tags:

views:

72

answers:

2

I have developed a small application. I created a login panel for it. I have only one user so, I hard coded both user name and password. Below is the code but it is not working.I don’t have any db for this bcoz, it will have only 1 user. Any help ii be appreciated. Thanks in advance.

<?php    
if(($_POST['na'] = 'admin') == ($_POST['pwd'] = 'zucker'))
{
    header("location:first.php");
}
else
{
    header("location:index.php?msg=enter correct user name and password");
}    
?>
+2  A: 

ok, from what I can decipher from your code - you have = and == applied incorrectly. Where you have = you want == and where you have == you want &&

if (($_POST['na']=='admin') && ($_POST['pwd']=='zucker')) {
  header('location:first.php')
};

I hope this isn't how your login model is going to work - whats to stop just anyone going directly to first.php?

Mailslut
René Wolferink
Remember to always exit() or die() after the header calls
Scott Saunders
I cleared the buck.
DAFFODIL
A: 

To avoid some Notice errors and other bugs:

<?php 

$na     = isset($_POST['na']) ? $_POST['na'] : false;
$pwd    = isset($_POST['pwd']) ? $_POST['pwd'] : false;
$submit = isset($_POST['submit']) ? true : false;

if ($submit) {

  if ($na == 'admin' && $pwd == 'zucker') {

    header("location:first.php");
    exit(); // Make sure nothing else gets sent

  } else {

    header("location:index.php?msg=enter correct user name and password");
    exit(); // Make sure nothing else gets sent

  }

}
?>

Here's a slightly more advanced example:

<?php 
$na     = isset($_POST['na']) ? $_POST['na'] : false;
$pwd    = isset($_POST['pwd']) ? $_POST['pwd'] : false;
$submit = isset($_POST['submit']) ? true : false;

// Accounts array (append as you wish)
$accounts  =  array(
                'admin'  =>  '4635c0015b2084afcc7cb39593545e06',
                'foo'    =>  '37b51d194a7513e45b56f6524f2d51f2'
              );

// form complete?
if ($submit && $na && pwd) {

  if (isset($accounts[$na]) && md5($accounts[$na]) == $pwd) {

    header("location:first.php");
    exit(); // Make sure nothing else gets sent

  } else {

    header("location:index.php?msg=enter correct user name and password");
    exit(); // Make sure nothing else gets sent

  }

}
?>
Kieran Allen
its pretty pointless adding md5 to a hard coded login, if the hacker was reading his password then he would already have server access :/
RobertPitt
Not necessarily; This can cover a few bases i.e. If the PHP binary crashes, or if the server is incorrectly configured. It's happened to many large sites before, even Facebook - http://techcrunch.com/2007/08/11/facebook-source-code-leaked/It'll also keep out prying eyes on shared hosting where some people may have shell access. I totally agree though, if you're going to implement something like my second snippet then it's probabaly worth using a database of some sort.
Kieran Allen
Thnx for the info.
DAFFODIL
Both of u hv helped me.Thnx a lot
DAFFODIL
the xample works but is so written over that the guy who asked the question probably wont understand what he did wrong.database is absolutely not necessary. i'd suggest dynamically salting the md5 hash with a token and the username and not even include the username in the script.
Joe Hopfgartner