password checking

[student_steve]

Hey guys, here is some code for a password security measure in a
website:

<?php
session_start() ;
$errorMessage = '';
if (isset($_POST['username']) && isset($_POST['password'])) {
if ($_POST['username'] === 'steven' && $_POST['password'] ===
'crocker') {
$_SESSION['basic_is_logge d_in'] = true;
header('Locatio n: http://users.cs.cf.ac. uk/S.J.Crocker/search.php');

} else {
$errorMessage = 'Sorry, wrong user id / password';
echo $errorMessage;
}
}
?>

The problem is, when i enter 'steven' as the username and 'crocker' as
the password.. nothing happerns, it should go to
"http://users.cs.cf.ac. uk/S.J.Crocker/search.php" but it remains on the
password enter screen. The error message works however, any idea where
im going wrong??

Cheers
Steve

[pieter_hordijk@hotmail.com]

Re: password checking

Why are you using three equal signs?

The following is enough:
if(($_POST['username'] == 'steven') && ($_POST['password'] ==
'crocker'))

[d]

Re: password checking

"student_st eve" <gingercrock@ho tmail.com> wrote in message
news:1142439209 .094140.120730@ i40g2000cwc.goo glegroups.com.. .[color=blue]
> Hey guys, here is some code for a password security measure in a
> website:
>
> <?php
> session_start() ;
> $errorMessage = '';
> if (isset($_POST['username']) && isset($_POST['password'])) {
> if ($_POST['username'] === 'steven' && $_POST['password'] ===
> 'crocker') {
> $_SESSION['basic_is_logge d_in'] = true;
> header('Locatio n: http://users.cs.cf.ac. uk/S.J.Crocker/search.php');
>
> } else {
> $errorMessage = 'Sorry, wrong user id / password';
> echo $errorMessage;
> }
> }
> ?>
>
> The problem is, when i enter 'steven' as the username and 'crocker' as
> the password.. nothing happerns, it should go to
> "http://users.cs.cf.ac. uk/S.J.Crocker/search.php" but it remains on the
> password enter screen. The error message works however, any idea where
> im going wrong??[/color]

Have you checked that the session is being set correctly? Are you sure it's
actually working as expected?

Also, as you are using sessions, you should call session_write_c lose()
before you call header("locatio n:...") - not doing so can cause serious
problems on some platforms.
[color=blue]
> Cheers
> Steve
>[/color]

dave

[Rich]

Re: password checking

"d" <d@example.co m> wrote in message
news:KGXRf.3639 8$wl.11183@text .news.blueyonde r.co.uk...
<snip>[color=blue]
> Also, as you are using sessions, you should call session_write_c lose()
> before you call header("locatio n:...") - not doing so can cause serious
> problems on some platforms.[/color]

Dave,

Sorry to hijack the thread, but why would not calling session_write_c lose()
cause a problem on some platforms?

Cheers,
Rich (Still learning)

[Jerry Stuckle]

Re: password checking

pieter_hordijk@ hotmail.com wrote:[color=blue]
> Why are you using three equal signs?
>
> The following is enough:
> if(($_POST['username'] == 'steven') && ($_POST['password'] ==
> 'crocker'))
>[/color]

Three equal signs checks to ensure they are both the same type and the
same value.

Otherwise you can have the potential problem of the user entering a zero
for username and password. PHP could then try to compare as integers
instead of strings - and convert 'steven' and 'crocker' to zero. The
comparison would then be true.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attgl obal.net
=============== ===

[Mark A. Boyd]

Re: password checking

On Wed, 15 Mar 2006 16:13:29 GMT, student_steve posted in comp.lang.php:
[color=blue]
> Hey guys, here is some code for a password security measure in a
> website:
>
> <?php
> session_start() ;
> $errorMessage = '';
> if (isset($_POST['username']) && isset($_POST['password'])) {
> if ($_POST['username'] === 'steven' && $_POST['password'] ===
> 'crocker') {
> $_SESSION['basic_is_logge d_in'] = true;
> header('Locatio n: http://users.cs.cf.ac. uk/S.J.Crocker/search.php');
>
> } else {
> $errorMessage = 'Sorry, wrong user id / password';
> echo $errorMessage;
> }
> }
> ?>
>
> The problem is, when i enter 'steven' as the username and 'crocker' as
> the password.. nothing happerns, it should go to
> "http://users.cs.cf.ac. uk/S.J.Crocker/search.php" but it remains on the
> password enter screen. The error message works however, any idea where
> im going wrong??[/color]

Correct me if I'm wrong (relatively new to PHP), but don't you need to exit()
immediately after a redirect?

header('Locatio n: http://users.cs.cf.ac. uk/S.J.Crocker/search.php');
exit();
} else {



--
Mark A. Boyd
Keep-On-Learnin' :)

[Richard Levasseur]

Re: password checking

No, you don't. I don't see why you would need to, except for perhaps
exit() causing any buffers to flush, thus sending the headers to the
client.

[Mark A. Boyd]

Re: password checking

On Thu, 16 Mar 2006 05:27:29 GMT, Richard Levasseur posted in comp.lang.php:
[color=blue]
> No, you don't. I don't see why you would need to, except for perhaps
> exit() causing any buffers to flush, thus sending the headers to the
> client.[/color]

Thanks for the correction. I'm not sure what gave me that impression.


--
Mark A. Boyd
Keep-On-Learnin' :)

[d]

Re: password checking

"Rich" <rflack@gmail.c om> wrote in message
news:RZXRf.3640 7$wl.15603@text .news.blueyonde r.co.uk...[color=blue]
> "d" <d@example.co m> wrote in message
> news:KGXRf.3639 8$wl.11183@text .news.blueyonde r.co.uk...
> <snip>[color=green]
>> Also, as you are using sessions, you should call session_write_c lose()
>> before you call header("locatio n:...") - not doing so can cause serious
>> problems on some platforms.[/color]
>
> Dave,
>
> Sorry to hijack the thread, but why would not calling
> session_write_c lose() cause a problem on some platforms?
>
> Cheers,
> Rich (Still learning)[/color]

No problem :)

Due to the way PHP's default session handler locks the session data file, if
the browser is re-directed to the new page *before* closing the connection
to the current script, the second script will be waiting for the first
script to close, and the first script is (apparently) not closed until the
second one is loaded. Essentially, I found that nearly all mac clients
would hang on issuing a Location: header. As soon as I added that command,
the problems disappeared. Windows was never affected, btw.

dave

[d]

Re: password checking

"Mark A. Boyd" <mblist@sanDotr r.com.invalid> wrote in message
news:Xns9787DD0 0FB9E7mblistssa nDotrrcom@66.75 .164.120...[color=blue]
> On Thu, 16 Mar 2006 05:27:29 GMT, Richard Levasseur posted in
> comp.lang.php:
>[color=green]
>> No, you don't. I don't see why you would need to, except for perhaps
>> exit() causing any buffers to flush, thus sending the headers to the
>> client.[/color]
>
> Thanks for the correction. I'm not sure what gave me that impression.[/color]

I was under the same impression, but I think that's just because it makes
sense to not output any content that the browser isn't going to render :-P
[color=blue]
>
> --
> Mark A. Boyd
> Keep-On-Learnin' :)[/color]

[Steve Chapel]

Re: password checking

Jerry Stuckle wrote:[color=blue]
> pieter_hordijk@ hotmail.com wrote:[color=green]
>> Why are you using three equal signs?
>>
>> The following is enough:
>> if(($_POST['username'] == 'steven') && ($_POST['password'] ==
>> 'crocker'))
>>[/color]
>
> Three equal signs checks to ensure they are both the same type and the
> same value.
>
> Otherwise you can have the potential problem of the user entering a zero
> for username and password. PHP could then try to compare as integers
> instead of strings - and convert 'steven' and 'crocker' to zero. The
> comparison would then be true.[/color]

But because $_POST["username"] is a string, and 'steven' is a string, a
string comparison will be done with ==, and the problem you mention with
a numeric comparison won't happen, right? I just tried some PHP code
with a simple variable ($str) in place of $_POST["username"] set to "0",
and a string comparison is done.

[Jerry Stuckle]

Re: password checking

Steve Chapel wrote:[color=blue]
> Jerry Stuckle wrote:
>[color=green]
>> pieter_hordijk@ hotmail.com wrote:
>>[color=darkred]
>>> Why are you using three equal signs?
>>>
>>> The following is enough:
>>> if(($_POST['username'] == 'steven') && ($_POST['password'] ==
>>> 'crocker'))
>>>[/color]
>>
>> Three equal signs checks to ensure they are both the same type and the
>> same value.
>>
>> Otherwise you can have the potential problem of the user entering a
>> zero for username and password. PHP could then try to compare as
>> integers instead of strings - and convert 'steven' and 'crocker' to
>> zero. The comparison would then be true.[/color]
>
>
> But because $_POST["username"] is a string, and 'steven' is a string, a
> string comparison will be done with ==, and the problem you mention with
> a numeric comparison won't happen, right? I just tried some PHP code
> with a simple variable ($str) in place of $_POST["username"] set to "0",
> and a string comparison is done.[/color]

Steve,

In this particular example, that's true - it will compare OK, at current
versions of PHP. But it's still a good habit to get into.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attgl obal.net
=============== ===

[Shelly]

Re: password checking


"Jerry Stuckle" <jstucklex@attg lobal.net> wrote in message
news:tfGdnWvTPJ xom4bZRVn-qg@comcast.com. ..[color=blue]
> Steve Chapel wrote:[color=green]
>> Jerry Stuckle wrote:
>>[color=darkred]
>>> pieter_hordijk@ hotmail.com wrote:
>>>
>>>> Why are you using three equal signs?
>>>>
>>>> The following is enough:
>>>> if(($_POST['username'] == 'steven') && ($_POST['password'] ==
>>>> 'crocker'))
>>>>
>>>
>>> Three equal signs checks to ensure they are both the same type and the
>>> same value.
>>>
>>> Otherwise you can have the potential problem of the user entering a zero
>>> for username and password. PHP could then try to compare as integers
>>> instead of strings - and convert 'steven' and 'crocker' to zero. The
>>> comparison would then be true.[/color]
>>
>>
>> But because $_POST["username"] is a string, and 'steven' is a string, a
>> string comparison will be done with ==, and the problem you mention with
>> a numeric comparison won't happen, right? I just tried some PHP code with
>> a simple variable ($str) in place of $_POST["username"] set to "0", and a
>> string comparison is done.[/color]
>
> Steve,
>
> In this particular example, that's true - it will compare OK, at current
> versions of PHP. But it's still a good habit to get into.[/color]

Maybe it is the "C" (and Java) in me, but I always compare with

if (!strcmp(first, second))

or strcasecmp. That way I am always sure I am comparing the contents of
strings. (Am I wasting my effort?)

Shelly

[Jerry Stuckle]

Re: password checking

Shelly wrote:[color=blue]
> "Jerry Stuckle" <jstucklex@attg lobal.net> wrote in message
> news:tfGdnWvTPJ xom4bZRVn-qg@comcast.com. ..
>[color=green]
>>Steve Chapel wrote:
>>[color=darkred]
>>>Jerry Stuckle wrote:
>>>
>>>
>>>>pieter_hord ijk@hotmail.com wrote:
>>>>
>>>>
>>>>>Why are you using three equal signs?
>>>>>
>>>>>The following is enough:
>>>>>if(($_PO ST['username'] == 'steven') && ($_POST['password'] ==
>>>>>'crocker') )
>>>>>
>>>>
>>>>Three equal signs checks to ensure they are both the same type and the
>>>>same value.
>>>>
>>>>Otherwise you can have the potential problem of the user entering a zero
>>>>for username and password. PHP could then try to compare as integers
>>>>instead of strings - and convert 'steven' and 'crocker' to zero. The
>>>>compariso n would then be true.
>>>
>>>
>>>But because $_POST["username"] is a string, and 'steven' is a string, a
>>>string comparison will be done with ==, and the problem you mention with
>>>a numeric comparison won't happen, right? I just tried some PHP code with
>>>a simple variable ($str) in place of $_POST["username"] set to "0", and a
>>>string comparison is done.[/color]
>>
>>Steve,
>>
>>In this particular example, that's true - it will compare OK, at current
>>versions of PHP. But it's still a good habit to get into.[/color]
>
>
> Maybe it is the "C" (and Java) in me, but I always compare with
>
> if (!strcmp(first, second))
>
> or strcasecmp. That way I am always sure I am comparing the contents of
> strings. (Am I wasting my effort?)
>
> Shelly
>
>[/color]

Shelly,

$first === $second

does the same thing.


--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
jstucklex@attgl obal.net
=============== ===

[ziizii]

Re: password checking

Well, I'm calling die() after header("Locatio n: ..."). A script is
supposed to not to continue in executing, if I'm redirecting client
somewhere else, but it does. Calling of die() this excecution stops and
that's what you probably want if you're redirecting client.