Topic awaiting preservation: PHP User Authorization

hey ya'll its been a while.
Anyways I'm trying to do a user login script with $_SESSION to register variables for use in the site for profiles, etc. http://mistsoftime.neopages.net/verification.txt is the code.
Its not logging anyone in, it just sends everything back to site.php and leaves them as Guest. Can anyone tell me where i screwed up?

»What is life w/o Friends?

WOAAAAAAH INSECURE INSECURE!!!!


first I don't know where this isn't working but here's a couple of ways to trouble shoot it.
First after this line:
$user = mysql_fetch_array($login);

put:
echo mysql_num_rows($login)

(and get rid of your header stuff for trouble shooting)

that's to see how many rows are being returned. you may also want to echo the sql to see what that looks like. Something like so:

$sql = "SELECT * FROM users WHERE username='$username' AND password='$password'";
echo $sql
mysql_query($sql);

your security issue is that $authenticate can be set in the url
/site.php?authenticate=1

and all is lost.




.:[ Never resist a perfect moment ]:.

lol thanks, but nm sorry ya'll I kept working on it and finally figured it out by redoing everything and getting some help from a friend on IRC. Thanks =) now i just have to figure out how to do a site search.

»What is life w/o Friends?

have a look at phpdig for your searching needs!

http://phpdig.toiletoine.net/

thanks, I'll check that out for the search thing, uhh one other thing, about the authenticated = 1 thing.. how could i get around that? cause im still using that and its still insecure o.0

»What is life w/o Friends?

Instead of checking whether $authenticated variable is true or not, every time check if username & password are valid (just like the first time, when you set $authenticated to true, which should be necessary anymore)...

You can also unset authenticated early in your script

Then do your check.

For my user authentication stuff I'm using a totally tweaked version of this script for user authentication (I basically kept the theory but put it all in a class for ease of use).

Essentially the best thing to do as Max said is to not set an authenticated varible but to just put your code within the if/else block where right now you are setting authenticated to true.



.:[ Never resist a perfect moment ]:.