Unregistered Avatar

Reply

Creating a real user database / Log-in.


 
LinkBack Thread Tools Display Modes

  #1 (permalink)  

Old 05-13-2005, 09:25 PM

Creating a real user database / Log-in.

IF YOU CHOOSE TO REGISTER, PLEASE DO NOT USE YOUR REAL PASSWORD OR ANYTHING OF THAT SORT, because I DO have access to the information. Thanks.
Well, I've taken to learning PHP and mySQL, and this is what I've come up with so far : http://67.142.29.254:8000/ . It is a basic login form that compares userinformation to a mySQL database, and also I created a registration form that places data in the mySQL database. If any of you are interested, as I find it very interesting and I have only done so little, I could probably write a full tutorial on how I did it for pure newbs, but for now I'll just post source .

This is the code for the login :
Code:
<?php
@$user=$_POST["Username"];
@$password=$_POST["Password"];

if (($user == NULL) || ($password == NULL))
{
echo ( " No account information entered, please try again. ");
exit();
}

$connect=mysql_connect("localhost", "artificialwings", "*******");
if (!$connect) {
	echo( "unable to connect to mysql database..." );
	exit();
	}
	else
	{
	echo( "Connected succesfully.<br>" ); 
	}
	
	echo( "Checking access...<br>" );
	echo( "Selecting database...<P>" );
	mysql_select_db("artificialwings", $connect);
	
	$work="SELECT user, password, email, number FROM users WHERE user='" . $user . "'";
	$results=mysql_query($work);
	$data=mysql_fetch_array($results);
	
	if ($data["password"] == $password){
	echo ( " You have successfully logged in . . . <P>" .
	"<B>Account Information</b><p>" .
	"Username :&nbsp;" . $data["user"] .
	"<p>Password :&nbsp;" . $data["password"] .
	"<p>Email Address :&nbsp;" . $data["email"] .
	"<p>User Number :&nbsp;" . $data["number"] );
	
	}
	else
	{
	echo ( " Invalid password . . . " );
	}
?>
it's very simple and i'm sure there are better ways to do this, but basically what it does is currently it takes the username you entered (ignoring the pass at first), and then finds it in the table. It then compares the password you entered with the actual password in the database.

here is the actual registration code which puts the data in the database :
Code:
<?php 
$user=$_POST["Username"];
$password=$_POST["Password"];
$password2=$_POST["Password2"];
$email=$_POST["Email"];

$userm="'" . $user . "'";
$passwordm="'" . $password . "'";
$emailm="'" . $email . "'";

if (($password != $password2) || ($password2 == NULL) || ($password == NULL) || ($email == NULL))
{
echo "Passwords did not match, please retry.";
exit();
}

$connect=mysql_connect("localhost", "artificialwings", "*******");

if (!$connect){
echo "couldn't register..";
}

mysql_select_db("artificialwings", $connect);
echo ("success.. registering..");
//area below simply finds what member number the new account will be
$findamountofusers="select MAX(number) from users;";
$dowork=mysql_query($findamountofusers);
$number=mysql_fetch_array($dowork);
$getnumber=$number["MAX(number)"];
$actual=$getnumber+1;
$actualm="'" . $actual . "'";

$work="insert into users (user, password, email, number) VALUES (". $userm . "," . $passwordm ."," . $emailm . "," . $actualm .");";

$register=mysql_query($work);


?>
anyways, feedback I guess.
__________________

ARTIFICIALWINGS

Last edited by ArtificialWings : 05-13-2005 at 09:44 PM.

ArtificialWings is offline ┼Angelwings┼

Join Date: Sep 2004

Posts: 641

Send a message via MSN to ArtificialWings

  #2 (permalink)  

Old 05-15-2005, 07:28 AM

It might help some if you also posted your MySQL query. Just so that they can get that completely set up. I've been trying to figure this out for a while actually...well...a simple version of it anyway.

Question though, I didn't really have the time to look through, but does this use cookies or just page sessions? I'm trying to figure out how I can just run it off of page sessions (I'm writing a securepage for work)
__________________
[:: CursedProphets :: BlizzCenter :: VDCore :: MeloDeath :: Battleforums ::]


Cold was my soul
Untold was the pain
I faced when you left me
A rose in the rain....
So I swore to the razor
That never, enchained
Would your dark nails of faith
Be pushed through my veins again

jd-inflames is offline VDC Team Member

Join Date: Feb 2004

Location: Kentucky

Posts: 245

Send a message via AIM to jd-inflames

  #3 (permalink)  

Old 05-15-2005, 10:39 AM

doesnt do either. this just compares form data to database data and validates it. You'd have to change the part where it prints out all the info for the user to session data, and you would probably want to make it global.

another thing i kinda dont like about this is that the passwords are not encrypted. By encrypting them you insure the users privacy, you secure the database better, and its just better

Its not too shabby though, there are more than one ways to do this.
__________________
Audi Videos | MySpace Layouts | About Me

missionsix is offline loves you.

missionsix's Avatar

Join Date: Feb 2004

Location: under you.

Posts: 4,774

Send a message via AIM to missionsix Send a message via MSN to missionsix

  #4 (permalink)  

Old 05-15-2005, 11:10 AM

I know nothing about encryption.. haha..., but anyways, I updated it to use cookies if you check out the URL again.
__________________

ARTIFICIALWINGS

ArtificialWings is offline ┼Angelwings┼

Join Date: Sep 2004

Posts: 641

Send a message via MSN to ArtificialWings

  #5 (permalink)  

Old 05-15-2005, 11:38 AM

Here are two functions i wrote to encrypt and decrypt some text. It takes a global key to encrypt it, which means that the passwords cant be unencrypted unless the key is thrown into the function.

PHP Code:
//md5 encryption
function md5_encrypt($plain_text$password$iv_len 16)
{
   
$plain_text .= "\x13";
   
$n strlen($plain_text);
   if (
$n 16$plain_text .= str_repeat("\0"16 - ($n 16));
   
$i 0;
   
$enc_text get_rnd_iv($iv_len);
   
$iv substr($password $enc_text0512);
   while (
$i $n) {
       
$block substr($plain_text$i16) ^ pack('H*'md5($iv));
       
$enc_text .= $block;
       
$iv substr($block $iv0512) ^ $password;
       
$i += 16;
   }
   return 
base64_encode($enc_text);
}
//md5 decryption
function md5_decrypt($enc_text$password$iv_len 16)
{
   
$enc_text base64_decode($enc_text);
   
$n strlen($enc_text);
   
$i $iv_len;
   
$plain_text '';
   
$iv substr($password substr($enc_text0$iv_len), 0512);
   while (
$i $n) {
       
$block substr($enc_text$i16);
       
$plain_text .= $block pack('H*'md5($iv));
       
$iv substr($block $iv0512) ^ $password;
       
$i += 16;
   }
   return 
preg_replace('/\\x13\\x00*$/'''$plain_text);

To use it you would do somethign like this:

PHP Code:
$encrypt_key 'globalencryption';
$string md5_encrypt('password',$encrypt_key); 
__________________
Audi Videos | MySpace Layouts | About Me

missionsix is offline loves you.

missionsix's Avatar

Join Date: Feb 2004

Location: under you.

Posts: 4,774

Send a message via AIM to missionsix Send a message via MSN to missionsix

  #6 (permalink)  

Old 05-15-2005, 01:08 PM

damn, thats genius. ill incorporate that, thanks
__________________

ARTIFICIALWINGS

ArtificialWings is offline ┼Angelwings┼

Join Date: Sep 2004

Posts: 641

Send a message via MSN to ArtificialWings

  #7 (permalink)  

Old 05-30-2005, 09:29 AM

PHP has built in md5.... I don't get it.

PHP Code:
<php?
$password=$_POST["Password"]; // Get Password passed from previous page
$encrypted md5($password); // Encrypt it...
echo $encrypted// Echo the encrypted password.  
?> 
That's how I've always done it. Just store the md5'd password in the database, and everytime you want to parse the login, just md5 it, and check it against the database entry.

Someone correct me if I'm wrong?

Dissonance is offline You can't pronounce my name?

Dissonance's Avatar

Join Date: Jul 2004

Posts: 23

  #8 (permalink)  

Old 05-30-2005, 10:10 AM

Dissonance your prefectly right, MD5 is a decent way of encrypting information, and its pretty tough to crack as well. But what sucks is that if someone ever does get your database, they could just run a script with md5decrypt to get all the peoples passwords. But encoding your passwords with function, you ensure that your functions are the only ones that can decypt the text, and the even if they had the functions, they would need the master key as well.
__________________
Audi Videos | MySpace Layouts | About Me

missionsix is offline loves you.

missionsix's Avatar

Join Date: Feb 2004

Location: under you.

Posts: 4,774

Send a message via AIM to missionsix Send a message via MSN to missionsix

  #9 (permalink)  

Old 06-07-2005, 02:18 AM

Sicloan, seeing as how I'm checking back I think you may have md5decrypt confused with base64_decode. As far as I know, md5 cannot be decoded, and searching on the PHP website (because as far as my memory served the function was non existent) and I was right! But yes I do agree that the function is alot safer, and pretty ingenious too.

VB does something similar, except they assign a random 3 bit character string (they call a SALT) to every registered user and then heres how they do it:
PHP Code:
md5md5$password ) . $salt ); 
Where what they do is first encrypt the password (plain text, unencrypted) and then add that encrypted text with the salt, and encrypt that all together. It might be alot easier to understand for novice programmers.
__________________

borednerd is offline registered.

borednerd's Avatar

Join Date: Feb 2005

Posts: 31

Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

Similar Threads
Thread Thread Starter Forum Replies Last Post
User Ranks missionsix Visual News 16 12-13-2005 09:04 PM
my first real render.. Turbo Digital Art Showcase 16 11-12-2004 08:25 AM
New Additions and User Options! Jay Discussion Lounge 12 07-24-2004 02:35 PM


All times are GMT -7. The time now is 09:56 PM.