PHP - Php Login Flat File Db- Security Question

I am creating a guestbook for a friend who has access to a hosting server for free, however they are reluctant to let us create databases so i have used a flat file system to create a simple login and register system. On this site I have also included a flatfile guestbook, I've not coded this from scratch as I'm just not php freak enough for it. The guestbook requires a name and email address to submit a post, i would like to change this so that it takes the details straight from the flatfile and not be displayed at all if there is no-one logged in.

Guestbook.php
<?php
  // find out the domain:
  $domain = $_SERVER['HTTP_HOST'];
  // find out the path to the current file:
  $path = $_SERVER['SCRIPT_NAME'];
$url = "http://" . $domain . $path  ;
extract($_POST);
if($Submit){
$date = date('D d Y h:i');

$comment=eregi_replace("\r\n","*",$comment);
$comment=eregi_replace("\n","*",$comment);
$fp = fopen("bin/guestbook.nfo","a+");

if(!$fp) {
    echo 'Error: Cannot open file.';
    exit;
}

fwrite($fp, $date."||".$name."||".$email."||".$comment."\n");

fclose($fp);

 }
?>



<div align="center">
  <h2><span class="style1">Guestbook </span><br>
  </h2>
</div>
<form name="form1" method="post" action="<?php echo $url;?>">
  <label>Name
  <input type="text" name="name">
  </label>




  <label>Email
  <input type="text" name="email">
  </label>
  <p>&nbsp;</p>
  <p>
    comment<br>
    <textarea name="comment" cols="40" rows="10"></textarea>

    <br>
    <label>
    <input type="submit" name="Submit" value="Sign">
    </label>
    <br>
    </p>
</form>
<hr>

<?php

$userinfo = file("cgi-bin/guestbook.nfo");

   echo '<table border="0">';

foreach($userinfo as $val)

{
   //explode that data into a new array:
   $data = explode("||", $val);


  echo '<tr><td>'.$data[0].'</td></tr>';
   echo '<tr><td>'.$data[1].' Wrote:</td></tr>';

    $data[3]=eregi_replace("\*","<br>",$data[3]);

   echo '<tr><td>'.$data[3].'</td></tr>';
   echo '<tr><td>Email:'.$data[2].'<hr></td></tr>';
}


   echo '</table>';



 ?>

Hello Mates,
         I am in need of help. I have a Flat File News Script. I am not sure how to build the Delete script..
i am not knew to PHP but kinda new to Flat File Database.. the reason why im using FFD is because my service doesn't allow mysql on the cheaper priced web pages.. i have 4 fields     ID || user_name || title || message

i want it to check the id because it will be in the url like  http://webpage.com/delete_news.php?id=3  and the id 3 and the other fields in id 3 is deleted.

Thank you
Valkeri2010

This topic has been moved to Miscellaneous.

http://www.phpfreaks.com/forums/index.php?topic=315620.0

Hi, I use MySQL for real projects of course... but, I like to challenge myself and I was wondering how people make advance applications with Flat File databases... My questions are...

>Display
  >Reading The Flat File Data
  >Sorting it Alphabetically For Display
  >How to create a WHERE clause affect with the data

>Storage
  >Adding Records
  >Deleting Records
  >Editing Records

I went over a lot of this on my own, but I'm stuck on certain parts because google only has so much on Flat File Databases... also how would u secure a Flat File Database from someone just simply direct linking to it and viewing it?

I currently have a flat file user registration and login in system. I also have a simple guestbook which i didn't code myself, the guest book currently requires the user to type in there name and e-mail address to make a post. how ever i would like them to have to login and if they aren't logged in then don't display the guestbook.

Live version:
B50crew.co.uk

Guestbook.php:
Code: [Select]
<?php
  // find out the domain:
  $domain = $_SERVER['HTTP_HOST'];
  // find out the path to the current file:
  $path = $_SERVER['SCRIPT_NAME'];
$url = "http://" . $domain . $path  ;
extract($_POST);
if($Submit){
$date = date('D d Y h:i');

$comment=eregi_replace("\r\n","*",$comment);
$comment=eregi_replace("\n","*",$comment);
$fp = fopen("bin/guestbook.nfo","a+");

if(!$fp) {
    echo 'Error: Cannot open file.';
    exit;
}

fwrite($fp, $date."||".$name."||".$email."||".$comment."\n");

fclose($fp);

 }
?>



<div align="center">
  <h2><span class="style1">Guestbook </span><br>
  </h2>
</div>
<form name="form1" method="post" action="<?php echo $url;?>">
  <label>Name
  <input type="text" name="name">
  </label>




  <label>Email
  <input type="text" name="email">
  </label>
  <p>&nbsp;</p>
  <p>
    comment<br>
    <textarea name="comment" cols="40" rows="10"></textarea>

    <br>
    <label>
    <input type="submit" name="Submit" value="Sign">
    </label>
    <br>
    </p>
</form>
<hr>

<?php

$userinfo = file("cgi-bin/guestbook.nfo");

   echo '<table border="0">';

foreach($userinfo as $val)

{
   //explode that data into a new array:
   $data = explode("||", $val);


  echo '<tr><td>'.$data[0].'</td></tr>';
   echo '<tr><td>'.$data[1].' Wrote:</td></tr>';

    $data[3]=eregi_replace("\*","<br>",$data[3]);

   echo '<tr><td>'.$data[3].'</td></tr>';
   echo '<tr><td>Email:'.$data[2].'<hr></td></tr>';
}


   echo '</table>';



 ?>
Login:
Code: [Select]
<?php
  // find out the domain:
  $domain = $_SERVER['HTTP_HOST'];
  // find out the path to the current file:
  $path = $_SERVER['SCRIPT_NAME'];
$url = "http://" . $domain . $path  ;
extract($_POST);
if($Submit){
$date = date('D d Y h:i');

$comment=eregi_replace("\r\n","*",$comment);
$comment=eregi_replace("\n","*",$comment);
$fp = fopen("bin/guestbook.nfo","a+");

if(!$fp) {
    echo 'Error: Cannot open file.';
    exit;
}

fwrite($fp, $date."||".$name."||".$email."||".$comment."\n");

fclose($fp);

 }
?>



<div align="center">
  <h2><span class="style1">Guestbook </span><br>
  </h2>
</div>
<form name="form1" method="post" action="<?php echo $url;?>">
  <label>Name
  <input type="text" name="name">
  </label>




  <label>Email
  <input type="text" name="email">
  </label>
  <p>&nbsp;</p>
  <p>
    comment<br>
    <textarea name="comment" cols="40" rows="10"></textarea>

    <br>
    <label>
    <input type="submit" name="Submit" value="Sign">
    </label>
    <br>
    </p>
</form>
<hr>

<?php

$userinfo = file("cgi-bin/guestbook.nfo");

   echo '<table border="0">';

foreach($userinfo as $val)

{
   //explode that data into a new array:
   $data = explode("||", $val);


  echo '<tr><td>'.$data[0].'</td></tr>';
   echo '<tr><td>'.$data[1].' Wrote:</td></tr>';

    $data[3]=eregi_replace("\*","<br>",$data[3]);

   echo '<tr><td>'.$data[3].'</td></tr>';
   echo '<tr><td>Email:'.$data[2].'<hr></td></tr>';
}


   echo '</table>';



 ?>
Session.php

<?php
class user {
    var $file_dir = "";
     
    function start($time = 3600) {
        session_set_cookie_params($time , '');
        session_name('afroxav-login');
        session_start();

         // Reset the expiration time upon page load
        if (isset($_COOKIE['afroxav-login'])) {
            setcookie('afroxav-login', $_COOKIE['afroxav-login'], time() + $time, '', 'localhost', 0, 1);
        }

        if (!isset($_SESSION['info'])) {
            $this->data = array('name' => 'Anonymous', 'logged' => false);
        } else {
            $this->data = $_SESSION['info'];
        }
    }

    function check_login() {
        if ($this->data['logged'] !== true) {
            return false;
        } else if ($this->data['logged'] === true) {
            if ($this->data['name'] !== 'Anonymous') {
                return true;
            }
            return false;
        }
        return false;
    }

    function login($user, $pass) {
        $logins_raw = @file_get_contents($this->file_dir . 'users.php');
        $logins_processed = str_replace('<?php exit; ?>', '', $logins_raw);
        $logins_array = explode('\n', $logins_processed);
        foreach ($logins_array as $id => $line) {
            $logins[$id] = explode('|', $line);
        }
        $pass = $this->hash_pass($pass);

        foreach ($logins as $user_info) {
            if ($user_info[1] == $user) {
                if ($user_info[2] == $pass) {
                    $this->update_session($user_info);
                    return true;
                }
            }
        }

        return false;
    }

    function hash_pass($string) {
        return hash('sha512', $string);
    }

    function logout() {
        $_SESSION['info'] = array('name' => 'Anonymous', 'logged' => false);
        $this->data = $_SESSION['info'];
        return true;
    }

    function prep_reg_array($name, $pass, $email, $mod = 'false', $admin = 'false') {
        $id_raw = @file_get_contents($this->file_dir . 'id.php');
        $id = str_replace('<?php exit; ?>', '', $id_raw);
        $id = $id + 1;
        @file_put_contents($this->file_dir . 'id.php', '<?php exit; ?>' . $id);
        return array($id, $name, $this->hash_pass($pass), $email, $mod, $admin);
    }

    function register($userdata) {
        $write = file_put_contents($this->file_dir . 'users.php', '\n' . implode('|', $userdata), FILE_APPEND);
        return ($write !== false) ? true : false;
    }

    function update_session($array) {
        $_SESSION['info'] = array(
            'id'        => $array[0],
            'name'        => $array[1],
            'pass'        => $array[2],
            'email'        => $array[3],
            'mod'        => $array[4],
            'admin'        => $array[5],
            'logged'    => true
        );
        $this->data = $_SESSION['info'];
    }
};

//html related functions
//not related at all with the sessions
function html_start($title) {
    header('Content-type: text/html');

    echo "<html>\n";
    echo "<head>\n";
    echo "<title>\n";
    echo $title;
    echo "</title>\n";
    echo "</head>\n";
    echo "<body>\n";
    echo "<h1>\n";
    echo $title;
    echo "</h1>\n";
}

function html_nav() {
    global $user;
     
    echo "<div>\n";
    echo "Navigation\n";
    echo "<ul>\n";
    echo "<li><a href=\"?page=home\">Home</a></li>\n";
    if ($user->check_login() == true) {
        echo "<li><a href=\"?page=logout\">Log Out</a></li>\n";
    } else {
        echo "<li><a href=\"?page=login\">Log In</a></li>\n";
        echo "<li><a href=\"?page=register\">Register</a></li>\n";
    }
    echo "</ul>\n";
    echo "</div>\n";     
}

function html_end() {
    echo "</body>\n";
    echo "</html>\n";
}
?>