phpmyadmin database built on my server and i cannot connect wiht my login page

316 100+

Hi all
I work for a small webdesign company and we have remote hosting. i built a mysql database with phpmyadmin on the server. i then downloaded and modified a php login page. i am continuing to get the ---invalid username or password--- i am not getting the E_USER_ERROR so i don't know if there is a problem with the php, how i set up the database or mabe somthing in between. so everyone knows all of my server interface is GUI. I use a company called Rackspace and software called Plesk. I set the database up on the correct domain and i setup username and passwords for all students and teachers at the school (this is for a private school management online program.)

any how here is the code

i have this setup on the domain where i built the database and here is a link to this page in action.
http://www.wyrchurch.com/RCA/login.php
as you can see the person who wrote this commented it but i changed alot here is a link to where i got the code so you can see the original cause mabe the error is comming from a change i made. now i did go back to the orginial once but it diddn't work.
http://www.tutorialized.com/tutorial/Login-Logout-with-a-Session-in-1-file/20041

Expand|Select|Wrap|Line Numbers

 
<?

// Use session variable on this page. This function must put on the top of page.

session_start();
 
////// Logout Section. Delete all session variable.

session_destroy();
 
$message="";
 
////// Login Section.

$Login=$_POST['Login'];

if($Login){ // If clicked on Login button.

$username=$_POST['username'];

$password=$_POST['password'];
 
// Connect database.

$host="localhost"; // Host name.

$db_user="rcadmin"; // MySQL username.

$db_password="nsds2004"; // MySQL password.

$database="RCA"; // Database name.

$RCA = mysql_pconnect($host, $db_user, $db_password) or trigger_error(mysql_error(),E_USER_ERROR);

 mysql_select_db($database, $RCA);
 
// Check matching of username and password.

$result=mysql_query("SELECT Login, Pass, Accesslvl FROM useraccess WHERE Login='username' AND pass='password'");

if(mysql_num_rows($result)!='0'){ // If match.

session_register("username"); // Craete session username.

header("location:main.php"); // Re-direct to main.php

}else{ // If not match.

$message="--- Incorrect Username or Password ---";

}
 
} // End Login authorize check.

?>
 
<html xmlns="http://www.w3.org/1999/xhtml">

<head>

<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

<title>Untitled Document</title>

</head>
 
<body>

<? echo $message; ?>

<form id="form1" name="form1" method="post" action="<? echo $PHP_SELF; ?>">

<table>

<tr>

<td>User : </td>

<td><input name="username" type="text" id="username" /></td>

</tr>

<tr>

<td>Password : </td>

<td><input name="password" type="password" id="password" /></td>

</tr>

</table>

<input name="Login" type="submit" id="Login" value="Login" />

</form>

</body>

</html>

Jan 9 '07 #1

Follow Post Reply

3946

ronverdonk

4,258

Expert 4TB

The SELECT query is incorrect. You use constants ('username' and 'password')and you must use the variable names in which you have stored the username and the password. I also added the error message display to this statement. SELECT statement must be:[php]$result=mysql_query("SELECT Login, Pass, Accesslvl FROM useraccess WHERE Login='$username' AND pass='$password'")
or die("SELECT error: " . mysql_error());[/php]
Ronald :cool:

Jan 9 '07 #2

tolkienarda

316

100+

Hi thanks
that didn't seem to fix all of the problems. I tried to do some basic injection to bypass the user pass field

Expand|Select|Wrap|Line Numbers

1'or'1'='1

and it worked so i now i think that the problem is definatly with my database or the connection. i remember which forum i am in so if the following is out of line please tell me and i will repost in the correct forum.
here are what the useraccess table looks listed below are all of the sql commands for the entire database.

Expand|Select|Wrap|Line Numbers

 
CREATE TABLE `useraccess` (

  `Login` varchar(4) NOT NULL default '',

  `Accesslvl` int(1) NOT NULL default '0',

  `Pass` varchar(10) NOT NULL default '',

  PRIMARY KEY  (`Login`)

) ENGINE=MyISAM DEFAULT CHARSET=latin1;

and the data in it

Expand|Select|Wrap|Line Numbers

 
INSERT INTO `useraccess` VALUES ('kska', 1, '442677ee0a');

INSERT INTO `useraccess` VALUES ('lska', 1, '6a0b078b24');

INSERT INTO `useraccess` VALUES ('kfar', 1, '2d9a3b9c24');

INSERT INTO `useraccess` VALUES ('boli', 1, '7f3929231d');

INSERT INTO `useraccess` VALUES ('calu', 1, '25bce6805f');

INSERT INTO `useraccess` VALUES ('rrav', 1, '10b354ad0e');

INSERT INTO `useraccess` VALUES ('jwin', 1, '1be083995a');

INSERT INTO `useraccess` VALUES ('dsco', 1, '5ab409f300');

INSERT INTO `useraccess` VALUES ('mshi', 1, '4ab1bfa158');

INSERT INTO `useraccess` VALUES ('smen', 1, '49b042c67f');

INSERT INTO `useraccess` VALUES ('ahai', 1, '496724782b');

INSERT INTO `useraccess` VALUES ('kcho', 1, '2286f34263');

INSERT INTO `useraccess` VALUES ('cbar', 2, '560f954803');

INSERT INTO `useraccess` VALUES ('tblo', 2, '422655e331');

INSERT INTO `useraccess` VALUES ('cste', 2, '66cbb47e22');

INSERT INTO `useraccess` VALUES ('aste', 2, '4d4640b12e');

INSERT INTO `useraccess` VALUES ('nyoh', 2, '74be5b5f63');

INSERT INTO `useraccess` VALUES ('pbur', 2, '712fd7684d');

INSERT INTO `useraccess` VALUES ('pgib', 2, '66acd61906');

INSERT INTO `useraccess` VALUES ('ngib', 2, '5604d7af03');

INSERT INTO `useraccess` VALUES ('egib', 2, '423ee8e130');

INSERT INTO `useraccess` VALUES ('kgro', 2, '66f5799c22');

INSERT INTO `useraccess` VALUES ('dhai', 2, '4d57fc102d');

INSERT INTO `useraccess` VALUES ('thai', 2, '74bc0e6363');

INSERT INTO `useraccess` VALUES ('jorh', 2, '4be463b221');

INSERT INTO `useraccess` VALUES ('joeh', 2, '6ccb3e7f22');

INSERT INTO `useraccess` VALUES ('khen', 2, '0e3763ae08');

INSERT INTO `useraccess` VALUES ('dake', 2, '7139bc404d');

INSERT INTO `useraccess` VALUES ('deke', 2, '66b3616006');

INSERT INTO `useraccess` VALUES ('ckel', 2, '561c5b0f07');

INSERT INTO `useraccess` VALUES (' ilo', 2, '422e22be31');

INSERT INTO `useraccess` VALUES ('glut', 2, '66fb783b22');

INSERT INTO `useraccess` VALUES ('bpea', 2, '4d499d0d2e');

INSERT INTO `useraccess` VALUES ('jpea', 2, '7480a48c63');

INSERT INTO `useraccess` VALUES ('dror', 2, '4bca34b020');

INSERT INTO `useraccess` VALUES ('zrop', 2, '4e715c7948');

INSERT INTO `useraccess` VALUES ('sash', 2, '0e27703f08');

INSERT INTO `useraccess` VALUES ('stsh', 2, '712b9b974d');

INSERT INTO `useraccess` VALUES ('epat', 2, '0123ws');

Jan 10 '07 #3

tolkienarda

316

100+

OK i found the problem but i have no idea how to fix it.

when i entered all of my passwords into the mysql data base i used this basic structure

Expand|Select|Wrap|Line Numbers

 
INSERT INTO `useraccess` ( `Login` , `Accesslvl` , `Pass` )

VALUES (

'admin', '0', PASSWORD( 'rootpass' )

);

thanks
eirc

Jan 10 '07 #4

tolkienarda

316

100+

ok i didn't finish typing that sorry. the problem is that all of the passwords are encrypted and when i compare the passwords entered via the form i get an incorrect password. i had one password in the database that wasn't encrypted and it workded great.

and second. problem i am having is that i am a complete beginer at php and i am trying to save the Accesslvl field from that row to a variable then redirect the browser to either a student or teacher page

thanks eric

Jan 10 '07 #5

phpmyadmin database built on my server and i cannot connect wiht my login page

Post your reply

Similar topics