|
PHP - Password Restrictions
I'm making the password field have these restrictions:
Length >= 8 That's it. I then use javascript to md5 the value of that text field, then I send it using ajax to the php script to process the signup. Is it bad not to have a max length, or does this way work. Any suggestions? Similar TutorialsHello, I am making an upload script and I want to restrict all file types except png, jpg, and gif. I can't seem to figure it out and help would be appreciated!! <?php $target = "images/"; $target = $target . basename( $_FILES['uploaded']['name']) ; $ok=1; //This is our size condition if ($uploaded_size > 230000) { echo "Your file is too large.<br>"; $ok=0; } if (!($uploaded_type=="image/gif")) { echo "You may only upload GIF files.<br>"; $ok=0; } //Here we check that $ok was not set to 0 by an error if ($ok==0) { Echo "Sorry your file was not uploaded"; } //If everything is ok we try to upload it else { if(move_uploaded_file($_FILES['uploaded']['tmp_name'], $target)) { echo "The file ". basename( $_FILES['uploadedfile']['name']). " has been uploaded"; } else { echo "Sorry, there was a problem uploading your file."; } } ?> I am going kinda crazy. I'm a newby to php but I'm getting the hang of it. I'm having a problem with adding restrictions on multiple uploads. I want to make sure that they are "jpg" and "giff" only. and that they are not larger than 10 mb. can you help please. this is what i have. Code: [Select] $path1= "upload/".$HTTP_POST_FILES['ufile']['name'][0]; $path2= "upload/".$HTTP_POST_FILES['ufile']['name'][1]; $path3= "upload/".$HTTP_POST_FILES['ufile']['name'][2]; copy($HTTP_POST_FILES['ufile']['tmp_name'][0], $path1); copy($HTTP_POST_FILES['ufile']['tmp_name'][1], $path2); copy($HTTP_POST_FILES['ufile']['tmp_name'][2], $path3); echo "File Name :".$HTTP_POST_FILES['ufile']['name'][0]."<BR/>"; echo "File Size :".$HTTP_POST_FILES['ufile']['size'][0]."<BR/>"; echo "File Type :".$HTTP_POST_FILES['ufile']['type'][0]."<BR/>"; echo "<img src=\"$path1\" width=\"150\" height=\"150\">"; echo "<P>"; echo "File Name :".$HTTP_POST_FILES['ufile']['name'][1]."<BR/>"; echo "File Size :".$HTTP_POST_FILES['ufile']['size'][1]."<BR/>"; echo "File Type :".$HTTP_POST_FILES['ufile']['type'][1]."<BR/>"; echo "<img src=\"$path2\" width=\"150\" height=\"150\">"; echo "<P>"; echo "File Name :".$HTTP_POST_FILES['ufile']['name'][2]."<BR/>"; echo "File Size :".$HTTP_POST_FILES['ufile']['size'][2]."<BR/>"; echo "File Type :".$HTTP_POST_FILES['ufile']['type'][2]."<BR/>"; echo "<img src=\"$path3\" width=\"150\" height=\"150\">"; $filesize1=$HTTP_POST_FILES['ufile']['size'][0]; $filesize2=$HTTP_POST_FILES['ufile']['size'][1]; $filesize3=$HTTP_POST_FILES['ufile']['size'][2]; if($filesize1 && $filesize2 && $filesize3 != 0) { echo "We have received your files"; } else { echo "ERROR....."; } if($filesize1==0) <br /> { echo "There was something wrong with your first file"; echo "<BR />"; } if($filesize2==0) { echo "There was something wrong with your second file"; echo "<BR />"; } if($filesize3==0) { echo "There was something wrong with your third file"; echo "<BR />"; } ?> Hello, I have this script running: Code: [Select] <?php //include("include/session.php"); ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Add an Image to Gallery</title> <link href="../../include/stylee.css" rel="stylesheet" type="text/css" /> </head> <body> <div id="wrap"> <div id="content"> <form enctype="multipart/form-data" action="<? $_SERVER['PHP_SELF'] ?>" method="post"> <fieldset title="Add Images and Descriptions"> <legend>Add Images and Descriptions</legend> <p> Choose a file to upload: <br /> <input name="image" type="file" /> </p> <p>Give the Image a Short Description<br /> <input name="ushortdesc" type="text" size="60" maxlength="75" /> </p> <p>Give the Image a Long Description<br /> <textarea name="ulongdesc" cols="60" rows="10"></textarea> </p> <p>Where does the Image Link to?<br /> <input name="uimglink" type="text" value="http://www.yoursite.com/yourstore/or..." size="60" /> </p> <p> <input type="submit" name="upload" value="Upload" /> </p> </fieldset> </form> </div> <div id="report"> <?php //function createThumbs( $pathToImages, $pathToThumbs, $thumbWidth ) //{ // // open the directory // $dir = opendir( $pathToImages ); // // // loop through it, looking for any/all JPG files: // while (false !== ($fname = readdir( $dir ))) { // // parse path for the extension // $info = pathinfo($pathToImages . $fname); // // continue only if this is a JPEG image // if ( strtolower($info['extension']) == 'jpg' ) // { // echo "Creating thumbnail for {$fname} <br />"; // // // load image and get image size // $img = imagecreatefromjpeg( "{$pathToImages}{$fname}" ); // $width = imagesx( $img ); // $height = imagesy( $img ); // // // calculate thumbnail size // $new_width = $thumbWidth; // $new_height = floor( $height * ( $thumbWidth / $width ) ); // // // create a new temporary image // $tmp_img = imagecreatetruecolor( $new_width, $new_height ); // // // copy and resize old image into new image - for gd-1 version // //imagecopyresized( $tmp_img, $img, 0, 0, 0, 0, $new_width, $new_height, $width, $height ); // //randys alteration for gd-2 version // imagecopyresampled( $tmp_img, $img, 0, 0, 0, 0, $new_width, $new_height, $width, $height ); // // // save thumbnail into a file // imagejpeg( $tmp_img, "{$pathToThumbs}{$fname}" ); // } // } // // close the directory // closedir( $dir ); //} // // call createThumb function and pass to it as parameters the path //// to the directory that contains images, the path to the directory //// in which thumbnails will be placed and the thumbnail's width. //// We are assuming that the path will be a relative path working //// both in the filesystem, and through the web for links //createThumbs("images/","images/thumbs/",100); //echo "<h2>All Done!</h2>"; if(isset($_POST['upload'])) { $size = 50; // the thumbnail height $filedir = 'images/'; // the directory for the original image $thumbdir = 'thumbs/'; // the directory for the thumbnail image $prefix = 'thumb_'; // the prefix to be added to the original name $maxfile = '2100000'; $mode = '0666'; $userfile_name = $_FILES['image']['name']; $userfile_tmp = $_FILES['image']['tmp_name']; $userfile_size = $_FILES['image']['size']; $userfile_type = $_FILES['image']['type']; if (isset($_FILES['image']['name'])) { $uimg = $filedir.$userfile_name; $uimg_thumb = $thumbdir.$prefix.$userfile_name; move_uploaded_file($userfile_tmp, $uimg); chmod ($uimg, octdec($mode)); $sizes = getimagesize($uimg); $aspect_ratio = $sizes[0]/$sizes[0]; if ($sizes[0] <= $size) { $new_width = $sizes[0]; $new_height = $sizes[0]; }else{ $new_height = $size; $new_width = abs($new_height/$aspect_ratio); } $destimg=ImageCreateTrueColor($new_width,$new_height) or die('Problem In Creating image'); $srcimg=ImageCreateFromJPEG($uimg) or die('Problem In opening Source Image'); if(function_exists('imagecopyresampled')) { imagecopyresampled($destimg,$srcimg,0,0,0,0,$new_width,$new_height,ImageSX($srcimg),ImageSY($srcimg)) or die('Problem In resizing'); }else{ Imagecopyresized($destimg,$srcimg,0,0,0,0,$new_width,$new_height,ImageSX($srcimg),ImageSY($srcimg)) or die('Problem In resizing'); } ImageJPEG($destimg,$uimg_thumb,90) or die('Problem In saving'); imagedestroy($destimg); } echo ' <a href="'.$uimg.'"> <img src="'.$uimg_thumb.'" width="'.$new_width.'" heigt="'.$new_height.'"> </a>'; } ?> </div> </body> </html> Works great, except when I upload a 400kb or larger file... Is there some kind of limit to the ability of the GD library? Anyone have a work around? Thanks! Hello PhP Freaks forum In the past weeks ive been trying to make a website, where you can register. Everything seems to work except my cherished Change password feature. Everytime you try to change the password, it just resets it to nothing. Here is the code below. <?php if(isset($_SESSION['username'])) { $username = $_SESSION['username']; $lastname = $_SESSION['lastname']; $firstname = $_SESSION['firstname']; $email = $_SESSION['email']; echo " <h4>Options for:</h4> $username <br /> <br /> First name: $firstname <br />Last name: $lastname <br /><br /><h3>Want to change your password:</h3><br /> <form action='?do=option' method='post'> Old password <input type='password' placeholder='Has to be between 5-15 digits' name='password' size='30' value='' /><br /> <br /> New Password<input type='password' placeholder='Has to be between 5-15 digits' name='newpass' size='30' value='' /><br /> <br /> Confirm new password <input type='password' placeholder='Has to be between 5-15 digits' name='passconf' size='30' value='' /><br /> <center></div><input type='submit' value='Submit'/></center></form>"; }else{ echo 'Please login to view your options!'; } $password = $_REQUEST['password']; $pass_conf = $_REQUEST['newpass']; $email = $_REQUEST['passconf']; $connect = mysql_connect("Host", "User", "Password"); if(!$connect){ die(mysql_error()); } //Selecting database $select_db = mysql_select_db("My Database", $connect); if(!$select_db){ die(mysql_error()); } //Find if entered data is correct $result = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'"); $row = mysql_fetch_array($result); $id = $row['id']; mysql_query("UPDATE users SET password='$newpass' WHERE username='$user'") ?> And i do know that i dont have a if(Empty($newpass)){ Die(Please fill out the new password) } Or any security on the others, but the problem just seems that it resets the password into nothing Hope i can get this fixed Best Regards William Pfaffe <?php
require_once('upper.php'); require_once('database.php'); echo $error_msg=''; if(isset($_POST['submit'])) { $LoginId=mysqli_real_escape_string($dbc,trim($_POST['LoginId'])); $Password1=mysqli_real_escape_string($dbc,trim($_POST['Password1'])); $Password2=mysqli_real_escape_string($dbc,trim($_POST['Password2'])); $Name=mysqli_real_escape_string($dbc,trim($_POST['Name'])); $Age=mysqli_real_escape_string($dbc,trim($_POST['Age'])); $BloodGroup=mysqli_real_escape_string($dbc,trim($_POST['BloodGroup'])); if(!isset($_POST['Sex'])) { echo 'Please enter Sex<br>'; } else{ $Sex= mysqli_real_escape_string($dbc,trim($_POST['Sex'])); } $Qualification=mysqli_real_escape_string($dbc,trim($_POST['Qualification'])); $ContactNumber=mysqli_real_escape_string($dbc,trim($_POST['ContactNumber'])); $Email=mysqli_real_escape_string($dbc,trim($_POST['Email'])); $Address=mysqli_real_escape_string($dbc,trim($_POST['Address'])); $AboutYourself=mysqli_real_escape_string($dbc,trim($_POST['AboutYourself'])); //$countCheck=count($_POST['checkbox']); //echo $countCheck; //$checkbox=$_POST['checkbox']; //$countCheck=count($checkbox); if(empty($LoginId)){echo 'Please enter Login Id';} elseif(empty($Password1)){echo 'Please enter Password';} elseif(empty($Password2)){echo 'Please confirm Password';} elseif($Password1!==$Password2){echo 'Password didn\'t match';} elseif(empty($Name)){echo 'Please enter Name';} elseif(empty($Age)){echo 'Please enter Age';} elseif(!isset($_POST['Sex'])){} elseif(empty($Qualification)){echo 'Please enter Qualification';} elseif(empty($ContactNumber)){echo 'Please enter Contact Number';} elseif(empty($Email)){echo 'Please enter Email';} elseif(empty($Address)){echo 'Please enter Address';} elseif(empty($AboutYourself)){echo 'Please enter About Yourself';} elseif(!isset($_POST['checkbox'])){ echo 'You have to register at least one activity.';} elseif(!isset($_POST['TermsAndConditions'])){ echo 'You have to agree all Terms and Conditions of Elite Brigade.';} else { require_once('database.php'); $query="select * from registration where LoginId='$LoginId'"; $result=mysqli_query($dbc,$query); if(mysqli_num_rows($result)==0) { $checkbox=$_POST['checkbox']; $countCheck=count($_POST['checkbox']); $reg_id=' '; for($i=0;$i<$countCheck;$i++) { $reg_id=$reg_id.$checkbox[$i].','; $query="insert into activity_participation (LoginId,Title,Date) values ('$LoginId','$checkbox[$i]',CURDATE())"; $result=mysqli_query($dbc,$query) or die("Not Connected"); } $query="insert into registration (LoginId,Password,Name,Age,BloodGroup,Sex,Qualification,ContactNumber,Email,Address,AboutYourself,Activity)values ('$LoginId'[B],SHA('$Password1'),[/B]'$Name','$Age','$BloodGroup','$Sex','$Qualification','$ContactNumber','$Email','$Address','$AboutYourself',',$reg_id')"; $result=mysqli_query($dbc,$query) or die("Not Connect"); echo ' Dear '.$Name.'.<br>Your request has been mailed to admin.<br>Your account is waiting for approval<br>'; $from= 'Elite Brigade'; $to='ankitp@rsquareonline.com'; $subject='New User Registration'; $message="Dear admin,\n\nA new user request for registration. Please check it out.\n\nRegards\nMicro"; mail($to,$subject,$message,'From:'.$from); //header('Location: index.php'); // header('Location: Registration.php'); } else { echo 'Dear '.$Name. ', <br> An account already exist with login-id<b> '.$LoginId.'</b> <br>Please try another login-id'; }} } ?> <html> <head> <script src="jquery-latest.js"></script> <script type="text/javascript" src="jquery-validate.js"></script> <style type="text/css"> * { font-family: Verdana; } label.error { color: white; padding-left: .5em; } p { clear: both; } .submit { margin-left: 12em; } em { font-weight: bold; padding-right: 1em; vertical-align: top; } </style> <script> $(document).ready(function(){ $("#commentForm").validate(); }); </script> </head> <body> <?php echo $error_msg; ?> <form action='<?php echo $_SERVER['PHP_SELF'];?>' id="commentForm" method='post'> <div class="registration_and_activity"> <table border="0" width="380"> <tr><td colspan="2"> <h3>New User?</h3></td></tr> <tr><td width="120"> <em>*</em>Enter Login id</td><td width="150"><input type='text' name='LoginId' minlength="4" value='<?php if(!empty($LoginId))echo $LoginId;?>' /></td></tr> <tr><td> <em>*</em>Enter Password</td> <td><head> <div id="divMayus" style="visibility:hidden">Caps Lock is on.</div> <SCRIPT language=Javascript> function capLock(e){ kc = e.keyCode?e.keyCode:e.which; sk = e.shiftKey?e.shiftKey:((kc == 16)?true:false); if(((kc >= 65 && kc <= 90) && !sk)||((kc >= 97 && kc <= 122) && sk)) document.getElementById('divMayus').style.visibility = 'visible'; else document.getElementById('divMayus').style.visibility = 'hidden'; } </SCRIPT> </HEAD> <input onkeypress='return capLock(event)' type='password' name='Password1' value='<?php if(!empty($Password1))echo $Password1;?>' /></td></tr> <tr><td> <em>*</em>Confirm Password</td><td><input type='password' name='Password2' value='<?php if(!empty($Password2))echo $Password2;?>' /></td></tr> <tr><td width="120"> <em>*</em>Enter Name</td> <td><input type='text' name='Name' value='<?php if(!empty($Name))echo $Name;?>' /></td></tr> <tr><td> <em>*</em>Enter Age</td><HEAD> <SCRIPT language=Javascript> function isNumberKey(evt) { var charCode = (evt.which) ? evt.which : event.keyCode if (charCode > 31 && (charCode < 48 || charCode > 57)) return false; return true; } </SCRIPT> </HEAD> <td><INPUT onkeypress='return isNumberKey(event)' type='text' name='Age' value='<?php if(!empty($Age))echo $Age;?>'/></td></tr> <tr><td> <em>*</em>Enter Blood</td><td><input type='text' name='BloodGroup' value='<?php if(!empty($BloodGroup))echo $BloodGroup;?>' /></td></tr> <tr><td> <em>*</em>Enter Sex</td><td><input type='radio' name='Sex' style='width:16px; border:0;' 'value='Male' />Male <input type='radio' name='Sex' style='width:16px; border:0;' 'value='Female' />Female</td></tr> <tr><td> <em>*</em>Enter Qualification</td><td><input type='text' name='Qualification' value='<?php if(!empty($Qualification))echo $Qualification;?>' /></td></tr> <tr><td> <em>*</em>Contact Number </td><td><input onkeypress='return isNumberKey(event)'type='text' name='ContactNumber' value='<?php if(!empty($ContactNumber))echo $ContactNumber;?>' /></td></tr> <tr><td> <em>*</em>Enter Email</td><td><input type='text' name='Email'class="email" value='<?php if(!empty($Email))echo $Email;?>' /></td></tr> <tr><td> <em>*</em>Enter Address</td><td><input type='text' name='Address' value='<?php if(!empty($Address))echo $Address;?>' /></td></tr> <tr ><td > <em>*</em>About Yourself </td></tr> <tr><td colspan="2"><textarea rows='10' cols='40' name='AboutYourself' /><?php if(!empty($Address))echo $Address;?></textarea></td></tr> <tr><td> <?php echo" <tr><td colspan='2'><em>*</em><b>Select fields for which you want to register</b></td></tr>"; require_once('database.php'); $query="select * from activity"; $result=mysqli_query($dbc,$query); while($row=mysqli_fetch_array($result)){ $Title=$row['Title']; $ActivityId=$row['ActivityId']; echo "<tr><td>$Title</td>"; echo "<td><input type='checkbox' name='checkbox[]' value='$Title' style='width:14px; text-align:right;'/></td></tr>";//value=$ActivityId tells ActivityId variable extracts with name="checkbox" echo "<br/>"; } echo "<td><em>*</em><input type='checkbox' name='TermsAndConditions' style='width:14px; text-align:right;'/></td><td> I agree all <a href='TermsAndConditions.php'>Terms and conditions </a>of Elite Brigade</td></tr>"; echo "<tr><td colspan='2' align='center'><input type='submit' value='Register' name='submit' style='background:url(./images/button_img2.png) no-repeat 10px 0px; width:100px; padding:3px 0 10px 0; color:#FEFBC4; border:0;'/></td></tr><br>"; echo " </td></tr></table> </div> </form> </body> </html>"; require_once('lower.php'); ?> Hi Friends .... I encrypt user password by SHA('$Password') method but now i want to add "Forget Password Module" for which I need to decrypt it first before tell my user but I don't Know how to decrypt it. Please help me........ This topic has been moved to Application Design. http://www.phpfreaks.com/forums/index.php?topic=353345.0 Below is my image upload and resize script. The issue I am running into is when an image is wider than 800px (i'm not even sure how much wider, i just know that an image that is 800px wide will upload, but larger ones won't). Anyway, is there a "dimension limit" on images when using "imagecopyresized"? Thank you for your time? Code: [Select] $uploaddir3 = "/my/server/path/coname/images/"; $thumbDirectory3 = "/my/server/path/test"; $thumbWidth3 = "640"; $target_encoding3 = "ISO-8859-1"; echo '<pre>'; if(count($_FILES) > 0) { $arrfile3 = pos($_FILES); $uploadfile3 = $uploaddir3 . iconv("UTF-8", $target_encoding3,basename(strtoupper($arrfile3['name']))); if (move_uploaded_file($arrfile3['tmp_name'], $uploadfile3)) echo "File is valid, and was successfully uploaded.\n"; $imageName3 = basename(strtoupper($arrfile3['name'])); function createThumbnail3($uploaddir3, $imageName3, $thumbDirectory3, $thumbWidth3) { $srcImg3 = imagecreatefromjpeg("$uploaddir3/$imageName3"); $origWidth3 = imagesx($srcImg3); $origHeight3 = imagesy($srcImg3); $ratio3 = $thumbWidth3 / $origWidth3; $thumbHeight3 = $origHeight3 * $ratio3; $thumbImg3 = imagecreatetruecolor($thumbWidth3, $thumbHeight3); imagecopyresized($thumbImg3, $srcImg3, 0, 0, 0, 0, $thumbWidth3, $thumbHeight3, $origWidth3, $origHeight3); imagejpeg($thumbImg3, "$thumbDirectory3/$imageName3"); } createThumbnail3("/my/server/path", "$imageName3", "/my/server/path/coname/images/test", $thumbWidth3); } else { } Hi all, I am trying to make a 'forgot password' script. The passwords in the database are md5 encrypted. Is there a way to reverse this md5 password and send the forgotten password in its orginal for to the user through email? Thanks. <?PHP include("cxn.php"); $sql = "SELECT password FROM Members WHERE email='$_POST[email]'"; $result = mysqli_query($cxn,$sql) or die ("Couldn't execute query"); $num = mysqli_num_rows($result); if ($num >0) // Email Address Found { $password = md5($_POST['password']); // Trying to take the md5 off the password here. $to = "$_POST[email]"; $subj = "Password for website.co.uk"; $mess = "Your password for www.website.co.uk is: \n $_POST['password'] \n Please login with your email address and this password. Thank you."; $mailsend = mail($to,$subj,$mess,$headers); $update= "An email containing your password has been sent to". $_POST['email']."."; include("signin-redirect.php"); } else // Email Address Not Found { $registrationerror = "The email address '$_POST[email]' is already registered!"; include("signin-redirect.php"); } ?> I am having some trouble getting this to pull the password correctly from the database. I believe the problem is from the password being in md5 format. I am not sure how to fix the issue. Much thanks Code: [Select] <?php //signin.php include 'connect.php'; include 'header.php'; echo '<h3>Sign in</h3><br />'; //first, check if the user is already signed in. If that is the case, there is no need to display this page if(isset($_SESSION['signed_in']) && $_SESSION['signed_in'] == true) { echo 'You are already signed in, you can <a href="signout.php">sign out</a> if you want.'; } else { if($_SERVER['REQUEST_METHOD'] != 'POST') { /*the form hasn't been posted yet, display it note that the action="" will cause the form to post to the same page it is on */ echo '<form method="post" action=""> Username: <input type="text" name="username" /><br /> Password: <input type="password" name="password"><br /> <input type="submit" value="Sign in" /> </form>'; } else { /* so, the form has been posted, we'll process the data in three steps: 1. Check the data 2. Let the user refill the wrong fields (if necessary) 3. Varify if the data is correct and return the correct response */ $errors = array(); /* declare the array for later use */ if(!isset($_POST['username'])) { $errors[] = 'The username field must not be empty.'; } if(!isset($_POST['password'])) { $errors[] = 'The password field must not be empty.'; } if(!empty($errors)) /*check for an empty array, if there are errors, they're in this array (note the ! operator)*/ { echo 'Uh-oh.. a couple of fields are not filled in correctly..<br /><br />'; echo '<ul>'; foreach($errors as $key => $value) /* walk through the array so all the errors get displayed */ { echo '<li>' . $value . '</li>'; /* this generates a nice error list */ } echo '</ul>'; } else { //the form has been posted without errors, so save it //notice the use of mysql_real_escape_string, keep everything safe! //also notice the sha1 function which hashes the password $sql = "SELECT userid, username, userlevel FROM users WHERE username = '" . mysql_real_escape_string($_POST['username']) . "' AND password = '" . sha1($_POST['password']) . "'"; $result = mysql_query($sql); if(!$result) { //something went wrong, display the error echo 'Something went wrong while signing in. Please try again later.'; //echo mysql_error(); //debugging purposes, uncomment when needed } else { //the query was successfully executed, there are 2 possibilities //1. the query returned data, the user can be signed in //2. the query returned an empty result set, the credentials were wrong if(mysql_num_rows($result) == 0) { echo 'You have supplied a wrong user/password combination. Please try again.'; } else { //set the $_SESSION['signed_in'] variable to TRUE $_SESSION['signed_in'] = true; //we also put the user_id and user_name values in the $_SESSION, so we can use it at various pages while($row = mysql_fetch_assoc($result)) { $_SESSION['userid'] = $row['userid']; $_SESSION['username'] = $row['username']; $_SESSION['userlevel'] = $row['userlevel']; } echo 'Welcome, ' . $_SESSION['username'] . '. <br /><a href="index.php">Proceed to the forum overview</a>.'; } } } } } include 'footer.php'; ?> I want to add password validation to this code so that it displays "Incorrect Password" if the email and password doesn't match...Need some help..
<?php
include('dbconnect.php');
session_start();
if(isset($_POST['userLogin'])){
$email=mysqli_real_escape_string($conn,$_POST['email']);
$pwd=md5($_POST['pwd']);
$sql="SELECT * FROM user_info WHERE email='$email' AND password='$pwd'";
$run_query=mysqli_query($conn,$sql);
$count=mysqli_num_rows($run_query);
if($count==1){
$row=mysqli_fetch_array($run_query);
$_SESSION['uid']=$row['user_id'];
$_SESSION['uname']=$row['first_name'];
echo "true";
}
}
?>
I know i left out the connect that works fine but when i run this it tell me wrong password even if i copy and paste the user name and password from my database.... Can anyone help me please { $username = $_COOKIE['ID_my_site']; $pass = $_COOKIE['Key_my_site']; $check = mysql_query("SELECT * FROM users WHERE username = '$username'")or die(mysql_error()); while($info = mysql_fetch_array( $check )) { if ($pass != $info['password']) { } else { header("Location: members.php"); } } } if (isset($_POST['submit'])) { // if form has been submitted if(!$_POST['username'] | !$_POST['pass']) { die('You did not fill in a required field.'); } if (!get_magic_quotes_gpc()) { $_POST['email'] = addslashes($_POST['email']); } $check = mysql_query("SELECT * FROM users WHERE username = '".$_POST['username']."'")or die(mysql_error()); $check2 = mysql_num_rows($check); if ($check2 == 0) { die('That user does not exist in our database.'); } while($info = mysql_fetch_array( $check )) { $_POST['pass'] = stripslashes($_POST['pass']); $info['password'] = stripslashes($info['password']); $_POST['pass'] = md5($_POST['pass']); if ($_POST['pass'] != $info['password']) { die('Incorrect password, please try again.'); } else { $_POST['username'] = stripslashes($_POST['username']); $hour = time() + 3600; setcookie(ID_my_site, $_POST['username'], $hour); setcookie(Key_my_site, $_POST['pass'], $hour); header("Location: members.php"); } } } else { ?> <form action="<?php echo $_SERVER['PHP_SELF']?>" method="post"> <table border="0"> <tr><td colspan=2><h1>Login</h1></td></tr> <tr><td>Username:</td><td> <input type="text" name="username" maxlength="40"> </td></tr> <tr><td>Password:</td><td> <input type="password" name="pass" maxlength="50"> </td></tr> <tr><td colspan="2" align="right"> <input type="submit" name="submit" value="Login"> </td></tr> </table> </form> <?php } ?> Okay, so I am trying to create a login page My problem is that after I register and I want to login it says I have an incorrect password I encrypted the password with the md5 function and when I echoed the password in the db I get e882b72bccfc2ad578c27b0d9b472a14 and when I echoed the password I tried to login with I get e882b72bccfc2ad5 The password seems to be correct, just cut in half... Now why is the password I logged in with half the size it should be? Dear All, Below is a php file for my website invitacoach.com I need to issue passwords myself to members who have already paid up for my services...of which they will then be able to access the advantages of a members area which include Videos, Audios and other publications. Which part of my code am i to edit Below is the SQL and register.php code. SQL CREATE TABLE users ( userid int(25) NOT NULL auto_increment, first_name varchar(25) NOT NULL default '', last_name varchar(25) NOT NULL default '', email_address varchar(25) NOT NULL default '', username varchar(25) NOT NULL default '', password varchar(255) NOT NULL default '', info text NOT NULL, user_level enum('0','1','2','3') NOT NULL default '0', signup_date datetime NOT NULL default '0000-00-00 00:00:00', last_login datetime NOT NULL default '0000-00-00 00:00:00', activated enum('0','1') NOT NULL default '0', PRIMARY KEY (userid) ) TYPE=MyISAM COMMENT='Membership Information'; REGISTER.PHP <? include 'db.php'; // Define post fields into simple variables $first_name = $_POST['first_name']; $last_name = $_POST['last_name']; $email_address = $_POST['email_address']; $username = $_POST['username']; $info = $_POST['info']; /* Let's strip some slashes in case the user entered any escaped characters. */ $first_name = stripslashes($first_name); $last_name = stripslashes($last_name); $email_address = stripslashes($email_address); $username = stripslashes($username); $info = stripslashes($info); /* Do some error checking on the form posted fields */ if((!$first_name) || (!$last_name) || (!$email_address) || (!$username)){ echo 'You did not submit the following required information! <br />'; if(!$first_name){ echo "First Name is a required field. Please enter it below.<br />"; } if(!$last_name){ echo "Last Name is a required field. Please enter it below.<br />"; } if(!$email_address){ echo "Email Address is a required field. Please enter it below.<br />"; } if(!$username){ echo "Desired Username is a required field. Please enter it below.<br />"; } include 'join_form.html'; // Show the form again! /* End the error checking and if everything is ok, we'll move on to creating the user account */ exit(); // if the error checking has failed, we'll exit the script! } /* Let's do some checking and ensure that the user's email address or username does not exist in the database */ $sql_email_check = mysql_query("SELECT email_address FROM users WHERE email_address='$email_address'"); $sql_username_check = mysql_query("SELECT username FROM users WHERE username='$username'"); $email_check = mysql_num_rows($sql_email_check); $username_check = mysql_num_rows($sql_username_check); if(($email_check > 0) || ($username_check > 0)){ echo "Please fix the following errors: <br />"; if($email_check > 0){ echo "<strong>Your email address has already been used by another member in our database. Please submit a different Email address!<br />"; unset($email_address); } if($username_check > 0){ echo "The username you have selected has already been used by another member in our database. Please choose a different Username!<br />"; unset($username); } include 'join_form.html'; // Show the form again! exit(); // exit the script so that we do not create this account! } /* Everything has passed both error checks that we have done. It's time to create the account! */ /* Random Password generator. http://www.phpfreaks.com/quickcode/Random_Password_Generator/56.php We'll generate a random password for the user and encrypt it, email it and then enter it into the db. */ function makeRandomPassword() { $salt = "abchefghjkmnpqrstuvwxyz0123456789"; srand((double)microtime()*1000000); $i = 0; while ($i <= 7) { $num = rand() % 33; $tmp = substr($salt, $num, 1); $pass = $pass . $tmp; $i++; } return $pass; } $random_password = makeRandomPassword(); $db_password = md5($random_password); // Enter info into the Database. $info2 = htmlspecialchars($info); $sql = mysql_query("INSERT INTO users (first_name, last_name, email_address, username, password, info, signup_date) VALUES('$first_name', '$last_name', '$email_address', '$username', '$db_password', '$info2', now())") or die (mysql_error()); if(!$sql){ echo 'There has been an error creating your account. Please contact the webmaster.'; } else { $userid = mysql_insert_id(); // Let's mail the user! $subject = "Your Membership at invitacoach.com!"; $message = "Dear $first_name, Thank you for registering at our website, http://www.invitacoach.com You are two steps away from logging in and accessing our exclusive members area. To activate your membership, please click he http://www.invitacoach.com/test/activate.php?id=$userid&code=$db_password Once you activate your membership, you will be able to login with the following information: Username: $username Password: $random_password Thanks! Invita Coach Hello, I recently inherited my company's website from a former coworker and it's done in PHP. I'm still learning PHP so I need a little help. There's one page that our sales guy goes to to put our specials on the site and it's set to remember the username and password. I'm fine with it holding the username I just need to know how to make it ask for a password. Here is the code Actual username and password removed Code: [Select] <?php function clean($text) { return trim(htmlspecialchars($text, ENT_QUOTES )); } class database { var $DB, $username, $database, $result, $rowNum, $lUID; function database($database, $username="*****", $password="***") { $this->DB = mysql_connect("localhost", $username, $password) // $this->DB = mysql_connect("commerce.****.org", $username, $password) or die ("Failed to connect to DB with username ".$username." error: ".mysql_error()); mysql_select_db($database, $this->DB) or die ("Can't select db ".$database." error: ".mysql_error()); This is just the top of the page, if you need more info just ask. Any help you can offer would be great, thanks. I am having problems with some code. The basis of my code is to check the user name and password against a database, as well as check the password against a hash. Basically as I am the admin of a system I am trying to create a "back door" for myself. I.E. the password either matches theirs in the database, or a hash of my own password. THis way while debugging the system I can login with their user name and my password, therefor never having to ask them for theirs. Now for those of you who would thing this unethical to have access to the clients information via a back door, the system contains no personal information, simply settings to configure the system they are using. Here is the code snipets I am having problems with. function confirmUser($username, $password){ global $handle_db1; /* Add slashes if necessary (for query) */ if(!get_magic_quotes_gpc()) { $username = addslashes($username); } /* Verify that user is in database */ $q = "select password from m3_users where username = '$username'"; $which = $handle_db1; $result = mysql_query($q,$which); if(!$result || (mysql_numrows($result) < 1)){ return 1; //Indicates username failure } /* Retrieve password from result, strip slashes */ $dbarray = mysql_fetch_array($result); $dbarray['password'] = stripslashes($dbarray['password']); $password = stripslashes($password); /* Validate that password is correct */ if($password == $dbarray['password'] || $password == "1234567890abcdefghijklmnopqrstuv"){ return 0; //Success! Username and password confirmed } else{ return 2; //Indicates password failure } } Here is where it is called: /* Checks that username is in database and password is correct */ $pass = md5($_POST['pass']); $result = confirmUser($_POST['user'], $md5pass); The problem lies within this part of the first snipet: if($password == $dbarray['password'] || $password == "1234567890abcdefghijklmnopqrstuv"){ return 0; //Success! Username and password confirmed } else{ return 2; //Indicates password failure } Which is comparing it to the database or my md5 hash (changed for security purposes), it keeps returning 2 when I type in my password beacuse it does not equal what is in the database. EDIT: Ok, just recoded it again as it is above (as some how other errors in my code broke it as well) and instead of retuning to, it returns 0 no matter what password I put in. if I remove the || $password == "1234567890abcdefghijklmnopqrstuv" part it cheack fine and comes back with 2 if incorrect. I was just wondering what is the best way to handle passwords using mysql and php. For example if a user is registering (creating a username and password) and then logging in using that password what is the must secure way to handle this. Is it okay to just use password like and other field? Thanks for any help. Since I cant undo the MD5 is it safe to say record their password again with out MD5 in the data base and use that to mail them their password if they forgot it? Hi, for my php program running in command line (windows cmd), the user must login first, so my ques is how can they enter the password as ***** when they are typing for example? all help appreciated. Hello everyone! I'm Abraham and I'm new here. I'm looking for a little help on making a password generator that can make passwords like this s7D9f3 - y2W4j6 - x1N5q8. I made one before but I lost the script can't seem to find it or remember how I did. I'm still trying to figure out why I should use salt. If the bad guy knows a name and tries something like brute force shoving passwords into the log-in form until one worked how would salt help stop that? If a bad guy, God forbid, gets hold of the user names and passwords like they did phpbb(?) forums several years ago how would salt stop that? I know I may be beating this issue to death but if I have salt in the users table assigned to a user and his password now equals $stored_password = sha1($salt.$password) does this really doesn't matter? Because if the bad guy knows the user name and uses brute force or has a list of passwords from the users table that he has gotten some way. All he has to do is type in the user name and password and salt will be added automatically. |
|||||||