Printable View
When the user logging into this page, http://localhost/snw/users/login.php and when the users are not properly navigated from the default page means, it will send back the user to the default page.
I used this coding. But even when the user logins from the default page also, it is sending back to the default page.
Code:if (!isset($txtusrname) || !isset($txtusrpwd)){
header("Location: http://localhost/snw/default.php");
}
So we're going to need to see more of your code here. Your syntax is fine, so one of the variables you're checking is probably not set to what you expect it to be.
As said: show us the whole code.
In particular, where do $txtusrname and $txtusrpwd come from?
Are you expecting them to be set automatically? They won't be (unless the register_globals setting is on, which it definitely shouldn't be), but they may be in the $_POST variable if you've used POST to submit a login form.
Code:<html>
<head>
<title>Login Page</title>
</head>
<body>
<?php
<div class="bottombody">
<!--Bottom Body -->
<div class="leftpart">
<div style="padding-top: 90px"><img src="images/topcurve.gif" alt="" /></div>
<div class="curvebg" style="padding-right: 5px;">
<!--Login Part -->
<div class="loginpart">
<div class="topcurve"> </div>
<div class="curvebglogin" align="center">
<table border="0" cellpadding="0">
<form method="POST" action="users/login.php">
<tr><td colspan="2" class="fontbold">Login Here!</td></tr>
<tr><td colspan="2"><hr color="white"/></td></tr>
<tr>
<td>Username:</td>
<td><input type="textbox" name="txtusrname" /></td>
</tr>
<tr>
<td>Password:</td>
<td><input type="password" name="txtusrpwd" /></td>
</tr>
<tr><td colspan="2" align="center" style="padding-top: 5px;"><input type="submit" value="Login" id="btn_login" style="border-style:none; background-color: #33CCCC; color:white; font-weight: bold;" /></td></tr>
</form>
</table>
</div>
<div class="bottomcurve"> </div>
</div>
</div>
<div><img src="images/bottomcurve.gif" alt="" /></div>
</div>
</div>
?>
<body>
</html>
Also i am having a problem, each and every time when the page loads, the username and userpwd fields have some default text which i entered during my first login. Why this happening?
You need to use $_POST['txtusrname'] and $_POST['txtusrpwd'].
That would be because of your browsers auto-fill. It shouldn't appear on other peoples computers and would show their login information even if they did.
Ya thankyou, the first one works. What about the other problem? Each and every time those 2 textboxes are filled with default text. How to rectify it?
Hi this is my coding for the login checks, here what about the bolded code?Code:<?php
//checking whether the users are coming from login page
if (!isset($_POST['txtusrname']) || !isset($_POST['txtusrpwd'])){
header("Location: http://localhost/snw/default.php");
}
else{
//coverting the field values to variables
$usrname = addslashes($_POST['txtusrname']);
$usrpwd = md5($_POST['txtusrpwd']);
//setting the database connection variables
$dbhost = "localhost";
$dbuser = "root";
$dbpwd = "admin";
$dbDatabase = "db_snw";
//connecting to the database
$db = mysql_connect("$dbhost","$dbuser","$dbpwd") or die("Error Connecting to the Database");
mysql_select_db("$dbDatabase",$db) or die("Couldn't Select the database");
$result = mysql_query("select * from tbl_login where Username='$usrname' and Userpwd='$usrpwd'");
//checking the rows are present
$rowcheck = mysql_num_rows($result);
if($rowcheck>0){
while ($row = mysql_fetch_array($result)){
//start the session variable
session_start();
session_register('Username');
echo("Success");
}
}
else{
echo ("Incorrect Username and Password");
}
}
?>
How this session will works?
I initially logged in and the page loads and when again i load the same page, it is redirecting to the default page from the current page. Then what is the use of session starts() and register(). The session ends so soon, on the next navigation.
What about this?
You can make the textboxes blank by default by adding an empty value attribute to the password and text box.Quote:
Originally Posted by bharanidharanit
Those set session cookies, basically a server side version of cookies to remember the logged in after leaving the site.Quote:
Originally Posted by bharanidharanit
Ya i use that in asp.net, there a session remains for some time. Here when i navigate to the login check page initially means, it rollsback me to the default page. And now when i login the session starts now and now when i again navigate to the login check page means, it must go to that page with that session know, but it again taking back to the default page.
Sorry. I'm really a little confused what you're asking here.
Ya what actually the session does, it stores the user information(in my case it stores username).
I have 2 pages, default page and check page. So with my coding, if the user directly navigates first to the check page means, it will redirect user to the default page. (with isset)
And now the user login with username and password and navigating to the check page.
In the check page only it register session information and session starts.
So now when the user again navigates to check page means(directly typing the link of the check page in address bar), the user must not taken to the login page as the user is logged in now.
Is that correct?
But here it is again navigating to the login page. Hope now you get me.
In asp.net the session remains for 20 mins. Even we can change that.
What about in php?
But each and every time
Put the session start code at the top of the page - before any other PHP. You can then check if the session is set (via isset($_SESSION['session_name'])) and redirect based on that.
As for your session expire time, please see this.
Thankyou, are you saying about this?
Code:session_start();
Session_register('Username');
if not isset($_SESSION['Username'])
{
//back to login page
}
No. You need something like this:
Cheers.Code:session_start();
if (isset($_SESSION['Username']))
{
// Go to logged in page.
}
else if (isset($_POST['password']) && isset($_POST['password']))
{
// Do login stuff here and set the username session if the user is validated.
}
Thankyou very much...
Quote:
You can make the textboxes blank by default by adding an empty value attribute to the password and text box.
.Code:<input type="textbox" name="txtusrname" value="" />
This doesnot works, when the value is set to null, again the i am getting the same texts filled by default.
But When i use spaces in the quotes like this value=" ", it works but in the textbox, it starts the text with an empty space at first. Is there any other way?
You could use javascript to reset them. Or use the cache-control headers to force the page not to be cached - which could be the source of the issue.
Don't use value=" " since it's not blank - it's using a space as the default value.
if an <input> element is auto-filling when you don't have a value given to it, then it's most likely your autofill. turn it off or clear it, or use a different browser. that isn't anything related to PHP.
now, where-ever you got this script, it's incredibly old. and it doesn't seem like you really know what half of these functions do -- my case in point is that you're using session_register() to register a username session, yet you don't have any variables named Username, and thus you're not storing anything. you named your username variable $usrname. but, even if you were doing this correctly, this function is deprecated and is scheduled to be removed in PHP6. you should be using the $_SESSION variable to deal with and declare any session variables:
second on the list: you're using addslashes() to escape something you're querying the database with. this is a bad idea. connect to your database, then use mysql_real_escape_string() to escape any variables rather than using addslashes(). you must connect to the database first, however, because this function requires that you have a MySQL connection to use it.PHP Code:<?php
session_start();
//excuse me, I'm bypassing logic here
if(LOGIN_IS_SUCCESSFUL){
//we're logged in
$_SESSION['username'] = $usrname;
echo "login was successful.";
}else{
echo "login failed.";
}
?>
third on the list: you're using a while loop to loop through one record. this is just .. silly. if you're only expecting one result and only want one result (you do, because usernames should be unique in a login system), then only get one result. like so:PHP Code:<?php
//connect to database
$usrname = mysql_real_escape_string($_POST['username']);
?>
when you're returning a list of things (news posts, a journal, products, etc), then using a while loop is great.PHP Code:$sql = "SELECT * FROM table WHERE ...";
$query = mysql_query($sql);
//check if we have a result
if(mysql_num_rows($query)){
//we use mysql_fetch_assoc instead of mysql_fetch_array
//so that we get an associative array instead of both an
//associative and numeric array.
$row = mysql_fetch_assoc($query);
//now, $row contains all of my data for this one row
print_r($row);
}else{
//login failed
echo "login failed";
}
Actually i got that code from devnetwork tutorials. I simply want to make a login system. Where i need to start with for the latest php version?Quote:
now, where-ever you got this script, it's incredibly old.
In asp.net Membership provider and Profile provider do this things and in PHP where must i go?
it doesn't matter where you got this code from -- it's just old in general. the things I pointed out in my post are all older methods that are deprecated or shouldn't be used because of flaws in the way they work. I pointed out easy solutions to fix these issues, though. it's entirely possible to fix the code you already have to work for you.
I don't really know what you're talking about when you say "membership provider and profile provider do these things" -- if these are plugins or extensions that make some kind of login system for you, then that isn't really how it works in PHP.
Ok Thankyou, I need to build a very secured login system in PHP5. And so now where i need to start with. Is there any tutorial or something for building a login system with newer methods?
Hi, the first link is very good. Thankyou.
But even i had a look, i can't understand the use of this.
And in my application, i need my administrator to view the users password and when i use sha1 and md5, is it possible?Code:mysql_real_escape_string
mysql_real_escape_string escapes special characters in MySQL query strings to ensure that no quotes or backslashes are put in there to make exploits in your code (it comments them out).
And no, you can't view information that has been MD5 or SHA hashed.
Ok, is there any algorithm to be used in my case?
sure, there are methods, but none of them can promise you the security that a hash like MD5 or SHA1 can. you really shouldn't have any need to view anyone's password, anyway. you can create a "forgot my password" system that will reset a password, but that's about it. if creating a secure login system is important to you, then being able to look at a person's password should not be important. and leaving passwords in plain text is always a bad idea.
Ya thats ok, i can use this algorithm. What do we have to use while posting a input to other page? id or name?
Code:<input type="text" id="username" name="username" />
Hello this works for me for checking my login. Is this one more secured? Also when the application contains more no of users in thousands, does the query executes faster. Is there any other way to speed up the process?
Code:<?PHP
$username = $_POST['txtusrname'];
$userpwd = $_POST["txtusrpwd"];
//echo ($username);
//echo ($userpwd);
//connecting to database
$dbhost = "localhost";
$dbuser = "root";
$dbpass = "admin";
$dbname = "db_snw";
$dbconn = mysql_connect($dbhost,$dbuser,$dbpass) or die("Can't connect database");
mysql_select_db($dbname,$dbconn) or die("can't select table");
//removing special characters
$username = mysql_real_escape_string($username);
//selecting row for the current username
$query = "SELECT userpwd,salt
FROM tbl_users
WHERE username = '$username';";
$result = mysql_query($query);
if(mysql_num_rows($result) < 1)
{
echo ("No Such User Exists");
}
// echo ($query);
// echo ($result);
//checking if the user is true
$userdata = mysql_fetch_array($result,MYSQL_ASSOC);
$hash = sha1( $userdata['salt'] . sha1($userpwd) );
echo ($userdata['userpwd']);
// echo ($hash);
//incorrect password
if($hash != $userdata['userpwd'])
{
echo("Incorrect Login");
header('Location: default.php');
}
else
{
echo ("Login Successful");
}
?>
Hi thankyou now i created a login system now, how can i create email verification system wih my login system.
Code:<form method="POST" action="hidden">
Hi i found this on another post. what does action attribute enctype do here?Code:<form enctype="multipart/form-data" >
uh. the hidden form action doesn't do anything, as far as I know. if it's a real form, then I would bet it has some javascript that submits the form or something. enctype is used when uploading files. that really doesn't have anything to do with PHP, though!
your login form looks fine, except for the fact that you have a redirect using a header() call there. you can't send output to the browser (using echo) and then also send a header. your redirect wouldn't work.
anyway, an email verification for registration just stores a user's account information in the database with some kind of randomized hash that will be used to actually activate the account. accounts that haven't been activated (given by a boolean field in your database, for example) wouldn't be able to login. when finished registering, you would simply make a call to the mail() function (look it up on PHP.net) and send an email to the user saying that they need to activate their account. this is where you would create the random hash and store it in the database for activation. the email would have a link to some script that would take that hash (in the query string) and check if it existed in the database. if it did, then it activates the account and then lets the user login.
of course, this is all just theory. I'm not really willing to give you much else if you're not willing to write, or at least search, for your own stuff ;)
Thankyou, i will do then..
Hi, i am done with some example coding. I am having some doubts now. First of all can i able to send mails from my localhost. I used this coding.
With this code first i am done with errors asCode:$to = $email;
$subject = "SNW Registration";
$message = "Welcome to SNW!!!\r\rComplete your registration
by clicking the link below:\r
http://localhost/snw//verify.php?$activationkey";
$headers = 'From: noreply@ SNW.com' . "\r\n" .
'Reply-To: noreply@ SNW.com' . "\r\n" .
'X-Mailer: PHP/' . phpversion();
mail($to,$subject,$message,$headers);
echo "Mail sent Successfully";
After that i changed my mail part like thisQuote:
Warning: mail() [function.mail]: Failed to connect to mailserver at "localhost" port 25, verify your "SMTP" and "smtp_port" setting in php.ini or use ini_set() in C:\wamp\www\snw\chkregister.php on line 57
what is the use of @ here? With this i am successful, but i am not getting any mails. Whats wrong in this?Code:@mail($to,$subject,$message,$headers);
Hi, Here it goes my verification part. Does this code goes anything wrong?
Code:<?PHP
$querystring = $_SERVER['QUERY_STRING'];
echo ($querystring);
//connecting to host and database
$dbhost = "localhost";
$dbuser = "root";
$dbpass = "admin";
$dbname = "db_snw";
$dbconn = mysql_connect($dbhost,$dbuser,$dbpass) or die("Can't connect database");
mysql_select_db($dbname,$dbconn) or die("can't select table");
//checking if the user exists
$query = "select * from tbl_users where activationkey='$querystring'";
$result = mysql_query($query) or die(mysql_error());
if(mysql_num_rows($result)<1)
{
echo("No Such User Exists");
}
$userdata = mysql_fetch_array($result,MYSQL_ASSOC);
$userid = $userdata['id'];
echo ($userid);
//setting Active for the current user
$activequery = "update tbl_users set activationkey='',userstatus='Y' where id='$userid'";
if(!mysql_query($activequery))
{
die(mysql_error());
}
else
{
echo ('Your Account is now active, go back to login and proceed further');
}
?>
If this is a cause, how to output error to the user and to redirect a page?Quote:
your login form looks fine, except for the fact that you have a redirect using a header() call there. you can't send output to the browser (using echo) and then also send a header. your redirect wouldn't work.
you can't. unless you used javascript, which I wouldn't recommend. or used the query string to redirect to the form, and have the form check if that query string is set and then outputting a message if you wanted.
the mail() function won't work on your local machine unless you have a mail server installed, which I doubt you do. you could switch to something like the PHPMailer class or any others like it (which I cannot provide any support for), or use an online host that has sendmail or something installed.
the @ symbol before a function call is to suppress errors. there really isn't any reason to be suppressing errors most of the time; you shouild be dealing with them instead.
and lastly, when I say you take something from the query string, you don't ... take the entire query string. the query string can hold variables, these are called 'GET requests.' you can use the superglobal PHP variable $_GET to access these. if you have the following URL:
http://example.com/?var=something
then the variable $_GET['var'] would hold "something." if you then had:
http://example.com/?var=something&var2=something_else
then the variable $_GET['var'] would hold "something," and the variable $_GET['var2'] would hold "something_else."
get the idea?
Hello thankyou,T I have already smtp mail server installed in my system, but that doesnot works. I think it will be ok, when i host it. Thats ok for now.
I would like to add captcha to my registration system. I searched google and i get some. There are more number of scripts in that which are little bit complex to go on. I simply took my needs from that. Now My registration page is generating captcha, but i dont know how to check it back after the user enters from the shown image.
Here's my coding.
Captcha.php
My Registration pageCode:<?php
session_start();
//Settings: You can customize the captcha here
$image_width = 120;
$image_height = 40;
$characters_on_image = 6;
$font = './monofont.ttf';
//The characters that can be used in the CAPTCHA code.
//avoid confusing characters (l 1 and i for example)
$possible_letters = '23456789bcdfghjkmnpqrstvwxyz';
$random_dots = 0;
$random_lines = 20;
$captcha_text_color="0x142864";
$captcha_noice_color = "0x142864";
$code = '';
$i = 0;
while ($i < $characters_on_image) {
$code .= substr($possible_letters, mt_rand(0, strlen($possible_letters)-1), 1);
$i++;
}
$font_size = $image_height * 0.75;
$image = @imagecreate($image_width, $image_height);
/* setting the background, text and noise colours here */
$background_color = imagecolorallocate($image, 255, 255, 255);
$arr_text_color = hexrgb($captcha_text_color);
$text_color = imagecolorallocate($image, $arr_text_color['red'],
$arr_text_color['green'], $arr_text_color['blue']);
$arr_noice_color = hexrgb($captcha_noice_color);
$image_noise_color = imagecolorallocate($image, $arr_noice_color['red'],
$arr_noice_color['green'], $arr_noice_color['blue']);
/* generating the dots randomly in background */
for( $i=0; $i<$random_dots; $i++ ) {
imagefilledellipse($image, mt_rand(0,$image_width),
mt_rand(0,$image_height), 2, 3, $image_noise_color);
}
/* generating lines randomly in background of image */
for( $i=0; $i<$random_lines; $i++ ) {
imageline($image, mt_rand(0,$image_width), mt_rand(0,$image_height),
mt_rand(0,$image_width), mt_rand(0,$image_height), $image_noise_color);
}
/* create a text box and add 6 letters code in it */
$textbox = imagettfbbox($font_size, 0, $font, $code);
$x = ($image_width - $textbox[4])/2;
$y = ($image_height - $textbox[5])/2;
imagettftext($image, $font_size, 0, $x, $y, $text_color, $font , $code);
/* Show captcha image in the page html page */
header('Content-Type: image/jpeg');// defining the image type to be shown in browser widow
imagejpeg($image);//showing the image
imagedestroy($image);//destroying the image instance
$_SESSION['6_letters_code'] = $code;
function hexrgb ($hexstr)
{
$int = hexdec($hexstr);
return array("red" => 0xFF & ($int >> 0x10),
"green" => 0xFF & ($int >> 0x8),
"blue" => 0xFF & $int);
}
?>
Code:<html>
<head>
<title>Register Page</title>
<script type="text/javascript" language="javascript">
function refreshCaptcha()
{
var img = document.images['captchaimg'];
img.src = img.src.substring(0,img.src.lastIndexOf("?"))+"?rand="+Math.random()*1000;
}
</script>
</head>
<body>
<table width="100%" border="1">
<form method="POST" action="chkregister.php">
<tr>
<td>Enter Username:</td>
<td><input type="text" id="regusrname" name="regusrname" /></td>
<td id="v1"> </td>
</tr>
<tr>
<td>Enter Password:</td>
<td><input type="text" id="regusrpwd" name="regusrpwd" /></td>
<td id="v2"> </td>
</tr>
<tr>
<td>Confirm Password:</td>
<td><input type="text" id="regcusrpwd" /></td>
<td id="v3"> </td>
</tr>
<tr>
<td>Enter Email Address:</td>
<td><input type="text" id="email" name="email" /></td>
<td id="v4"> </td>
</tr>
<tr>
<td>Enter the image shown below:</td>
<td><input type="text" id="6_letters_code" name="6_letters_code" /></td>
<td> </td>
</tr>
<tr>
<td> </td>
<td><img src="captcha.php?rand=<?php echo rand(); ?>" id='captchaimg' /></td>
<td><small>click <a href='javascript: refreshCaptcha();'>here</a> to refresh</small></td>
</tr>
<tr>
<td colspan="3"><input type="submit" value="Register" /></td>
</tr>
</form>
</table>
</body>
<html>
whatever you got the captcha code from would be what you would need to find out how to use it. where-ever you got it, I'm sure there were some instructions or a manual on how to use it. follow them.
I used recaptcha, i added to my, i am having already javascript validation, i also want this to be validated. I dont know how to proceed from this step. Now i am able to see captcha in my page. But i dont know how to display error message. When the user register, he must be checked with every fields that he has return correctly and also checks with captcha, then the page must redirect to the next page. Here is my coding,
Code:# <html>
# <head>
# <title>Register Page</title>
# <script type="text/javascript" language="javascript">
# function validate_register()
# {
# alert('hi');
# var usrname = document.getElementById('regusrname').value;
# var usrpwd = document.getElementById('regusrpwd').value;
# var cusrpwd = document.getElementById('regcusrpwd').value;
# if (usrname=="")
# {
# document.getElementById('v1').innerHTML = "Enter Username";
# return false;
# }
# elseif (usrpwd=="")
# {
# document.getElementById('v2').innerHTML = "Enter Password";
# return false;
# }
# elseif (usrpwd != cusrpwd)
# {
# document.getElementById('v3').innerHTML = "Password Missmatch";
# return false;
# }
# else
# {
# return true;
# }
# }
# </script>
# </head>
# <body>
# <table width="100%" border="1">
# <form method="POST" action="chkregister.php">
# <tr>
# <td>Enter Username:</td>
# <td><input type="text" id="regusrname" name="regusrname" /></td>
# <td id="v1"> </td>
# </tr>
# <tr>
# <td>Enter Password:</td>
# <td><input type="text" id="regusrpwd" name="regusrpwd" /></td>
# <td id="v2"> </td>
# </tr>
# <tr>
# <td>Confirm Password:</td>
# <td><input type="text" id="regcusrpwd" /></td>
# <td id="v3"> </td>
# </tr>
# <tr>
# <td>Enter Email Address:</td>
# <td><input type="text" id="email" name="email" /></td>
# <td id="v4"> </td>
# </tr>
# <tr>
# <td>Enter Captcha Verification</td>
# <td>
# <?php
#
# require_once('recaptchalib.php');
#
# // Get a key from http://recaptcha.net/api/getkey
# $publickey = "6LePbAoAAAAAALvKwRXXsD8fhSCCqR_yKTHq4wfQ";
# $privatekey = "6LePbAoAAAAAAGG3kNPiaSUfiHx0mexGYwOueBrt";
#
# # the response from reCAPTCHA
# $resp = null;
# # the error code from reCAPTCHA, if any
# $error = null;
#
# # was there a reCAPTCHA response?
# if ($_POST["recaptcha_response_field"]) {
# $resp = recaptcha_check_answer ($privatekey,
# $_SERVER["REMOTE_ADDR"],
# $_POST["recaptcha_challenge_field"],
# $_POST["recaptcha_response_field"]);
#
# if ($resp->is_valid) {
# echo "You got it!";
# } else {
# # set the error code so that we can display it
# $error = $resp->error;
# }
# }
# echo recaptcha_get_html($publickey, $error);
# ?>
# </td>
# </tr>
# <tr>
# <td colspan="3"><input type="submit" value="Register" onsubmit="validate_register()" /></td>
# </tr>
# </form>
# </table>
# </body>
# <html>