password checking

[student_steve]

Hey guys, here is some code for a password security measure in a
website:

<?php
session_start();
$errorMessage = '';
if (isset($_POST['username']) && isset($_POST['password'])) {
if ($_POST['username'] === 'steven' && $_POST['password'] ===
'crocker') {
$_SESSION['basic_is_logged_in'] = true;
header('Location: http://users.cs.cf.ac.uk/S.J.Crocker/search.php');

} else {
$errorMessage = 'Sorry, wrong user id / password';
echo $errorMessage;
}
}
?>

The problem is, when i enter 'steven' as the username and 'crocker' as
the password.. nothing happerns, it should go to
"http://users.cs.cf.ac.uk/S.J.Crocker/search.php" but it remains on the
password enter screen. The error message works however, any idea where
im going wrong??

Cheers
Steve

[pieter_hordijk]

Why are you using three equal signs?

The following is enough:
if(($_POST['username'] == 'steven') && ($_POST['password'] ==
'crocker'))

[d]

"student_steve" <gi*********@hotmail.com> wrote in message
news:11**********************@i40g2000cwc.googlegr oups.com...

Hey guys, here is some code for a password security measure in a
website:

<?php
session_start();
$errorMessage = '';
if (isset($_POST['username']) && isset($_POST['password'])) {
if ($_POST['username'] === 'steven' && $_POST['password'] ===
'crocker') {
$_SESSION['basic_is_logged_in'] = true;
header('Location: http://users.cs.cf.ac.uk/S.J.Crocker/search.php');

} else {
$errorMessage = 'Sorry, wrong user id / password';
echo $errorMessage;
}
}
?>

The problem is, when i enter 'steven' as the username and 'crocker' as
the password.. nothing happerns, it should go to
"http://users.cs.cf.ac.uk/S.J.Crocker/search.php" but it remains on the
password enter screen. The error message works however, any idea where
im going wrong??
Have you checked that the session is being set correctly? Are you sure it's
actually working as expected?

Also, as you are using sessions, you should call session_write_close()
before you call header("location:...") - not doing so can cause serious
problems on some platforms.
Cheers
Steve

dave

[Rich]

"d" <[e-mail]> wrote in message
news:KG******************@text.news.blueyonder.co. uk...
<snip>

Also, as you are using sessions, you should call session_write_close()
before you call header("location:...") - not doing so can cause serious
problems on some platforms.

Dave,

Sorry to hijack the thread, but why would not calling session_write_close()
cause a problem on some platforms?

Cheers,
Rich (Still learning)

[Jerry Stuckle]

pi************@hotmail.com wrote:

Why are you using three equal signs?

The following is enough:
if(($_POST['username'] == 'steven') && ($_POST['password'] ==
'crocker'))

Three equal signs checks to ensure they are both the same type and the
same value.

Otherwise you can have the potential problem of the user entering a zero
for username and password. PHP could then try to compare as integers
instead of strings - and convert 'steven' and 'crocker' to zero. The
comparison would then be true.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[Mark A. Boyd]

On Wed, 15 Mar 2006 16:13:29 GMT, student_steve posted in comp.lang.php:

Hey guys, here is some code for a password security measure in a
website:

<?php
session_start();
$errorMessage = '';
if (isset($_POST['username']) && isset($_POST['password'])) {
if ($_POST['username'] === 'steven' && $_POST['password'] ===
'crocker') {
$_SESSION['basic_is_logged_in'] = true;
header('Location: http://users.cs.cf.ac.uk/S.J.Crocker/search.php');

} else {
$errorMessage = 'Sorry, wrong user id / password';
echo $errorMessage;
}
}
?>

The problem is, when i enter 'steven' as the username and 'crocker' as
the password.. nothing happerns, it should go to
"http://users.cs.cf.ac.uk/S.J.Crocker/search.php" but it remains on the
password enter screen. The error message works however, any idea where
im going wrong??

Correct me if I'm wrong (relatively new to PHP), but don't you need to exit()
immediately after a redirect?

header('Location: http://users.cs.cf.ac.uk/S.J.Crocker/search.php');
exit();
} else {

--
Mark A. Boyd
Keep-On-Learnin' :)

[Richard Levasseur]

No, you don't. I don't see why you would need to, except for perhaps
exit() causing any buffers to flush, thus sending the headers to the
client.

[Mark A. Boyd]

On Thu, 16 Mar 2006 05:27:29 GMT, Richard Levasseur posted in comp.lang.php:

No, you don't. I don't see why you would need to, except for perhaps
exit() causing any buffers to flush, thus sending the headers to the
client.

Thanks for the correction. I'm not sure what gave me that impression.
--
Mark A. Boyd
Keep-On-Learnin' :)

[d]

"Rich" <rf****@gmail.com> wrote in message
news:RZ******************@text.news.blueyonder.co. uk...

"d" <[e-mail]> wrote in message
news:KG******************@text.news.blueyonder.co. uk...
<snip>

Also, as you are using sessions, you should call session_write_close()
before you call header("location:...") - not doing so can cause serious
problems on some platforms.

Dave,

Sorry to hijack the thread, but why would not calling
session_write_close() cause a problem on some platforms?

Cheers,
Rich (Still learning)

No problem :)

Due to the way PHP's default session handler locks the session data file, if
the browser is re-directed to the new page *before* closing the connection
to the current script, the second script will be waiting for the first
script to close, and the first script is (apparently) not closed until the
second one is loaded. Essentially, I found that nearly all mac clients
would hang on issuing a Location: header. As soon as I added that command,
the problems disappeared. Windows was never affected, btw.

dave

[d]

"Mark A. Boyd" <mb****@sanDotrr.com.invalid> wrote in message
news:Xn********************************@66.75.164. 120...

On Thu, 16 Mar 2006 05:27:29 GMT, Richard Levasseur posted in
comp.lang.php:

No, you don't. I don't see why you would need to, except for perhaps
exit() causing any buffers to flush, thus sending the headers to the
client.
Thanks for the correction. I'm not sure what gave me that impression.

I was under the same impression, but I think that's just because it makes
sense to not output any content that the browser isn't going to render :-P

--
Mark A. Boyd
Keep-On-Learnin' :)

[Steve Chapel]

Jerry Stuckle wrote:

pi************@hotmail.com wrote:

Why are you using three equal signs?

The following is enough:
if(($_POST['username'] == 'steven') && ($_POST['password'] ==
'crocker'))

Three equal signs checks to ensure they are both the same type and the
same value.

Otherwise you can have the potential problem of the user entering a zero
for username and password. PHP could then try to compare as integers
instead of strings - and convert 'steven' and 'crocker' to zero. The
comparison would then be true.

But because $_POST["username"] is a string, and 'steven' is a string, a
string comparison will be done with ==, and the problem you mention with
a numeric comparison won't happen, right? I just tried some PHP code
with a simple variable ($str) in place of $_POST["username"] set to "0",
and a string comparison is done.

[Jerry Stuckle]

Steve Chapel wrote:

Jerry Stuckle wrote:

pi************@hotmail.com wrote:

Why are you using three equal signs?

The following is enough:
if(($_POST['username'] == 'steven') && ($_POST['password'] ==
'crocker'))

Three equal signs checks to ensure they are both the same type and the
same value.

Otherwise you can have the potential problem of the user entering a
zero for username and password. PHP could then try to compare as
integers instead of strings - and convert 'steven' and 'crocker' to
zero. The comparison would then be true.

But because $_POST["username"] is a string, and 'steven' is a string, a
string comparison will be done with ==, and the problem you mention with
a numeric comparison won't happen, right? I just tried some PHP code
with a simple variable ($str) in place of $_POST["username"] set to "0",
and a string comparison is done.

Steve,

In this particular example, that's true - it will compare OK, at current
versions of PHP. But it's still a good habit to get into.

--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[Shelly]

"Jerry Stuckle" <js*******@attglobal.net> wrote in message
news:tf********************@comcast.com...

Steve Chapel wrote:

Jerry Stuckle wrote:

pi************@hotmail.com wrote:

Why are you using three equal signs?

The following is enough:
if(($_POST['username'] == 'steven') && ($_POST['password'] ==
'crocker'))
Three equal signs checks to ensure they are both the same type and the
same value.

Otherwise you can have the potential problem of the user entering a zero
for username and password. PHP could then try to compare as integers
instead of strings - and convert 'steven' and 'crocker' to zero. The
comparison would then be true.

But because $_POST["username"] is a string, and 'steven' is a string, a
string comparison will be done with ==, and the problem you mention with
a numeric comparison won't happen, right? I just tried some PHP code with
a simple variable ($str) in place of $_POST["username"] set to "0", and a
string comparison is done.

Steve,

In this particular example, that's true - it will compare OK, at current
versions of PHP. But it's still a good habit to get into.

Maybe it is the "C" (and Java) in me, but I always compare with

if (!strcmp(first, second))

or strcasecmp. That way I am always sure I am comparing the contents of
strings. (Am I wasting my effort?)

Shelly

[Jerry Stuckle]

Shelly wrote:

"Jerry Stuckle" <js*******@attglobal.net> wrote in message
news:tf********************@comcast.com...

Steve Chapel wrote:

Jerry Stuckle wrote:
pi************@hotmail.com wrote:
>Why are you using three equal signs?
>
>The following is enough:
>if(($_POST['username'] == 'steven') && ($_POST['password'] ==
>'crocker'))
>

Three equal signs checks to ensure they are both the same type and the
same value.

Otherwise you can have the potential problem of the user entering a zero
for username and password. PHP could then try to compare as integers
instead of strings - and convert 'steven' and 'crocker' to zero. The
comparison would then be true.
But because $_POST["username"] is a string, and 'steven' is a string, a
string comparison will be done with ==, and the problem you mention with
a numeric comparison won't happen, right? I just tried some PHP code with
a simple variable ($str) in place of $_POST["username"] set to "0", and a
string comparison is done.

Steve,

In this particular example, that's true - it will compare OK, at current
versions of PHP. But it's still a good habit to get into.

Maybe it is the "C" (and Java) in me, but I always compare with

if (!strcmp(first, second))

or strcasecmp. That way I am always sure I am comparing the contents of
strings. (Am I wasting my effort?)

Shelly

Shelly,

$first === $second

does the same thing.
--
==================
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attglobal.net
==================

[ziizii]

Well, I'm calling die() after header("Location: ..."). A script is
supposed to not to continue in executing, if I'm redirecting client
somewhere else, but it does. Calling of die() this excecution stops and
that's what you probably want if you're redirecting client.