ansaurus

Question

Answer 1

A:

Get the Tamper Data add on for Firefox. It'll let you watch the form post and the response back from the server. There are other add ons that will do the same, or if you also need to see the same data in IE you can get Fiddler.

Chris Shaffer 2009-05-12 17:03:56

These tools will definitely help I think. Of course, now that I have them, I am having trouble getting the error to show up again. It is still happening on a co-worker's computer, but not mine.

Mesidin 2009-05-12 17:15:09

Answer 2

A:

What if instead of selecting COUNT(id) you instead just selected * and replaced mysql_result for mysql_num_rows, do the errors still occur?

$result = mysql_query("SELECT * FROM merchants WHERE passw='$_POST[password]' AND usern='$_POST[username]'") or die("Couldn't query the user-database."); 
$num = mysql_num_rows($result); 

if ($num < 1) {

tj111 2009-05-12 17:05:22

This seemed to have no effect.Honestly, it seems to me like the page is just refreshing, and it's not going to script at all. I am trying to duplicate the problem with the tamper firefox plugin to see if this is actually the case.

Mesidin 2009-05-12 17:29:04

Answer 3

+1 A:

Resisting the urge to shout 'SQL injection attack!!!!1111', as you say it does rather look like the form isn't submitted correctly. A couple of ideas:

Do you check in some way that the form has been submitted in the code before you query the database? If so, is this value definitely being posted?

I had this very issue in Firefox / Safari before, when I had a <button type="submit"> tag to submit the form without a value assigned to that button - IE (<8)was fine with this, but other browsers definitely weren't.

Put the following code in your submission page to see exactly what gets submitted:

die('<pre>'.print_r($_POST,true).'</pre>');

BrynJ 2009-05-12 17:08:03

Heh. Now you know why I prefaced with my caveat. Unless it fixes the problem, I was specifically asked not to change any code, even with my protests of vulnerability. Gah! Drives me nuts as well just looking at it. It makes no sense.I will try that out and see what I can come up with!

Mesidin 2009-05-12 17:17:18

Answer 4

A:

Lets just go for a rewrite here and see how it works:

<?php
$db = mysql_connect('***', '***', '***') or die("Couldn't connect to the db."); 
mysql_select_db('***') or die("Couldn't select the db"); 

$result = mysql_query("SELECT id FROM merchants WHERE passw='%s' AND usern='%s'",
                      mysql_real_escape_string($_POST['username']),
                      mysql_real_escape_string($_POST['password'])) 
      or die("Couldn't query the user table."); 

if (mysql_num_rows($result) != 0) {
     $user = mysql_fetch_assoc($result);
     $userId = $user['id'];

     // Destroy any old session data from before for a fresh session
     session_destroy();
     session_start(); 

     header('Location: merchants/index.php'); 
     exit();
} else {
    $message = "Login Failed: Incorrect username or password";

    header('Location: login.php?message='.$message);
    exit();
}
?>

Give that a shot. Always good to throw an exit() in after you set the location in the header to make sure no more code executes.

While you're at it you might want to have the error message set in the session array and send it back that was as opposed to through the query string:

...
} else {
    $message = "Login Failed: Incorrect username or password";
    $_SESSION['login_error'] = $message;
    header('Location: login.php');
    exit();
}

Then just access $_SESSION['login_message'] on your login page to display any errors.

Id this doesn't get you working try some var_dump() on the $_POST array to see what is coming into your form.

Parrots 2009-05-12 17:24:11

ansaurus

tags:

views:

answers:

HTML login form return error

related questions