phpmyadmin database built on my server and i cannot connect wiht my login page

Collapse
X
 
  • Time
  • Show
Clear All
new posts
  • tolkienarda
    Contributor
    • Dec 2006
    • 316

    phpmyadmin database built on my server and i cannot connect wiht my login page

    Hi all
    I work for a small webdesign company and we have remote hosting. i built a mysql database with phpmyadmin on the server. i then downloaded and modified a php login page. i am continuing to get the ---invalid username or password--- i am not getting the E_USER_ERROR so i don't know if there is a problem with the php, how i set up the database or mabe somthing in between. so everyone knows all of my server interface is GUI. I use a company called Rackspace and software called Plesk. I set the database up on the correct domain and i setup username and passwords for all students and teachers at the school (this is for a private school management online program.)

    any how here is the code

    i have this setup on the domain where i built the database and here is a link to this page in action.
    http://www.wyrchurch.c om/RCA/login.php
    as you can see the person who wrote this commented it but i changed alot here is a link to where i got the code so you can see the original cause mabe the error is comming from a change i made. now i did go back to the orginial once but it diddn't work.
    http://www.tutorialize d.com/tutorial/Login-Logout-with-a-Session-in-1-file/20041
    Code:
    <?
    // Use session variable on this page. This function must put on the top of page.
    session_start();
    
    ////// Logout Section. Delete all session variable.
    session_destroy();
    
    $message="";
    
    ////// Login Section.
    $Login=$_POST['Login'];
    if($Login){ // If clicked on Login button.
    $username=$_POST['username'];
    $password=$_POST['password'];
    
    // Connect database.
    $host="localhost"; // Host name.
    $db_user="rcadmin"; // MySQL username.
    $db_password="nsds2004"; // MySQL password.
    $database="RCA"; // Database name.
    $RCA = mysql_pconnect($host, $db_user, $db_password) or trigger_error(mysql_error(),E_USER_ERROR);
     mysql_select_db($database, $RCA);
    
    // Check matching of username and password.
    $result=mysql_query("SELECT Login, Pass, Accesslvl FROM useraccess WHERE Login='username' AND pass='password'");
    if(mysql_num_rows($result)!='0'){ // If match.
    session_register("username"); // Craete session username.
    header("location:main.php"); // Re-direct to main.php
    }else{ // If not match.
    $message="--- Incorrect Username or Password ---";
    }
    
    } // End Login authorize check.
    ?>
    
    <html xmlns="http://www.w3.org/1999/xhtml">
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    <title>Untitled Document</title>
    </head>
    
    <body>
    <? echo $message; ?>
    <form id="form1" name="form1" method="post" action="<? echo $PHP_SELF; ?>">
    <table>
    <tr>
    <td>User : </td>
    <td><input name="username" type="text" id="username" /></td>
    </tr>
    <tr>
    <td>Password : </td>
    <td><input name="password" type="password" id="password" /></td>
    </tr>
    </table>
    <input name="Login" type="submit" id="Login" value="Login" />
    </form>
    </body>
    </html>
  • ronverdonk
    Recognized Expert Specialist
    • Jul 2006
    • 4259

    #2
    The SELECT query is incorrect. You use constants ('username' and 'password')and you must use the variable names in which you have stored the username and the password. I also added the error message display to this statement. SELECT statement must be:[php]$result=mysql_q uery("SELECT Login, Pass, Accesslvl FROM useraccess WHERE Login='$usernam e' AND pass='$password '")
    or die("SELECT error: " . mysql_error());[/php]
    Ronald :cool:

    Comment

    • tolkienarda
      Contributor
      • Dec 2006
      • 316

      #3
      Hi thanks
      that didn't seem to fix all of the problems. I tried to do some basic injection to bypass the user pass field
      Code:
       1'or'1'='1
      and it worked so i now i think that the problem is definatly with my database or the connection. i remember which forum i am in so if the following is out of line please tell me and i will repost in the correct forum.
      here are what the useraccess table looks listed below are all of the sql commands for the entire database.
      Code:
      CREATE TABLE `useraccess` (
        `Login` varchar(4) NOT NULL default '',
        `Accesslvl` int(1) NOT NULL default '0',
        `Pass` varchar(10) NOT NULL default '',
        PRIMARY KEY  (`Login`)
      ) ENGINE=MyISAM DEFAULT CHARSET=latin1;
      and the data in it
      Code:
      INSERT INTO `useraccess` VALUES ('kska', 1, '442677ee0a');
      INSERT INTO `useraccess` VALUES ('lska', 1, '6a0b078b24');
      INSERT INTO `useraccess` VALUES ('kfar', 1, '2d9a3b9c24');
      INSERT INTO `useraccess` VALUES ('boli', 1, '7f3929231d');
      INSERT INTO `useraccess` VALUES ('calu', 1, '25bce6805f');
      INSERT INTO `useraccess` VALUES ('rrav', 1, '10b354ad0e');
      INSERT INTO `useraccess` VALUES ('jwin', 1, '1be083995a');
      INSERT INTO `useraccess` VALUES ('dsco', 1, '5ab409f300');
      INSERT INTO `useraccess` VALUES ('mshi', 1, '4ab1bfa158');
      INSERT INTO `useraccess` VALUES ('smen', 1, '49b042c67f');
      INSERT INTO `useraccess` VALUES ('ahai', 1, '496724782b');
      INSERT INTO `useraccess` VALUES ('kcho', 1, '2286f34263');
      INSERT INTO `useraccess` VALUES ('cbar', 2, '560f954803');
      INSERT INTO `useraccess` VALUES ('tblo', 2, '422655e331');
      INSERT INTO `useraccess` VALUES ('cste', 2, '66cbb47e22');
      INSERT INTO `useraccess` VALUES ('aste', 2, '4d4640b12e');
      INSERT INTO `useraccess` VALUES ('nyoh', 2, '74be5b5f63');
      INSERT INTO `useraccess` VALUES ('pbur', 2, '712fd7684d');
      INSERT INTO `useraccess` VALUES ('pgib', 2, '66acd61906');
      INSERT INTO `useraccess` VALUES ('ngib', 2, '5604d7af03');
      INSERT INTO `useraccess` VALUES ('egib', 2, '423ee8e130');
      INSERT INTO `useraccess` VALUES ('kgro', 2, '66f5799c22');
      INSERT INTO `useraccess` VALUES ('dhai', 2, '4d57fc102d');
      INSERT INTO `useraccess` VALUES ('thai', 2, '74bc0e6363');
      INSERT INTO `useraccess` VALUES ('jorh', 2, '4be463b221');
      INSERT INTO `useraccess` VALUES ('joeh', 2, '6ccb3e7f22');
      INSERT INTO `useraccess` VALUES ('khen', 2, '0e3763ae08');
      INSERT INTO `useraccess` VALUES ('dake', 2, '7139bc404d');
      INSERT INTO `useraccess` VALUES ('deke', 2, '66b3616006');
      INSERT INTO `useraccess` VALUES ('ckel', 2, '561c5b0f07');
      INSERT INTO `useraccess` VALUES (' ilo', 2, '422e22be31');
      INSERT INTO `useraccess` VALUES ('glut', 2, '66fb783b22');
      INSERT INTO `useraccess` VALUES ('bpea', 2, '4d499d0d2e');
      INSERT INTO `useraccess` VALUES ('jpea', 2, '7480a48c63');
      INSERT INTO `useraccess` VALUES ('dror', 2, '4bca34b020');
      INSERT INTO `useraccess` VALUES ('zrop', 2, '4e715c7948');
      INSERT INTO `useraccess` VALUES ('sash', 2, '0e27703f08');
      INSERT INTO `useraccess` VALUES ('stsh', 2, '712b9b974d');
      INSERT INTO `useraccess` VALUES ('epat', 2, '0123ws');

      Comment

      • tolkienarda
        Contributor
        • Dec 2006
        • 316

        #4
        OK i found the problem but i have no idea how to fix it.

        when i entered all of my passwords into the mysql data base i used this basic structure
        Code:
        INSERT INTO `useraccess` ( `Login` , `Accesslvl` , `Pass` )
        VALUES (
        'admin', '0', PASSWORD( 'rootpass' )
        );
        thanks
        eirc

        Comment

        • tolkienarda
          Contributor
          • Dec 2006
          • 316

          #5
          ok i didn't finish typing that sorry. the problem is that all of the passwords are encrypted and when i compare the passwords entered via the form i get an incorrect password. i had one password in the database that wasn't encrypted and it workded great.

          and second. problem i am having is that i am a complete beginer at php and i am trying to save the Accesslvl field from that row to a variable then redirect the browser to either a student or teacher page

          thanks eric

          Comment

          Working...