parse delimited text file to seperate arrays

[lancewassing]

I'm hoping this question is simple. I am trying to create a login script for my already in place client manage using php. I have created a text file filled with usernames and passwords delimited by the "/" character. The file looks like this:

lance/wassi
norm /wassi
amand/yandt
aaron/willi
miche/young

i have an html form which uses the following code to post the userinput... this part works fine:

<form name="loginscript" action="login.php" method="POST"/>
<input type="text" name="username" />
<input type="password" name="password" />
<input type="submit" value="login" />
</form>
 
===login.php===
import_request_variables('p','p_');
 

the above code has been tested and works fine... but there seems to be a problem with code below which is allocated in login.php

<?php
    //load user input and print to screen for testing purposes
    import_request_variables('p','p_');
    echo "Hello " . $p_username . " " . $p_password;
 
    //define arrays
    $usernames = array();
    $passwords = array();
    $tmp_lines = array();
 
    //open the file
    $file = fopen("httP://localhost/PHP/loginscript/users.txt","r");
 
    //read the file line by line into the tmp_lines array
    $i = 0;
    while(!feof($file))
    {
        $tmp_lines[$i] = fgets($file);
        $i = $i + 1;
    }
 
    //explode the tmp array 1 by 1 into 2 seperate arrays
    $j = 0;
    while($j != $i)
    {
        $tmp_global = explode("/",$tmp_lines[$j],11)
        $usernames[$j] = $tmp_global[0];
        $passwords[$j] = $tmp_global[1];
        $j = $j + 1;
    }
 
    //test to see if right data is populated
    for($k = 0; $k <= $j; $k++)
    {
        echo "<br /> " . $usernames[$k] . " " . $passwords[$k];
    }
 
?>
 

This gives me the HTTP 500 error page.

I have modified the code numerous times and the best result so far has been a blank page... does anyone have any idea as to how this works as employees are viewing data which they should not be seeing.... i need this to work and am not interested in using mysql...?

[lancewassing]

there are some slight gramatical errors which im pretty sure i have fixed, such as the one in the url string for the file...

[Dormilich]

I would suspect something's wrong on the server (file permission and such) rather than with the PHP (you need a real mess to make a PHP error to HTTP 500)

PS: welcome at Bytes

[Markus]

You're using a plain text file to hold usernames and passwords? Big no no. Use a database. MySQL.

[numberwhun]

@Markus
Agreed, use a mysql database as Markus suggested, but to go a bit further with that, I would not store the password. Instead, I would simply create an md5 to create a hash of the password and store that in the database instead. Its a bit more secure. That way, when the users go to log in, you take whatever they enter for a password, convert it to an md5 hash, retrieve the hash from the database and compare the two to see if they match.

On another note, from someone who is learning PHP, I have question that is related to the users code (and could help them a bit I think).

Instead of how the file is read into the array above, couldn't you use this method? Wouldn't it be much easier and more efficient than looping through the file as done above? Just wanted to get some opinions.

Regards,

Jeff

[Markus]

@numberwhun
Yes. Stupid me. I was going to remark on not hashing a password, but forgot. *embarrased*

@numberwhun
Yes, you're correct. That would be much more efficient. Glad to see you're learning PHP. :D

[Atli]

Hi.

I would agree with Dormilich, this doesn't sound like a problem with your PHP code, but rather with your server.

PHP usually handles errors internally, printing errors and warnings, but not actually causing the request to fail in such a spectacular way.

The HTTP 500 error code is more likely to be caused by a server error, such as if it doesn't recognize the .php extension, or if you have a badly formatted .htaccess file.
Is there anything like that you can think of that may be causing this?

I suggest you contact your host, or whomever administrates the server, and ask them if they can identify the problem. The HTTP server logs may give you an indication as to what is going wrong.

As to your code.
I would advise against using the import_request_variables function, like you do. It can very easily cause security holes in your application.

Instead, I would use the $_POST super-global to import the exact values you need.

For example, rather than doing:

import_request_variables('p','p_');
echo "Hello " . $p_username . " " . $p_password;

Do:

$p_username = htmlentities($_POST['username']);
$p_password = htmlentities($_POST['password']);
echo "Hello " . $p_username . " " . $p_password;

The htmlentities function converts all HTML special characters into their respective HTML entities, so they will be shown rather than parsed as HTML. (You should always use this, or a similar, method on unsafe strings before printing them into your HTML)

[Atli]

@numberwhun
Or, even better, create a sha1 hash.
MD5 is getting old. SHA1 is a lot more secure.

And if that is not enough, try the hash function. That gives you access to a number of hash algorithms, including stronger variants of the SHA algorithm as well as a number of less popular algorithms.
(See hash_algos)