Problem with login script using php

[James]

Hey guys. I seem to be having a problem with security on my login script.


This is the code for my login page.

<?php
	include('connect.php');

	$username=$_POST['username'];
	$password=$_POST['password'];

	// protect from MySQL injection 
	$username = stripslashes($username);
	$password = stripslashes($password);
	$username = mysql_real_escape_string($username);
	$password = mysql_real_escape_string($password);

	$encrypted_password=md5($password);

	$sql="SELECT * FROM staff WHERE username='$username' and password='$encrypted_password'";
	$sqlresult=mysql_query($sql)or die("Could not retreive data from table");

	$row=mysql_fetch_array($sqlresult);
?>

All the code is working fine and it directs to the admin.php file upon successful login

<?php
			if (isset($_POST['submit']))
			{

				if ($row['username']==$username && $row['password']==$encrypted_password)
				{
					$username = $_SESSION['username'];
					$password = $_SESSION['password'];
					header("Location:admin.php");
				}

					elseif ($username == '' || $password == '')
					{
						echo '<div style="padding:5px 10px 5px 10px; margin:0px auto 20px; border:2px solid #FF0000; color:#FF0000; width:176px;">';
						echo "Please fill in all required fields";
						echo '</div>';
					}
						
						else
						{
							echo '<div style="padding:5px 10px 5px 10px; text-align:center; margin:0px auto 20px; border:2px solid #FF0000; color:#FF0000; width:255px;">';
							echo "INCORRECT USERNAME AND PASSWORD ENTERED:";
							echo "<br/>";
							echo "Please enter a valid username and password";
							echo '</div>';
						}
			}
		?>

However, if I type in 'admin.php' into the appropriate place in the url in the address bar then I can view the page that should be secured with a login. Currently I have used sessions on the admin page to redirect somebody if they haven't first logged in.

<?php
	session_start();
		
		if ($_SESSION['username'] = '')
		{
			header("location:login.php");
		}
?>

Any feedback would be much appreciated

[johny10151981]

this line is wrong

if ($_SESSION['username'] = '')

//correct line would be
if ($_SESSION['username']=='')
//..

and in the log in page i.e. login.php start your session and as well save the user id in session

[charles07]

James

johny10151981 is right, you are missing an = , it is better to include a session check file in every page other than login page & the code should be like this

<?php
    session_start();
 
        if ($_SESSION['username'] == '')
        {
            header("location:login.php");
        }
?>

also make sure you set $_SESSION['username'] once logged in credentials are checked correct.

[Dormilich]

<?php
	session_start();
		
		if ($_SESSION['username'] = '')
		{
			header("location:login.php");
		}
?>

some nifty little trick to avoid this problem:
if ('' == $_SESSION['username'])
should you accidentally write
if ('' = $_SESSION['username']),
you’ll be prompted with an error.