Problem with login script using php

[James]

Hey guys. I seem to be having a problem with security on my login script.


This is the code for my login page.

<?php
    include('connect.php');
 
    $username=$_POST['username'];
    $password=$_POST['password'];
 
    // protect from MySQL injection 
    $username = stripslashes($username);
    $password = stripslashes($password);
    $username = mysql_real_escape_string($username);
    $password = mysql_real_escape_string($password);
 
    $encrypted_password=md5($password);
 
    $sql="SELECT * FROM staff WHERE username='$username' and password='$encrypted_password'";
    $sqlresult=mysql_query($sql)or die("Could not retreive data from table");
 
    $row=mysql_fetch_array($sqlresult);
?>
 

All the code is working fine and it directs to the admin.php file upon successful login

<?php
            if (isset($_POST['submit']))
            {
 
                if ($row['username']==$username && $row['password']==$encrypted_password)
                {
                    $username = $_SESSION['username'];
                    $password = $_SESSION['password'];
                    header("Location:admin.php");
                }
 
                    elseif ($username == '' || $password == '')
                    {
                        echo '<div style="padding:5px 10px 5px 10px; margin:0px auto 20px; border:2px solid #FF0000; color:#FF0000; width:176px;">';
                        echo "Please fill in all required fields";
                        echo '</div>';
                    }
 
                        else
                        {
                            echo '<div style="padding:5px 10px 5px 10px; text-align:center; margin:0px auto 20px; border:2px solid #FF0000; color:#FF0000; width:255px;">';
                            echo "INCORRECT USERNAME AND PASSWORD ENTERED:";
                            echo "<br/>";
                            echo "Please enter a valid username and password";
                            echo '</div>';
                        }
            }
        ?>    
 
 

However, if I type in 'admin.php' into the appropriate place in the url in the address bar then I can view the page that should be secured with a login. Currently I have used sessions on the admin page to redirect somebody if they haven't first logged in.

 
<?php
    session_start();
 
        if ($_SESSION['username'] = '')
        {
            header("location:login.php");
        }
?>
 

Any feedback would be much appreciated

[johny10151981]

this line is wrong

if ($_SESSION['username'] = '')
 
//correct line would be
if ($_SESSION['username']=='')
//..
 

and in the log in page i.e. login.php start your session and as well save the user id in session

[charles07]

James

johny10151981 is right, you are missing an = , it is better to include a session check file in every page other than login page & the code should be like this

<?php
    session_start();
 
        if ($_SESSION['username'] == '')
        {
            header("location:login.php");
        }
?>
 

also make sure you set $_SESSION['username'] once logged in credentials are checked correct.

[Dormilich]

<?php
    session_start();
 
        if ($_SESSION['username'] = '')
        {
            header("location:login.php");
        }
?>

some nifty little trick to avoid this problem:
if ('' == $_SESSION['username'])
should you accidentally write
if ('' = $_SESSION['username']),
you’ll be prompted with an error.