Illufox
07-16-2008, 01:41 PM
Something really weird happened. I have used a login script for years and it has worked fine. I have used this script for my own site for years and also for my clients site. There were never any problems. But yesterday my client informed me, that he can now access the secured site without entering a user name and password. I noticed that the same happened on my own site. Both sites are on the same hosting server and since I didn't change anything on the script I was assuming that something happend on the hosting server. However, the hosting provider is unable to help.
I don't understand why the script has worked fine for a long time, and now all of a sudden the login check is bypassed without any explanation. My last resort is this forum, in case anybody has experienced the same.
Here are the scripts:
index.htm
(removed rest of html as not important here)
<form action="login.php" method="post">
<table border="0" cellspacing="2" cellpadding="2">
<tr>
<td align="right" class="header">Username:</td>
<td><input type="text" name="username" size="20"></td>
</tr>
<tr>
<td align="right" class="header">Password:</td>
<td><input type="password" name="password" size="20"></td>
</tr>
<tr>
<td> </td>
<td align="right"><input type="submit" name="Submit" value="Log in"> </td>
</tr>
</table>
</form>
Login.php
<?php
session_start();
ob_start();
include("database.php");
$query = "SELECT * FROM users WHERE user = '$username' LIMIT 1";
$result = mysql_query($query);
$qdata1 = mysql_fetch_object($result);
if ($qdata1->pass == "$password") {
$userprofile = $qdata1;
include "include/newsession.php";
header ('Location:welcome.php');
exit();
} else {
session_unset();
print "Wrong Login. Use your correct User Name and Password and try again.<br> <input type='submit' value='Retry' onClick='history.go(-1)'>";
}
mysql_close();
?>
database.php
(removed private data below)
<?php
/**
* Connect to the mysql database.
*/
$conn = mysql_connect("xxxxxx.xxxxxxmysql.com", "username", "password") or die(mysql_error());
mysql_select_db('database name', $conn) or die(mysql_error());
?>
newsession.php
<?php
$_SESSION['id'] = session_id();
$_SESSION['username'] = $username;
$_SESSION['userprofile'] = $userprofile;
$_SESSION['time'] = time();
?>
This script is very simple and should be correct as it has always worked fine. Any help is greatly appreciated.
I don't understand why the script has worked fine for a long time, and now all of a sudden the login check is bypassed without any explanation. My last resort is this forum, in case anybody has experienced the same.
Here are the scripts:
index.htm
(removed rest of html as not important here)
<form action="login.php" method="post">
<table border="0" cellspacing="2" cellpadding="2">
<tr>
<td align="right" class="header">Username:</td>
<td><input type="text" name="username" size="20"></td>
</tr>
<tr>
<td align="right" class="header">Password:</td>
<td><input type="password" name="password" size="20"></td>
</tr>
<tr>
<td> </td>
<td align="right"><input type="submit" name="Submit" value="Log in"> </td>
</tr>
</table>
</form>
Login.php
<?php
session_start();
ob_start();
include("database.php");
$query = "SELECT * FROM users WHERE user = '$username' LIMIT 1";
$result = mysql_query($query);
$qdata1 = mysql_fetch_object($result);
if ($qdata1->pass == "$password") {
$userprofile = $qdata1;
include "include/newsession.php";
header ('Location:welcome.php');
exit();
} else {
session_unset();
print "Wrong Login. Use your correct User Name and Password and try again.<br> <input type='submit' value='Retry' onClick='history.go(-1)'>";
}
mysql_close();
?>
database.php
(removed private data below)
<?php
/**
* Connect to the mysql database.
*/
$conn = mysql_connect("xxxxxx.xxxxxxmysql.com", "username", "password") or die(mysql_error());
mysql_select_db('database name', $conn) or die(mysql_error());
?>
newsession.php
<?php
$_SESSION['id'] = session_id();
$_SESSION['username'] = $username;
$_SESSION['userprofile'] = $userprofile;
$_SESSION['time'] = time();
?>
This script is very simple and should be correct as it has always worked fine. Any help is greatly appreciated.