Heres My PHP script. If you have PHP and MySQL installed, feel Free to Beta test it, point out loopholes, bugs, etc. to me, i can take the criticism.
It employs The mysql DB to store user names and passwords, as well as emails.
Ive used PHP to capture the ip and save it to prevent session jacking. i think its secure... Do You Think it is?
/* ####################################################################
connect.php These Block denote A New Page, Unless Stated Otherwise.
Replace All Values Surrounded by # signs with The Matching Server Info.
#################################################################### */
<?php
$connection = mysql_connect(#HOST# ,
#MySQL Username# ,
#MySQL PASSWORD#) or die("Cannot Connect to Database");
mysql_select_db(#DATABASE OF LOGIN TABLE# , $connection);
$wrong_info = "the URL to your Wrong info page. Don't remove the Quotes";
$welcome_page = "The Full URL to The page you Get to When you log on.";
$logout_to_page = "The Full URL to your home/index page, or a page with the message: you have been logged out";
function PROTECT(){
/*
* Call This Funtion To Check is A User is Logged in.
* If Yes, Returns Variable $secure as 1.
* If no, Returns 0
*/
session_start();
if (isset($_SESSION[user]) && $_SESSION['ip'] == $_SERVER['REMOTE_ADDR'];){
/* Checked: if Info exists in session, And if IPs match. */
$userInfo = "mysql_query("SELECT * FROM 'login' where 'user'='user-$_SESSION[user]-'")";
/* Does Session username exist in DB? */
if (!mysql_num_rows($userInfo)) {header("Location: $wrong_info");$secure = 0;}
else {
/* Checks if DB password matches Session Password. */
$q = mysql_fetch_array($userInfo);
if ($_SESSION['pass'] != $q[password]) {header("Location: $wrong_info");$secure = 0;}
else {$secure = 1;};
};
} else {header("Location: logout.php"; $secure = 0;);
};
function LOGON(){
echo 'Logging on.\n\r';
$user = $_POST[post_user];
$password = md5($_POST[post_pass]);
$userInfo = mysql_query("SELECT * FROM login where user=user-". $user ."-");
if (!mysql_num_rows($userInfo)) {echo 'No such user!';}
else {
$q = mysql_fetch_array($userInfo);
if ($password != $q[password]) {echo 'wrong password';}
else {
session_start();
$_SESSION['user'] = $user ;
$_SESSION['pass'] = $password];
$_SESSION['time'] = time();
$_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
header("Location: $welcome_page");
};
};
};
function LOGOUT(){
session_start();
$_SESSION['user'] = "";
$_SESSION['pass'] = "";
echo "You have been Logged In For ".
date(G \\H\o\u\r\s i \\M\i\n\u\t\e\s\ \A\n\d s ,
time() - $_SESSION['time'])
." Seconds, From the IP ". $_SESSION['ip'] ."<br />/n/r
<a href=\"$logout_to_page\">Continue.</a>";
$_SESSION['time'] = "";
$_SESSION['ip'] = "";
};
function REGISTER(){
$new_UN = $_POST["post_user_new"];
$new_PW = md5($_POST["post_pass_new"]);
$new_PW2 = md5($_POST["post_pass_new2"]);
$new_EM = $_POST["post_mail_new"];
if($new_UN != "" && $new_PW != "" && $new_PW == $new_PW2)
{
$userInfo = mysql_query("SELECT * FROM 'login`' where 'user'='user-$new_UN-'");
if (!mysql_num_rows($userInfo)){
$query = "INSERT INTO login ( 'user' , 'password' , 'email' ) VALUES ( ". $new_UN .", ". $new_PW .", ". $new_EM.");";
mysql_query( $query )
echo "Account Created"; }
else {
echo "Username: $new_UN Already Taken,
Please Hit The Back Button And Choose A New One."}
}
else { echo"A Field Is Blank,
Or The passwords Do Not Match.
Please Hit The Back Button"; };
};
?>
/* ################################################################################
Run This Page ONCE AND ONLY ONCE. Name it Whatever you Want, With the Extention .php
################################################################################# */
<?php require_once "connect.php"
mysql_query("
CREATE TABLE 'login' (
'user' varchar(64) NOT NULL,
'password' varchar(64) NOT NULL,
'email' text NOT NULL,
'autoID' int(10) unsigned NOT NULL auto_increment,
PRIMARY KEY ('autoID'),
UNIQUE KEY 'user' ('user')
) ENGINE=InnoDB DEFAULT CHARSET=latin1 ;
"); ?>
/* #############################
##########Register.php##########
############################# */
<?php require_once "connect.php"
REGISTER()
?>
/* ###################################
##########logontry.php################
################################### */
<?php require_once "connect.php"
LOGON()
?>
/* ###################################
##########logout.php##################
################################### */
<?php require_once "connect.php"
LOGOUT()
?>
/* #################################################################################
###########PLACE AT TOP OF PROTECTED PAGES, Make sure Extention is .php###########
################################################################################# */
<?php require_once "connect.php"
PROTECT()
if($secure == 1) {
?>
/* ###################################################
##########PLACE AT BOTTOM OF PROTECTED PAGES##########
################################################### */
<?php
} else {
echo "<a href=\"$logout_to_page\">You Cannot Acccept Header Redirects, Please Click here.</a>"
};
?>
/* ###############################
##########Forms you Need##########
############################### */
/* #######Login################ */
<form action="logontry.php" method="post">
Username: <input type="text" name="post_user" /><br />
Password: <input type="pasword" name="post_pass" /><br />
<input type="submit" value="Logon!"></form>
/* #######Register############# */
<form action="register.php" method="post">
Username: <input type="text" name="post_user_new" /><br />
Password: <input type="pasword" name="post_pass_new" /><br />
Retype PW: <input type="pasword" name="post_pass_new2" /><br />
Email: <input type="text" name="post_mail_new" /><br />
<input type="submit" value="Register!"></form>
/* ######################################################
Additional Pages needed:
info is wrong
this Can Be Anything you want, but it
should have a link to your Index
page, Your Login Form Page, And your
Registration Form page.
Index Page
This page is the one that is displayed
when only the directory is shown.
like http://example.com/ is actually
http://example.com/index.php or
index.html
Make Sure You Put A Link to The Logout.php On
Each Page That is protected By The Script.
###################################################### */
Labels: web
