau = _wau || []; _wau.push(["tab", "72vlo7dmnb8j", "w12", "bottom-center"]);(function() { var s=document.createElement("script"); s.async=true; document.getElementsByTagName("head")[0].appendChild(s);})();</script>
 <style>

#logoPart { background:#000; height:90px;}
 
#bannerTD { width:900px; height:85px; background-color:#333; background-repeat: no-repeat;}
#bannerTD #bannerContainer { width:900px; height:325px; text-align:center;}
#bannerTD #bannerContainerCover { width:900px; height:325px; text-align:center;}
#bannerTD #bannerBody { height:245px; text-align:center;}
 
#bannerTD #bannerFooter {     
position: relative;
background:#000; height:80px;
display:none;
width:900px;
top: -39px; /* 1x the distance of the footer used to be 78 */
}

#bannerTD #bannerFooterNav {
position: relative;
border: 1px solid grey;
top: -117px; /* 2x the distance of the footer used to be 156*/
}
 
.footerCell{ padding:5px; text-align:left; border:0px #F90 solid;}
.footerCell .footerTitle {font-family:tahoma, arial; font-size:11px; color:#fff; font-weight: bold;}
.footerCell .footerDesc {font-family:tahoma, arial; font-size:11px; color:#efefef;}
.footerCell ul {list-style: none; margin: 2px; margin-left: 75px; padding-left: 10px;}
.footerCell ul li {margin: 2px; line-height: 13px; padding: 0;}
.footerLink {text-align: right;}
 
.footerCell .imgDiv{ position:relative; float:left; width:80px; height:65px; margin: 2px 1px 0px 1px;}
.bttnMore {width:57px; height:19px; float: right;}
.bttnMore a{display: block; background:url(images/welcome-banner/gen/bttn_more_small.png) 0 0 no-repeat; line-height: 19px; text-decoration: none;}
 
.imgBgDiv_i {
width:82px; height:67px;
//background: url(images/welcome-banner/gen/thumbBgBordered.png) 0 0 no-repeat;
padding: 0;
float:left;
}

</style>

</head>

<body>
<body id="exterior">
<div id="body-bg">
</div>
    <div id="container">

    <div id="header">

        <a href="index.php<?php echo $referral_string?>">
        <div id="logo">
        </div></a><!--end of logo-->
       
        <div id="updates">
        <span>&nbsp;</span>
        </div><!--end of updates-->
       
        <div id="login">
         <div id="loginwelcome">
       
<?php if(!isset($_SESSION['username']) || !isset($_SESSION['password'])){  ?>
<?php if($final_report !=""){?>
<font color="red"><? echo $final_report;?></font>
<?php }else { ?>Welcome Guest, not a member? <a href="register.php<?php echo $referral_string?>"><b>Register Now!</b></a> <?php } ?>
   
   </div><!--end of loginwelcome-->
   <form action="" method="post">
                <p>
                <input type="text" title="username" name="username" class="username" value="Username" onclick="if ( value == 'Username' ) { value = ''; }"/>
                <input name="password" type="password" class="password" title="password" value="Password" onclick="if ( value == 'Password' ) { value = ''; }"/>
                <input type="Submit" name="login" class="submit" value="login" tabindex="3" />
                </p>
            </form>
            </div><!--end of login-->
           
<?php } ?>

<?php if(isset($_SESSION['username']) && isset($_SESSION['password'])){  ?>
<table>
   <tr>
       <td>
  Welcome <b><?php echo $membername ?></b>
   </td>
   </tr>
   <tr>
   <td align="right" width="310">
   &nbsp;&nbsp;&nbsp;&nbsp;Total Points: <b><?php echo $memberpoints ?></b><br>
  <?php if ($pointsneeded<=0){ ?>
  You can now request a reward!<?php }else { ?>
&nbsp;&nbsp;&nbsp;&nbsp;Points Needed: <b><?php echo $pointsneeded ?> <?php } ?>

</b><br>
</td>
</tr>
</table>
</div>
<!--end of header-->
<?php } ?>

<div id="navigation">
  <?php if(isset($_SESSION['username']) && isset($_SESSION['password'])){  ?>
  <table id="navi-items">
  <tr><td>

<div class="navi-item navi-item-selected">
<div class="navi-heading navi-heading-selected">
<a href="index.php"><img src="images/home.png" alt="Home" /></a>
</div>
</div>


<div class="navi-spacer"></div>


<div class="navi-item">
<div class="navi-heading">
<a href="vouchers.php"><img src="images/rewards.png" alt="Rewards" /></a>
</div>
</div>


<div class="navi-spacer"></div>


<div class="navi-item">
<div class="navi-heading">
<a href="testimonials.php"><img src="images/testimonials.png" alt="Testimonials" /></a>
</div>
</div>


<div class="navi-spacer"></div>


<div class="navi-item">
<div class="navi-heading">
<a href="terms.php"><img src="images/terms.png" alt="Terms" /></a>
</div>
</div>

 
<div class="navi-spacer"></div>


<div class="navi-item">
<div class="navi-heading">
<a href="help.php"><img src="images/help.png" alt="Help" /></a>
</div>
</div>


<div class="navi-spacer"></div>

<div class="navi-item">
<div class="navi-heading">
<a href="contact.php"><img src="images/contact-us.png" alt="Contact Us" /></a>
</div>
</div>
</td></tr>
  </table>
  <?php }else { ?>
  <table id="navi-items">
  <tr><td>

<div class="navi-item navi-item-selected">
<div class="navi-heading navi-heading-selected">
<a href="index.php"><img src="images/home.png" alt="Home" /></a>
</div>
</div>


<div class="navi-spacer"></div>


<div class="navi-item">
<div class="navi-heading">
<a href="vouchers.php"><img src="images/rewards.png" alt="Rewards" /></a>
</div>
</div>


<div class="navi-spacer"></div>


<div class="navi-item">
<div class="navi-heading">
<a href="testimonials.php"><img src="images/testimonials.png" alt="Testimonials" /></a>
</div>
</div>


<div class="navi-spacer"></div>


<div class="navi-item">
<div class="navi-heading">
<a href="terms.php"><img src="images/terms.png" alt="Terms" /></a>
</div>
</div>

 
<div class="navi-spacer"></div>


<div class="navi-item">
<div class="navi-heading">
<a href="help.php"><img src="images/help.png" alt="Help" /></a>
</div>
</div>


<div class="navi-spacer"></div>

<div class="navi-item">
<div class="navi-heading">
<a href="contact.php"><img src="images/contact-us.png" alt="Contact Us" /></a>
</div>
</div>
</td></tr>
  </table>
  <?php } ?>
</div><!--end of navigation-->



<!-- ______________________ BANNER ___________________-->
<tr><td id="bannerTD">
        <div id="bannerContainer">
<div id="bannerBody">
                <br /><img src="images/banner.png" border="0" alt="Banner" />
</div>
</div>
       
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="register.php"><img src="images/signup.png" /></a>
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
        <a href="points.php"><img src="images/earn.png" /></a>
        &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;<a href="vouchers.php"><img src="images/get.png" /></a>
</td></tr>
<!-- ______________________ /BANNER ___________________-->






<div id="contents-top"></div>
<div id="contents">
    <div class="content-block">
 
    <h1>How does <?php echo $title?> work?</h1><br><br>
     
     <a href="register.php<?php echo $referral_string?>"><center><img src="images/step1.png" border="0"><img src="images/step1a.png" border="0"></a><a href="points.php<?php echo $referral_string?>"><img src="images/step2.png" border="0"><img src="images/step2a.png" border="0"><a href="vouchers.php<?php echo $referral_string?>"><img src="images/step3.png" border="0"></center></a>
     <br>
<br>
     <p>
        It's easy to use your free time to earn <a href="vouchers.php<?php echo $referral_string?>"><b>rewards</b></a>. While you certainly won't get rich quick or instantly win prizes, if you put in a bit of effort you can earn whatever you want! You can redeem points for online goods or for vouchers such as Amazon, iTunes, ASOS and Xbox Live, the choice is yours.
<br><br>
While you learn about new products, share information about yourself, or sign up for online services, you earn points. While MOST OFFERS ARE FREE, you will also find cashback shopping and paid/trial offers - a great way to get a deal on your online purchases! <br><br>
</p>

<h1>Just 3 steps to success!</h1>
<p><br>
1. <b>Register:</b> The sign up process takes about 10 seconds, and we'll even give you <font color=#fcbc0c><b><?php echo $bonuspoints ?> FREE BONUS POINTS</b></font> when you <a href="register.php<?php echo $referral_string?>"><b>register</b></a>.<br><br>
2. <b>Earn points:</b> To be able to offer our users FREE gift vouchers to use at online stores such as Amazon and ASOS, you need to earn points. Earning these points are FREE, and you just need to complete a few surveys to get enough points to claim a free voucher. You can also earn points by signing up to some trial offers, but we recommend you stick to the free surveys for now.<br><br>
3. <b>Get Rewards:</b> Once you have earned <?php echo $mainpointsneeded ?> points on <?php echo $title?> you can swap them for REAL products or vouchers, which can be used at online stores/communities. Basically, you can request ANY product or voucher, as long as we can buy it online and send to you via email or shipping. On top of this, if you wish to have something custom ordered, feel free to tell us something what it is and we can always help you out! The rewards you can receive  are endless........

      </p>
       
        <h1>What are points worth?</h1>
        <p>
        <br>
10 points = $1.00/&pound;0.50<br>
50 points = $5.00/&pound;2.50<br>
100 points = $10.00/&pound;5.00<br>
200 points = $20.00/&pound;10.00
<br><br>
You need <?php echo $mainpointsneeded ?> points before you can redeem them for <a href="vouchers.php<?php echo $referral_string?>">rewards</a>. 
<br>

        </p>
        <h1>How do I know Simple Rewards is legit?</h1>
        <p>There's no doubt that in today's world fake companies are  everywhere. So how do you know Simple Rewards is, in fact, legit? To start,  Simple Rewards has already paid out over $10,000 in the last month. This shows  not only that we are a legitimate business but also that we are a very active one. If you would like to see more proof of our legitimacy, feel  free to check out our <a href="testimonials.php">Testimonials </a> section and read some of the latest testimonials written by Simple Rewards users!
        </p>
        <br />
      <h1>Reward Ideas</h1>
        <p>
        <br />
       
          <img src="images/ps3.png">&nbsp;&nbsp;
  <img src="images/giftcards.png">&nbsp;&nbsp;
  <img src="images/ipodtouch.png">&nbsp;&nbsp;
        </p>
        <p><center>
          <p><a href="index.php"><img src="images/largebanner.gif" /><hr width="75%">
          <script type=text/javascript language=JavaScript src=http://www.linkreferral.com/networkads2.pl?refid=341046&height=1&width=3&category=money making opportunities&subcategory=services ></script></a></p>
        </center></p>     
       
    </div><!--end of contentblock-->
    </div><!--end of contents-->
    <div id="contents-bottom"></div>
    </div><!--end of container-->
    </div>
<?php include("footer.php");?>

Hi,     Recently I've been trying writing a safe password hash and I wanted to know that if I use an MD5 hash at the end, just so it will be like some short of "packed",so instead of saving a 128 string, I'll use md5 to "pack" it into 32 characters and save up to 96 characters.   I know MD5 isn't safe and all, but the question is, does it lower the security ?   Also, would be happy for feedbacks about my password hash

function hash_($input,$key) {

     $op=hash("whirlpool",hash("sha512",$key) . "$" . $input . "$" . hash("sha512",$key));

Hello.

Through MySQL, I created a database using the following code:
Code: [Select]
create database auth;
use auth;
create table authorized_users ( name varchar(20),
                                password varchar(40),
                                        primary key     (name)
                              );
insert into authorized_users values ( 'username',
                                      'password' );

insert into authorized_users values ( 'testuser',
                                      sha1('password') );
grant select on auth.*
             to 'webauth'
             identified by 'webauth';
flush privileges;


Then I used the following code to set up a simple log in page.

Code: [Select]
<?php
  $name = $_POST['name'];
  $password = $_POST['password'];

  if ((!isset($name)) || (!isset($password))) {
  //Visitor needs to enter a name and password
?>
    <h1>Please Log In</h1>
    <p>This page is secret.</p>
    <form method="post" action="secretdb.php">
    <p>Username: <input type="text" name="name"></p>
    <p>Password: <input type="password" name="password"></p>
    <p><input type="submit" name="submit" value="Log In"></p>
    </form>

<?php
  } else {
    // connect to mysql
    $mysql = mysqli_connect("localhost", "webauth", "webauth");
    if(!$mysql) {
      echo "Cannot connect to database.";
      exit;
    }
    // select the appropriate database
    $selected = mysqli_select_db($mysql, "auth");
    if(!$selected) {
      echo "Cannot select database.";
      exit;
    }

    // query the database to see if there is a record which matches
    $query = "select count(*) from authorized_users where
              name = '".$name."' and
              password = sha1('".$password."')";

    $result = mysqli_query($mysql, $query);
    if(!$result) {
      echo "Cannot run query.";
      exit;
    }
    $row = mysqli_fetch_row($result);
    $count = $row[0];

    if ($count > 0) {
      // visitor's name and password combination are correct
      echo "<h1>Here it is!</h1>
            <p>I bet you are glad you can see this secret page.</p>";
    } else {
      // visitor's name and password combination are not correct
      echo "<h1>Go Away!</h1>
            <p>You are not authorized to use this resource.</p>";
    }
  }
?>

When I open up this page, above "Please Log In", I get this error:

Notice: Undefined index: name in C:\xampp\htdocs\learning\secretdb.php on line 2

Notice: Undefined index: password in C:\xampp\htdocs\learning\secretdb.php on line 3



Moreover, when I type in an authorized username and password, I get another error:

Warning: mysqli_connect() [function.mysqli-connect]: (28000/1045): Access denied for user 'webauth'@'localhost' (using password: YES) in C:\xampp\htdocs\learning\secretdb.php on line 19
Cannot connect to database.


Does anyone know what I'm doing wrong? I'm fairly new to PHP and MySQL and I'm pretty stuck. Thanks.