www.webdeveloper.com
Results 1 to 12 of 12

Thread: Problem with authentication in php script

  1. #1
    Join Date
    Aug 2004
    Location
    Switzerland
    Posts
    1,101

    Problem with authentication in php script

    Hi!
    I'm redoing a website for a friend and I have to deal with the php scripts already in place and done by somebody a bit like me : who can read and understand php, but not good enough to design something by himself and takes things from different places and put them together to make what he wants.

    I have two things that are more or less working, but buggy.
    I'm posting here the authentication problem, I'll open a new thread for the other problem as it has nothing to do with authentication.

    Basically, here is the thing : a user can register and put his information to be stored in the database.
    Registration is fine (inscriptionillu.php), information is collected in the DB like it should, but then, it doesn't return the confirmation page (traitementillu.php).
    If a user is already registered, when he tries to connect, on first try he'll get a blank page (like after registration). If he tries again, he'll get the confirmation page alright.

    I suspect there might be a session problem, or a problem in the if else statement, but I can't figure out why it's not working.

    Those two pages are called inside a third page, with a <? session_start();?> on top of it. Connexion to the database is fine as well. Pathways to the different scripts are fine too.

    Here they are :

    inscriptionillu.php :
    PHP Code:
    <?
    $met
    =$_POST["met"];

    if (
    $met=="change")
    {
        include(
    "connexion.php");

        @
    mysql_connect($host,$user,$pass)
           or die(
    "Impossible de se connecter");
        @
    mysql_select_db("$bdd")
           or die(
    "Impossible de se connecter");
        
        
    $table="illustrateurs2";
        
    $id=$_SESSION['id'];

        
    $query "SELECT * FROM $table WHERE ref='$id'";
        
        
    $result mysql_query($query);
        
    $val mysql_fetch_array($result);
        
    $nom=$val['nom'];
        
    $prenom=$val['prenom'];
        
    $mdp=$val['mdp'];
        
    $pseudo=$val['pseudo'];
        
    $site=$val['site'];
        
    $mail=$val['mail'];
        
    $tel=$val['tel'];
        
    $adresse=$val['adresse'];
        
    $adresse2=$val['adresse2'];
        
    $ville=$val['ville'];
        
    $code=$val['code'];
        
    $pays=$val['pays'];
        
    $jour=$val['jour'];
        
    $mois=$val['mois'];
        
    $annee=$val['annee'];
        
    $noto=$val['noto'];    
    }

    ?>

    <h2 class="titre">Inscription</h2>
    <br />
    <div align="center">

    <form name="formname" method="post" action="formillu.php?page=formulaire/traitementillu.php">
    <br />

      <span style="red">(*) champs
    obligatoires</span>
      <table border="0">

        <tbody>

          <tr>

            <td align="right"> Nom : </td>

            <td width="350" align="left"> <input size="30" maxlength="40" name="nom" type="area" <? if ($met=="change") echo "value='".$nom."'"?> ><span style="red">*</span>
            </td>

          </tr>

          <tr>

            <td align="right"> Pr&eacute;nom : </td>

            <td align="left"> <input size="30" maxlength="20" name="prenom" type="area" <? if ($met=="change") echo "value='".$prenom."'"?> ><span style="red">*</span>
            </td>

          </tr>

          <tr>

            <td align="right"> Email : </td>

            <td align="left"> <input size="40" name="mail" type="area"  <? if ($met=="change") echo "value='".$mail."'"?> ><span style="red">*</span>
            </td>

          </tr>

          <tr>

            <td align="right"> Mot de Passe : </td>

            <td align="left"> <input size="20" name="password" type="password"  <? if ($met=="change") echo "value='".$mdp."'"?> ><span style="red">*</span>
            </td>

          </tr>

          <tr>

            <td align="right"> Adresse : </td>

            <td align="left"> <input size="40" name="adresse1" type="area"  <? if ($met=="change") echo "value='".$adresse."'"?> ><span style="red">*</span>
            </td>

          </tr>

          <tr>

            <td align="right"> Adresse : </td>

            <td align="left"> <input size="40" name="adresse2" type="area" v <? if ($met=="change") echo "value='".$adresse2."'"?> >
            </td>

          </tr>

          <tr>

            <td align="right"> Code Postal : </td>

            <td align="left"> <input size="8" name="codepostal" type="area"  <? if ($met=="change") echo "value='".$code."'"?> ><span style="red">*</span>
            </td>

          </tr>

          <tr>

            <td align="right"> Ville : </td>

            <td align="left"> <input size="30" name="ville" type="area"  <? if ($met=="change") echo "value='".$ville."'"?> ><span style="red">*</span>
            </td>

          </tr>

          <tr>

            <td align="right"> Pays : </td>

            <td align="left"> <input size="10" name="pays" type="area" <? if ($met=="change") echo "value='".$pays."'"?> ><span style="red">*</span>
            </td>

          </tr>

          <tr>

            <td align="right"> T&eacute;l&eacute;phone : </td>

            <td align="left"> <input size="20" name="tel" type="area"  <? if ($met=="change") echo "value='".$tel."'"?> >
            </td>

          </tr>

          <tr>

            <td align="right"> Date de naissance : </td>

            <td align="left"> <input size="1" name="jour" maxlength="2" type="text"  <? if ($met=="change") echo "value='".$jour."'"?> > / <input size="1" name="mois" maxlength="2" type="area" <? if ($met=="change") echo "value='".$mois."'"?> > / <input size="3" name="annee" maxlength="4" type="text" <? if ($met=="change") echo "value='".$annee."'"?>> JJ/MM/AAAA
            </td>

          </tr>

          <tr>

            <td align="right"> Comment avez-vous connu <br />***** ? </td>

            <td align="left"> <input size="40" name="noto" type="area" <? if ($met=="change") echo "value='".$noto."'"?> ><span style="red">*</span>
            </td>

          </tr>

          <tr>

            <td align="right"> Votre pseudo sur le forum : </td>

            <td align="left"> <input size="20" name="pseudo" type="area" <? if ($met=="change") echo "value='".$pseudo."'"?> >
            </td>

          </tr>

          <tr>

            <td align="right"> Votre site internet : </td>

            <td align="left"> <input size="20" name="site" type="area" <? if ($met=="change") echo "value='".$site."'"?> >
            </td>

          </tr
        ></tbody>
      </table>

      <br />

      <input name="type" type="hidden" value="2">
      
      <?
      
    if ($met=="change")
      {
          echo 
    '<input name="new" type="hidden" value="no">';
      }
      else
      {
          echo 
    '<input name="new" type="hidden" value="yes">';
      }
      
    ?>

      <input name="envoi" value="ENVOYER" type="submit">

    </form>
    </div>
    Last edited by Ness_du_Frat; 12-06-2008 at 05:31 AM.

  2. #2
    Join Date
    Aug 2004
    Location
    Switzerland
    Posts
    1,101
    traitementillu.php

    PHP Code:
    <h2 class="titre">Traitement en cours</h2>
    <br />
    <div align="center">
    <?
    include("connexion.php");

    @
    mysql_connect($host,$user,$pass)
       or die(
    "Impossible de se connecter au serveur");
    @
    mysql_select_db("$bdd")
       or die(
    "Impossible de se connecter à la base");


    $type=$_POST["type"];

    if (
    $type==1
    {
        
    $table="illustrateurs2";
        
    $mail=$_POST["mail"];

        
    $query "SELECT * FROM $table WHERE mail='$mail'";
        
        
    $result mysql_query($query);
        
    $val mysql_fetch_array($result);

        if (
    $val['mail']=="")
        {
            echo 
    "Mail non valide";
        }

        else
        {
            if (
    $_POST["password"]==$val['mdp'])
            {
                
    $_SESSION['id']=$val['ref'];
                
    $_SESSION['nom']=$val['nom'];
                
    $_SESSION['prenom']=$val['prenom'];
                
    $_SESSION['mail']=$val['mail'];
                echo 
    "Vous êtes sur le formulaire d'envoi d'illustrations <br /> aux *****.<br /><br />";
                
    ?>
                <form name="edit" method="post" action="formillu.php?page=formulaire/inscriptionillu.php">
                <input name="met" type="hidden" value="change">
                <input name="envoi" value="Mise à jour de votre profil" type="submit">
                </form>
                <br><br>
                <form name="envoie" method="post" action="formillu.php?page=formulaire/infoillu.php">
                <input name="envoi" value="Envoi d'un document" type="submit">
                </form>
                
                <script language="JavaScript">
                //document.location = "http://****.fr/form.php?page=formulaire/info.php";
                </script><?
            
    }
            else
            {
                echo 
    "Le mot de passe est erroné.";
                echo 
    "Vous pouvez réessayer de vous connecter ou demander l'envoi de votre mot de passe depuis la page de connection.";
                
    ?><script language="JavaScript">
                window.setTimeout("window.back()",5000);
                </script><?
            
    }
        }
    }

    if (
    $type==2//entrer ou mise à jour d'un auteur.
    {
        
        
    $err=false;
        
    $mail=$_POST["mail"];
        
    $jour=$_POST["jour"];
        
    $mois=$_POST["mois"];
        
    $annee=$_POST["annee"];
        
    $mail."<BR>";
        
    $naissance."<BR>";
        
    $nom=$_POST["nom"];
        
    $prenom=$_POST["prenom"];
        
    $password=$_POST["password"];
        
    $adresse1=$_POST["adresse1"];
        
    $adresse2=$_POST["adresse2"];
        
    $codepostal=$_POST["codepostal"];
        
    $ville=str_replace("'""\'",$_POST["ville"]);
        
    $pays=str_replace("'""\'",$_POST["pays"]);
        
    $tel=$_POST["tel"];
        
    $noto=str_replace("'""\'",$_POST["noto"]);
        
    $pseudo=$_POST["pseudo"];
        
    $site=$_POST["site"];
        
    $new=$_POST["new"];

        if( empty(
    $nom) )
        {
            
    $err=true;
            
    $errtxt=$errtxt."Veuillez indiquer votre nom.<br>";
        }

        if( empty(
    $prenom) )
        {
            
    $err=true;
            
    $errtxt=$errtxt."Veuillez indiquer votre prénom.<br>";
        }

        if( !
    eregi("^[_\.0-9a-z-]+@([0-9a-z-]+\.)+[a-z]{2,4}$",$mail) )
        {
            
    $err=true;
            
    $errtxt=$errtxt."L'email entré est incorrect.<br>";
        }

        if( empty(
    $password) )
        {
            
    $err=true;
            
    $errtxt=$errtxt."Veuillez entrer un mot de passe.<br>";
        }

        if( empty(
    $adresse1) )
        {
            
    $err=true;
            
    $errtxt=$errtxt."Veuillez entrer au moins la première ligne d'adresse.<br>";
        }

        if( empty(
    $codepostal) )
        {
            
    $err=true;
            
    $errtxt=$errtxt."Veuillez indiquer votre code postal.<br>";
        }

        if( empty(
    $ville) )
        {
            
    $err=true;
            
    $errtxt=$errtxt."Veuillez indiquer votre ville.<br>";
        }

        if( empty(
    $pays) )
        {
            
    $err=true;
            
    $errtxt=$errtxt."Veuillez indiquer votre pays.<br>";
        }

    /*    if( empty($tel) )
        {
            $err=true;
            $errtxt=$errtxt."Veuillez indiquer votre téléphone.<br>";
        }*/

        
    if( empty($noto) )
        {
            
    $err=true;
            
    $errtxt=$errtxt."Comment avez-vous connu ***** ?<br>";
        }

        if (
    $err)
        {
        echo 
    "Le formulaire comporte une ou des erreurs :<br>";
        echo 
    $errtxt;
        }

        else  
    //il n'y a pas d'erreur dans le formulaire
        
    {
            
    $table="illustrateurs2";
        
            
    $query "SELECT * FROM $table WHERE mail='$mail'";
            
            
    $result mysql_query($query);
            
    $val mysql_fetch_array($result);
            
    $nb MYSQL_NUM_ROWS($result);    
            
            if(
    $new=="yes"//il s'agit d'un ajout d'auteur
            
    {
                if (
    $val['mail']=="" and $new==true)  //si le mail n'est pas dans la base, on peut l'ajouter
                
    {
                    
    $query="INSERT INTO illustrateurs2 VALUES('','$nom','$prenom','$password','$pseudo','$site','$mail','$tel','$adresse1','$adresse2','$ville','$codepostal', '$pays','$jour','$mois','$annee', '$noto')";
                    
    $result mysql_query($query);
        
                    IF (!
    $result) { $err=true$errtxt="Erreur, l'inscription n'a pas fonctionné. Veuillez réessayer ou contacter le webmaster au mail suivant : webmaster@*****.fr<br>".$query;}
                    ELSE
                    
                    {
                        
    $msg="Inscription réussie. Vous pouvez désormais nous envoyer vos illustrations par le formulaire.";
                        
    $query "SELECT * FROM $table WHERE mail='$mail'";
                        
                        
    $result mysql_query($query);
                        
    $val mysql_fetch_array($result);
                        
    $id=$val['ref'];
                    }
                }
                
                else  
    //si le mail est dans la base => ERRREUR
                
    {
                    echo 
    "Le mail entré est déjà dans la base de donnée.";
                }
            }  
    //fin ajout
            
            
    else //il s'agit d'une mise à jour
            
    {
                
    $id=$_SESSION['id'];
                
    $query="UPDATE illustrateurs2 SET nom='$nom', prenom='$prenom', mdp='$password', pseudo='$pseudo', site='$site', mail='$mail', tel='$tel', adresse='$adresse1', adresse2='$adresse2',ville='$ville', code='$codepostal', pays='$pays', jour='$jour',mois='$mois',annee='$annee', noto='$noto' WHERE ref='$id'";
                
    $result mysql_query($query);

                IF (!
    $result) { $err=true$errtxt="Erreur, la mise à jour n'a pas fonctionné. Veuillez réessayer ou contacter le webmaster au mail suivant : webmaster@*****.fr";}
                ELSE { 
    $msg="Votre profil est maintenant mis à jour."; }

            }  
    //fin mise à jour 
            
            //traitement de l'affichage
            
    if ($err)
            {
                echo 
    "Erreur lors du traitement : <br>".$errtxt;
            }
            else
            {
                echo 
    "Traitement réalisé avec succès.<br><br>".$msg;
                
                
    $_SESSION['id']=$id;
                
    $_SESSION['nom']=$nom;
                
    $_SESSION['prenom']=$prenom;
                
    $_SESSION['mail']=$mail;
                
                
    ?>
                <br><br><br>
                <form name="edit" method="post" action="formillu.php?page=formulaire/inscriptionillu.php">
                <input name="met" type="hidden" value="change">
                <input name="envoi" value="Mise à jour de votre profil" type="submit">
                </form>
                <br><br>
                <form name="envoie" method="post" action="formillu.php?page=formulaire/infoillu.php">
                <input name="envoi" value="Envoi d'un document" type="submit">
                </form>    
                <?        
                
            
    }
        
        } 
    //fin pas d'erreur dans les champs du formulaire.

    }

    ?>
    </div>
    For me, it's really painful to have to work with something like that, not really commented and not working, but the friend really wants me to work with this script and not design a new one.
    So, any clues about why it's never working on first try but always working on second try ? Is my guess about sessions correct ?
    Thanks for all input.

  3. #3
    Join Date
    Aug 2004
    Location
    Switzerland
    Posts
    1,101
    Is there a problem with the "post" not passing the session id through ?

  4. #4
    Join Date
    Aug 2004
    Location
    Switzerland
    Posts
    1,101

  5. #5
    Join Date
    Aug 2004
    Location
    Switzerland
    Posts
    1,101
    Is the script really that bad ?

    Another question : this script is exactly the same as another script used on the website. When I mean exactly, I really mean exactly. I simply duplicated the files, gave them a new name and had them connect to another table in the db.
    The other files work like a charm.
    I reviewed everything something like 10 times, but I couldn't find any difference.
    What is making the other files work and these ones not work ?

  6. #6
    Join Date
    Jan 2005
    Location
    Los Angeles, CA
    Posts
    4,887
    If a user is already registered, when he tries to connect, on first try he'll get a blank page (like after registration).
    If he tries again, he'll get the confirmation page alright.
    How does the user get to the confirmation page? Via a location header?
    If so, I fear there may be HTML getting out before PHP has a chance to delare header information.
    For debugging purposes, headers_sent() should prove handy before the part in the script that tries to redirect the user to the confirmation page.
    PHP Code:
    define("DEBUG_ON",1);//or 0
    if(DEBUG_ON && headers_sent()){
    echo 
    "<br>Les en-têtes HTTP ont déjà été envoyés!";//correct me if you got another way to say it
    echo "<br>Abort!";
    exit;

    If that is the case then ob_start() would seem like a practical solution to halt the output buffer in case you need to send a location header.
    If not, I'll look more closely at the script after you get back to the thread.

    PS - Nice to see you on the forums again
    Last edited by Ultimater; 12-10-2008 at 11:01 PM.

  7. #7
    Join Date
    Aug 2004
    Location
    Switzerland
    Posts
    1,101
    Hi Ulti ! Yes, long time no see, it's a pleasure to see you again here !!!

    The confirmation part is here :
    PHP Code:
          {
                echo "Traitement réalisé avec succès.<br><br>".$msg;
                
                $_SESSION['id']=$id;
                $_SESSION['nom']=$nom;
                $_SESSION['prenom']=$prenom;
                $_SESSION['mail']=$mail;
                
                ?>
                <br><br><br>
                <form name="edit" method="post" action="formillu.php?page=formulaire/inscriptionillu.php">
                <input name="met" type="hidden" value="change">
                <input name="envoi" value="Mise à jour de votre profil" type="submit">
                </form>
                <br><br>
                <form name="envoie" method="post" action="formillu.php?page=formulaire/infoillu.php">
                <input name="envoi" value="Envoi d'un document" type="submit">
                </form>    
                <?        
                
            
    }
    And the "mother page" has a session_start() at the very top. So, there should be no problem with the html being sent out before, because the headers have already been sent (I guess ?). And normally, when something like that happens, I get the "headers already sent by" error. (BTW, good translation !)

    So, basically, the problem is mainly related to the structure of the page, I think. I'll have have to look closely at it. I'll be in Paris for a few days, without access to the website, but I'll be back on Monday. I'll print this out and try to clear this mess a little bit...

    But I'll try your code right now !
    Thanks for your input !

  8. #8
    Join Date
    Aug 2004
    Location
    Switzerland
    Posts
    1,101
    So, tried your script and I didn't get any error output... but I still got the blank page

    I have the impression it stops after "traitement r&#233;alis&#233; avec succ&#232;s" and doesn't output the rest of the else statement...

    PHP Code:
    <? 
        
    else
            {
                echo 
    "Traitement réalisé avec succès.<br><br>".$msg// stops after that and doesn't output the rest of it.
                
                
    $_SESSION['id']=$id;
                
    $_SESSION['nom']=$nom;
                
    $_SESSION['prenom']=$prenom;
                
    $_SESSION['mail']=$mail;
                
                
    ?>
                <br><br><br> // from here, this is the part that should be appearing and that's not.
                <form name="edit" method="post" action="formillu.php?page=formulaire/inscriptionillu.php">
                <input name="met" type="hidden" value="change">
                <input name="envoi" value="Mise à jour de votre profil" type="submit">
                </form>
                <br><br>
                <form name="envoie" method="post" action="formillu.php?page=formulaire/infoillu.php">
                <input name="envoi" value="Envoi d'un document" type="submit">
                </form>    
                <?        
                
            
    }
    Last edited by Ness_du_Frat; 12-11-2008 at 04:16 AM.

  9. #9
    Join Date
    Jan 2005
    Location
    Los Angeles, CA
    Posts
    4,887
    When you say you get a blank page, how can the HTML before all the if-else statements on traitementillu.php get overlooked?
    Surely the blank page would look something more like:
    Code:
    <h2 class="titre">Traitement en cours</h2>
    <br />
    <div align="center">
    since these words appear at the very top of the PHP file and should render 'Traitement en cours' in big print, no?

    Or is the problem that $err is set to true and you get "Erreur lors du traitement : <br>".$errtxt rather than the confirmation part in the final if-else?
    Last edited by Ultimater; 12-11-2008 at 05:01 AM.

  10. #10
    Join Date
    Aug 2004
    Location
    Switzerland
    Posts
    1,101
    Yes, actually, you're right. I get "traitement en cours", and nothing else. My mistake for calling it a blank page... I meant "without the stuff which should actually be on it..."
    Sorry ^^

  11. #11
    Join Date
    Jan 2005
    Location
    Los Angeles, CA
    Posts
    4,887
    Does this mean that the script never reaches the final if else statement?
    Regardless whether $err would be true or false, you'd receive an additional echo.
    I think the next stage of debugging the script would be to make sure certain if statements are actually reached in the first place.

    It would seem only logical that the script would reach if ($type==2) since the page before it posts that value,
    yet perhaps include("connexion.php") preforms some kind of redirect and causes post data to be lost.
    That probably isn't the case but you can't be sure.
    Use the process of elimination.
    Next proceed lower down the page with test echos:
    PHP Code:
    echo ($_POST["type"]==2)?"so far so good":"type isn't set to 2"
    and so on until you narrow it down to where the script stops running.


    The only suspicious code I see so far is:
    PHP Code:
    $mail."<BR>";
    $naissance."<BR>"
    since you'd generally use = or .= to assign values.
    Last edited by Ultimater; 12-11-2008 at 05:23 AM.

  12. #12
    Join Date
    Aug 2004
    Location
    Switzerland
    Posts
    1,101
    Thanks !
    I leave in one hour for Paris, I'll have a good look at that when I'm back.
    The strange thing is that it does reach this state, otherwise it wouldn't output the "traitement en cours"... I'll have to test your debugging method.

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
HTML5 Development Center



Recent Articles