PHP Check User Script not working

Question

I've stumbled upon a bit of a problem. My checkuser.php isn't redirecting as it should to the members area page.

Basically login.html sends to checkuser.php which should then redirect to login_success.php

Here's the code `

<?
/* Check User Script */
session_start();  // Start Session

include 'db.php';
// Conver to simple variables
$username = $_POST['username'];
$password = $_POST['password'];

if((!$username) || (!$password)){
    echo "Please enter ALL of the information! <br />";
    include 'login_form.html';
    exit();
}

// Convert password to md5 hash
$password = md5($password);

// check if the user info validates the db
$sql = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password' AND activated='1'");
$login_check = mysql_num_rows($sql);

if($login_check > 0){
    while($row = mysql_fetch_array($sql)){
    foreach( $row AS $key => $val ){
        $$key = stripslashes( $val );
    }
        // Register some session variables!
        session_register('first_name');
        $_SESSION['first_name'] = $first_name;
        session_register('last_name');
        $_SESSION['last_name'] = $last_name;
        session_register('email_address');
        $_SESSION['email_address'] = $email_address;
        session_register('special_user');
        $_SESSION['user_level'] = $user_level;

        mysql_query("UPDATE users SET last_login=now() WHERE userid='$userid'");

        header("Location: login_success.php");
    }
} else {
    echo "You could not be logged in! Either the username and password do not match or you have not validated your membership!<br />
    Please try again!<br />";
    include 'login_form.html';
}
?>

Any help appreciated.

Thanks

You are vulnerable to [sql injection attacks](http://bobby-tables.com), and `session_register()` is pointless unless you're on a primordial-slime-era version of PHP. Just do `$_SESSION[...] = ...` instead. — Marc B, Jun 02 '14 at 14:59
Also `mysql_` functions are deprecated and please don't use `md5` for password hashing. — Pitchinnate, Jun 02 '14 at 15:00
What did you try ? Do you go into `if($login_check > 0){` for example? — BastienSander, Jun 02 '14 at 15:00
Okay, UPDATE! This was surrounded by HTML and after removing the HTML the code now works. Can anyone explain why that could be? — user3666207, Jun 02 '14 at 15:01
Regarding the SQL Injection attacks, can anyone suggest fixes or would I be better to modernise and start a fresh? — user3666207, Jun 02 '14 at 15:08

score 1 · Answer 1 · answered Jun 02 '14 at 15:00

1

you are not supposed to echo/print something before you

header("Location: login_success.php");

answered Jun 02 '14 at 15:00

volkinc

2,143
1
15
19

score 0 · Answer 2 · answered Jun 02 '14 at 15:02

0

Remove a $

 foreach( $row AS $key => $val ){
        $$key = stripslashes( $val );
 }

Like this:

foreach( $row AS $key => $val ){
        $key = stripslashes( $val );
 }

answered Jun 02 '14 at 15:02

Marten

1,376
5
28
49

score -1 · Answer 3 · answered Jun 02 '14 at 14:59

-1

What is the error you see?

If it's about "Output started" check twice both db.php and checkuser.php if they have any characters out of php tags <?php ?> it will cause header to not work. In most cases space is forgotten around somewhere.

answered Jun 02 '14 at 14:59

Can YILDIZ

414
3
16

PHP Check User Script not working

3 Answers3