Results 1 to 5 of 5

Thread: Authentication Class.FeedBack Please.

Threaded View

  1. #1

    Thread Starter
    Hyperactive Member PlaGuE's Avatar
    Join Date
    Jun 2005
    Location
    in ur mind.
    Posts
    445

    Authentication Class.FeedBack Please.

    This is an Authentication Class i am working on.

    I'd appreciate any feedback on making improvements to its security.
    PHP Code:
    <?
    class AuthClass{
        
        function Exeption($Error = array(), $BREAK = true){
                $this->ErrMessage = "";
                if($BREAK == true){
                $this->ErrMessage = "<br />";
                    foreach($Error as $Err){
                        $this->ErrMessage .= "<br /><strong>Portal Error</strong>:".$Err." \n";
                    }
                      return  trigger_error(exit($this->ErrMessage));
                }else{
                $this->ErrMessage = "<br />";
                    foreach($Error as $Err){
                        $this->ErrMessage .= "<strong>Portal Error</strong>:".$Err." \n";
                    }
                      return  print("".$this->ErrMessage);
                }            
            }
        
        function Authentication($mRank){
            // Authentication Functrion
            if(isset($_POST['AuthLogin'])){
                    if($_POST['userName'] == NULL || $_POST['userName'] == ""){
                        $AuthErrors[] = "You Need to Input A UserName.";
                    }
                    if($_POST['passWord'] == NULL || $_POST['passWord'] == ""){
                        $AuthErrors[] = "You Need to Input A PassWord.";
                    }
                    $DUserName = stripslashes(htmlentities($_POST['userName']));
                    $DPassWord = stripslashes(htmlentities($_POST['passWord']));
                $result = mysql_query("SELECT * FROM users WHERE username='".$DUserName."' AND password = PASSWORD('".$DPassWord."')");
                          if(mysql_num_rows($result) == 0 ){
                                  $AuthErrors[] = "You Have Specified An Incorrect UserName/Password.";
                          }
                          extract($userinfo = mysql_fetch_object($result));
                            if($_POST['RememberMe']){
                                  setcookie("CuSeR",$userinfo->username, time() + 3600);
                                setcookie("CuSeR_ID",$userinfo->ID, time() + 3600);
                            }
                            $_SESSION['CuSeR']    =    $userinfo->username;
                            $_SESSION['CuSeR_ID']    =    $userinfo->ID;
                            $_SESSION['CuSeR_Rank']    =    $userinfo->rank;
                            $_SESSION['CuSeR_LastLogin']    =    $userinfo->lastlogin;

            }
            if(isset($_COOKIE['CuSeR']) && isset($_COOKIE['CuSeR_ID'])){

                $result = mysql_query("SELECT * FROM users WHERE username='".($_COOKIE['CuSeR'])."' OR ID='".$_COOKIE['CuSeR_ID']."'");
                          extract($userinfo = mysql_fetch_object($result));
                            $_SESSION['CuSeR']    =    $userinfo->username;
                            $_SESSION['CuSeR_ID']    =    $userinfo->ID;
                            $_SESSION['CuSeR_Rank']    =    $userinfo->rank;
                            $_SESSION['CuSeR_LastLogin']    =    $userinfo->lastlogin;

            }
    //*
            $result = mysql_query("SELECT * FROM users WHERE username='".$_SESSION['CuSeR']."'");
            extract($userinfo = mysql_fetch_object($result));

                //print("My Rank:".$userinfo->rank."<br />");//-Making Sure
                //print("Needed Rank:".$mRank."<br />");//------Rank Checking Works

                        if(!$userinfo->ID){
                            //return false;
                            $this->Exeption($AuthErrors,false);
                            $this->loginForm();
                            }else{
                                if(($userinfo->banned == 1) && ($userinfo->verified != 1)){
                                    $this->Exeption(array("Not Only are you not a verified user, but you are also banned."),false);
                                }
                                elseif($userinfo->banned == 1){
                                        
                                        $this->Exeption(array("You Are Banned"),false);
                                  }
                                    elseif($userinfo->rank >= $mRank){
                                        if($userinfo->verified != 1){
                                            $this->Exeption(array("You Are UnVerified"),false);
                                        }else{
                                            return 1;
                                        }
                                    }else{
                                         $this->Exeption(array("You do not have a high enough rank to view this page.<br />\n"));
                                    }
                        }


        }//End Authentication Function

            function loginForm(){
            ?>
    <style type="text/css">
    <!--
    .style3 {
        font-size: 10px;
        font-family: Geneva, Arial, Helvetica, sans-serif;
        color: #FFFFFF;
    }
    -->
    </style>

            <form action="<?=$_SERVER['REQUEST_URI']?>" name="AuthLoginForm" method="post">
            <table width="31%" border="0" align="center" cellpadding="0" cellspacing="1" bgcolor="#000000">
      <tr>
        <td colspan="2" bgcolor="#999999"><div align="center">Login</div></td>
        </tr>
      <tr>
        <td width="8%" bgcolor="#999999">Username</td>
        <td width="92%" bgcolor="#999999"><input name="userName" type="text" value="UserName" class="login_text" /></td>
      </tr>
      <tr>
        <td bgcolor="#999999">Password</td>
        <td bgcolor="#999999"><input name="passWord" type="password" value="Password" class="login_text" /></td>
      </tr>
      <tr>
        <td colspan="2" valign="middle" bgcolor="#999999"><div align="center">
          <input type="submit" name="AuthLogin" value="Submit" />
          <span class="style3">Remember Me?</span>
          <input type="checkbox" name="RememberMe" value="true" />
        </div></td>
        </tr>
    </table>

            </form>
            <?
            }
        }
    ?>
    Last edited by PlaGuE; Sep 29th, 2006 at 02:43 AM.
    Without balance, there could only be chaos.
    Without chaos, there could be no balance.
    I live with karma. Eat with destiny. Dream of life without shackles....
    Yet. If life had no consequences, life could not exist, nor could it flourish.


    If at first you dont succeed.You're screwed.

    C++/Java NOOB.

    I aint a professional at PHP, but if i can help i will.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  



Click Here to Expand Forum to Full Width