Peter the code has worked!! Thank you all!! Also the additional security feature is something to brag about when I get to class. Thanks Skunks :-) On 4/24/13, Peter Karunyu <pkarunyu@gmail.com> wrote:
And what Yoni is implying is that, your code as is right now can be easily hacked by a standard 1 kid from Malaysia with their eyes closed :-)
Specifically due to the lines below:
$portal=$_POST['portal']; $u_id=$_POST['uname']; $pwd=$_POST['upass'];
$strSQL = "SELECT `u_name` from `users` where `u_name` = '.$u_id.' and `pass` = '.$pwd.' and `type` = '.$portal.'";
There's lots of examples on the net on how to bypass your login using SQL Injection.
A quick and dirty way of fixing it is thus:
$portal=mysql_real_escape_string(strip_tags(trim($_POST['portal']))); $u_id=mysql_real_escape_string(strip_tags(trim($_POST['uname']))); $pwd=mysql_real_escape_string(strip_tags(trim($_POST['upass'])));
On Wed, Apr 24, 2013 at 3:15 PM, Peter Karunyu <pkarunyu@gmail.com> wrote:
@Nduati, try the code below, but, like Kairu said, there were other places where you are using = instead of ==.
<?php $portal=$_POST['portal']; $u_id=$_POST['uname']; $pwd=$_POST['upass']; //my sql part $host="localhost"; $dbuser="root"; $dbpass=""; //connect to the database $conn = mysql_connect($host,$dbuser,$dbpass) or exit("Connection Error".mysql_error()); mysql_select_db('cars') or exit("Database not found"); //The Query $strSQL = "SELECT `u_name` from `users` where `u_name` = '.$u_id.' and `pass` = '.$pwd.' and `type` = '.$portal.'"; $result = mysql_query($strSQL, $conn) or exit("sql Error:".mysql_error()); //logic test $numrows = mysql_num_rows($result); //error below here if($numrows == 1){ //user access if ($portal == "user"){ header("Location:upload.html"); } elseif ($portal == "dealer"){ header ("Location:select.html"); } elseif ($portal == "admin"){ header ("Location : login.html"); } else { echo "login error"; return false; } } else{ echo" Login Failed"; echo "</br><a href='#' onclick='window.history.back();'>Click Here</a>"; } ?>
On Wed, Apr 24, 2013 at 3:12 PM, Andrew Nduati <nduatiandrew@gmail.com>wrote:
@Zack tried it and the error I have gotten is: "*Parse error*: syntax error, unexpected T_ELSEIF.... on line 30"
@Yoni. Please explain. Have not come across such before.
On Wed, Apr 24, 2013 at 3:06 PM, Andrew Nduati <nduatiandrew@gmail.com>wrote:
@Victor from my understanding, $u_id is just a variable. Correct me if i am wrong but I think I can call it anything as long as I am consistent with its use.
@Peter and Kennedy I had been using that and all I got was a blank page although the address bar showed it had moved to my php file.
On Wed, Apr 24, 2013 at 2:59 PM, Kennedy Kairu Kariuki <kkairu@gmail.com
wrote:
True Peter. Also the other parts where you are doing comparison and not assignment.
On Wed, Apr 24, 2013 at 2:56 PM, Peter Karunyu <pkarunyu@gmail.com>wrote:
I suspect it's line 18 where you state thus:
*if($numrows=1){* * * I reckon you wanted to say:
*if($numrows == 1){*
On Wed, Apr 24, 2013 at 2:46 PM, Victor Yegon <viktayeg@gmail.com>wrote:
> How do you assign username an id?? > > > On Wed, Apr 24, 2013 at 2:40 PM, Andrew Nduati < > nduatiandrew@gmail.com> wrote: > >> Afternoon people, I urgently need someone to look at my code below >> and tell my why: >> 1. The wrong credentials allow one access. >> 2. Only the dealers page is opening even after selecting user or >> admin portals. >> Looking forward to helpful feedback thanks. >> *THE CODE:* >> <?php >> $portal=$_POST['portal']; >> $u_id=$_POST['uname']; >> $pwd=$_POST['upass']; >> //my sql part >> $host="localhost"; >> $dbuser="root"; >> $dbpass=""; >> //connect to the database >> $conn= mysql_connect($host,$dbuser,$dbpass) or exit("Connection >> Error".mysql_error()); >> mysql_select_db('cars') or exit("Database not found"); >> //The Query >> $strSQL= "SELECT `u_name` from `users` where `u_name` = '.$u_id.' >> and `pass` = '.$pwd.' and `type` = '.$portal.'"; >> $result=mysql_query($strSQL, $conn) or exit("sql >> Error:".mysql_error()); >> //logic test >> $numrows=mysql_num_rows($result); >> //error below here >> if($numrows=1){ >> /*echo "success"; >> echo "Name:".$u_id."</br>";*/ >> //user access >> if ($portal="user"){ >> header("Location:upload.html"); >> } >> else{ >> echo "login error"; >> return false; >> } >> //dealer access even with wrong credentials this is opened >> if ($portal="dealer"){ >> header ("Location:select.html"); >> } >> //administrator access >> elseif ($portal="admin"){ >> header ("Location : login.html"); >> } >> } >> else{ >> echo" Login Failed"; >> echo "</br><a href='#' onclick='window.history.back();'>Click >> Here</a>"; >> } >> ?> >> >> _______________________________________________ >> skunkworks mailing list >> skunkworks@lists.my.co.ke >> ------------ >> List info, subscribe/unsubscribe >> http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks >> ------------ >> >> Skunkworks Rules >> http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 >> ------------ >> Other services @ http://my.co.ke >> > > > > -- > Regards, > > Yegon Victor | Web Specialist/Internet Consultant | > > > > _______________________________________________ > skunkworks mailing list > skunkworks@lists.my.co.ke > ------------ > List info, subscribe/unsubscribe > http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks > ------------ > > Skunkworks Rules > http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 > ------------ > Other services @ http://my.co.ke >
-- Regards, Peter Karunyu -------------------
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
_______________________________________________ skunkworks mailing list skunkworks@lists.my.co.ke ------------ List info, subscribe/unsubscribe http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks ------------
Skunkworks Rules http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 ------------ Other services @ http://my.co.ke
-- Regards, Peter Karunyu -------------------
-- Regards, Peter Karunyu -------------------