Forum Moderators: coopster
You could also shore up the security by converting your passwords using md5 www.php.net/md5 That way, even if your password file gets compromised, people wont be able to know the passwords.
<?
$password = "pass";
?>
mainpage.php:
<?
include ("password.php");
if ($userpass == $password)
{
echo "password is correct";
}
else
{
echo "password is incorrect";
}
?>
If anyone has access to your files locally also, this is probably the biggest risk.
W.
google search PHP form to read up on it.
If you are using dreamweaver it is a matter of inserting form, inserting form objects, setting the form action to post to the PHP file, and mess with the variables in there.
in file passwords.php
-------------
<?php
$users[]='hughie';
$passw[]='mypass';
$users[]='hughie2';
$passw[]='mypass2';
?>
-----------------
and in file login.php
-----------------------
<?php
require("passwords.php");
?>
<html>
<head>
<title> Password Loging</title>
</head>
<body>
<?php
$logok=0;
if (isset($_POST['submit']))
{
for ($i=0;$i<sizeof($users);$i++)
{
if ($users[$i]==$_POST['username'])
{
if ($passw[$i]==$_POST['password'])
{
$logok=1;
}
}
}
if ($logok==1)
{
echo 'YOU ARE NOW LOGGED IN';
}
else
{
echo 'WRONG DETAILS - <a href="'.$_SERVER[PHP_SELF].'">CLICK TO TRY AGAIN</a>';
}
}
else
{
?>
<form name="form1" method="post" action="<?php echo $_SERVER[PHP_SELF];?>">
Username:<input type="text" name="username"><br>
Password:<input type="text" name="password"><br>
submit:<input type="submit" name="submit" value="submit">
</form>
<?php
}
?>
</body>
</html>
-------------------
ta,
hughie
passwords.php
----------
<?php
$users[]='hughie';
$passw[]='a029d0df84eb5549c641e04a9ef389e5';
$users[]='hughie2';
$passw[]='29e80f01374c71764422b94532a4b336';
?>
----------
and in login.php
----------
<?php
require("passwords.php");
?>
<html>
<head>
<title> Password Loging</title>
</head>
<body>
<?php
$logok=0;
if (isset($_POST['submit']))
{
for ($i=0;$i<sizeof($users);$i++)
{
if ($users[$i]==$_POST['username'])
{
// for reference
echo 'MD5 of pass='.md5($_POST['password']).'<br><br>';
if ($passw[$i]==md5($_POST['password']))
{
$logok=1;
}
}
}
if ($logok==1)
{
echo 'YOU ARE NOW LOGGED IN';
}
else
{
echo 'WRONG DETAILS - <a href="'.$_SERVER[PHP_SELF].'">CLICK TO TRY AGAIN</a>';
}
}
else
{
?>
<form name="form1" method="post" action="<?php echo $_SERVER[PHP_SELF];?>">
Username:<input type="text" name="username"><br>
Password:<input type="text" name="password"><br>
submit:<input type="submit" name="submit" value="submit">
</form>
<?php
}
?>
</body>
</html>
----------
ta,
Hughie
My page would look like this..
<?
$pass = "blahblahblah"if(!$_POST)
{
// show form
if($form_pass!= $pass)
{
die(Password not right.);
}
}
else
{
// show correct password page
}
?>
- You are not checking against a password stored as an md5 hash of the password.
- You are not checking against a username and password, just a password.
On the original question, it will also be much better if the file in question is outside of the web root entirely, at which point it won't really matter if it's a php file or not.
Tom
Beta chat,
- You are not checking against a password stored as an md5 hash of the password.
- You are not checking against a username and password, just a password.On the original question, it will also be much better if the file in question is outside of the web root entirely, at which point it won't really matter if it's a php file or not.
Tom
Tom,
For the example, I didn't think it was necessary, so I didn't include it.
Since I was giving basic details of a "structure", I didn't think checking anything else really was necessary either. I was just showing that all that coding can be done with less space taken up, and time as well.
<?php
$users[]='hughie';
$passw[]='a029d0df84eb5549c641e04a9ef389e5';
$users[]='hughie2';
$passw[]='29e80f01374c71764422b94532a4b336';
?>
do i replace the passw with my own password, how does this md5 works?
$test_pwd = md5($_POST['pwd']);
for ($i=0, $max=sizeof($users); $i<$max; $i++)
{
if ($_POST['username'] == $users[$i] && $test_pwd == $_POST['pwd'])
{
let 'em in
}
}
