PHP Development
 
Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
User Name:
Password:
Remember me

The Shed is going Social! Join us on FaceBook and Twitter and chime in on the conversation.

Go Back   Dev Shed Forums > Programming Languages > PHP Development
Reload this Page

PHP-Security - Trouble with my login-page code


Reply
Add This Thread To:
  Del.icio.us   Digg   Google   Spurl   Blink   Furl   Simpy   Y! MyWeb 
« Previous Thread | Next Thread »  
Thread Tools Search this Thread Rate Thread Display Modes
 
Unread Dev Shed Forums Sponsor:
  #1  
Old January 17th, 2013, 10:58 PM
GreeneStreet GreeneStreet is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jan 2013
Posts: 5 GreeneStreet User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 55 m 28 sec
Reputation Power: 0
Angry PHP-Security - Trouble with my login-page code
So last week our company decided to migrate our website to a new server and after doing so we noticed one key element has stopped working- our login!
php.5.3
apache 2.3.3

The files are the exact same- the SQL database is the exact same- but once the correct login information is input the page just loads to 198.154.221.208/login.php?accesscheck=%2Fsubscribers%2Fgetting-started.php
instead of 198.154.221.208/subscribers/getting-started.php

We know that it correctly recognizes that the user has permissions because if we enter the incorrect password or just bogus information period- it brings us to the failed login page: 198.154.221.208/login.php?access=failed

So without further adieu, here's the code:
PHP Code:
<?php require_once('Connections/dbconnec.php'); ?>
<?php
// *** Validate request to login to this site.
if (!isset($_SESSION)) {
  session_start();
}

$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($_GET['accesscheck'])) {
  $_SESSION['PrevUrl'] = $_GET['accesscheck'];
}

if (isset($_POST['email'])) {
  $loginUsername=$_POST['email'];
  $password=$_POST['password'];
  $MM_fldUserAuthorization = "prilevel_id";
  $MM_redirectLoginSuccess = "/subscribers/getting-started.php";
  $MM_redirectLoginFailed = "login.php?access=failed";
  $MM_redirecttoReferrer = false;
  mysql_select_db($database_dbconnec, $dbconnec);

  $LoginRS__query=sprintf("SELECT cust_email, cust_password, prilevel_id, acctexp_date FROM customers WHERE cust_email='%s' AND cust_password='%s' AND acctexp_date >= CURDATE()",
  get_magic_quotes_gpc() ? $loginUsername : addslashes($loginUsername), get_magic_quotes_gpc() ? $password : addslashes($password));

  $LoginRS = mysql_query($LoginRS__query, $dbconnec) or die(mysql_error());
  $loginFoundUser = mysql_num_rows($LoginRS);
  if ($loginFoundUser) {

        $loginStrGroup  = mysql_result($LoginRS,0,'prilevel_id');

        //declare two session variables and assign them
        $_SESSION['MM_Username'] = $loginUsername;
        $_SESSION['MM_UserGroup'] = $loginStrGroup;

        if (isset($_SESSION['PrevUrl']) && false) {
          $MM_redirectLoginSuccess = $_SESSION['PrevUrl'];
        }
        header("Location: " . $MM_redirectLoginSuccess );
  }
  else {
        header("Location: ". $MM_redirectLoginFailed );
  }
}
?>


I'm not really very familiar with PHP or SQL so much as HTML and CSS so this is all still kind of foreign to me- SO I bring it before the community....
Reply With Quote
  #2  
Old January 17th, 2013, 11:41 PM
portcitysoftwar portcitysoftwar is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Dec 2012
Posts: 163 portcitysoftwar User rank is Sergeant (500 - 2000 Reputation Level)portcitysoftwar User rank is Sergeant (500 - 2000 Reputation Level)portcitysoftwar User rank is Sergeant (500 - 2000 Reputation Level)portcitysoftwar User rank is Sergeant (500 - 2000 Reputation Level)portcitysoftwar User rank is Sergeant (500 - 2000 Reputation Level) 
Time spent in forums: 1 Day 13 h 18 m 54 sec
Reputation Power: 17
Could you provide information about the original server and the new server including Apache versions, php versions, mysql versions, and Operating Systems.

One common thing i see that really shouldnt be an issue because people should check there cases but windows is not case sensitive with files or database columns while unix based os is.

Quote:
Originally Posted by GreeneStreet
So last week our company decided to migrate our website to a new server and after doing so we noticed one key element has stopped working- our login!
php.5.3
apache 2.3.3

The files are the exact same- the SQL database is the exact same- but once the correct login information is input the page just loads to 198.154.221.208/login.php?accesscheck=%2Fsubscribers%2Fgetting-started.php
instead of 198.154.221.208/subscribers/getting-started.php

We know that it correctly recognizes that the user has permissions because if we enter the incorrect password or just bogus information period- it brings us to the failed login page: 198.154.221.208/login.php?access=failed

So without further adieu, here's the code:
PHP Code:
<?php require_once('Connections/dbconnec.php'); ?>
<?php
// *** Validate request to login to this site.
if (!isset($_SESSION)) {
  session_start();
}

$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($_GET['accesscheck'])) {
  $_SESSION['PrevUrl'] = $_GET['accesscheck'];
}

if (isset($_POST['email'])) {
  $loginUsername=$_POST['email'];
  $password=$_POST['password'];
  $MM_fldUserAuthorization = "prilevel_id";
  $MM_redirectLoginSuccess = "/subscribers/getting-started.php";
  $MM_redirectLoginFailed = "login.php?access=failed";
  $MM_redirecttoReferrer = false;
  mysql_select_db($database_dbconnec, $dbconnec);

  $LoginRS__query=sprintf("SELECT cust_email, cust_password, prilevel_id, acctexp_date FROM customers WHERE cust_email='%s' AND cust_password='%s' AND acctexp_date >= CURDATE()",
  get_magic_quotes_gpc() ? $loginUsername : addslashes($loginUsername), get_magic_quotes_gpc() ? $password : addslashes($password));

  $LoginRS = mysql_query($LoginRS__query, $dbconnec) or die(mysql_error());
  $loginFoundUser = mysql_num_rows($LoginRS);
  if ($loginFoundUser) {

        $loginStrGroup  = mysql_result($LoginRS,0,'prilevel_id');

        //declare two session variables and assign them
        $_SESSION['MM_Username'] = $loginUsername;
        $_SESSION['MM_UserGroup'] = $loginStrGroup;

        if (isset($_SESSION['PrevUrl']) && false) {
          $MM_redirectLoginSuccess = $_SESSION['PrevUrl'];
        }
        header("Location: " . $MM_redirectLoginSuccess );
  }
  else {
        header("Location: ". $MM_redirectLoginFailed );
  }
}
?>


I'm not really very familiar with PHP or SQL so much as HTML and CSS so this is all still kind of foreign to me- SO I bring it before the community....
Reply With Quote
  #3  
Old January 18th, 2013, 05:26 AM
paulh1983 paulh1983 is offline
Contributing User
Dev Shed Regular (2000 - 2499 posts)
  
Join Date: Dec 2004
Posts: 2,237 paulh1983 User rank is First Lieutenant (10000 - 20000 Reputation Level)paulh1983 User rank is First Lieutenant (10000 - 20000 Reputation Level)paulh1983 User rank is First Lieutenant (10000 - 20000 Reputation Level)paulh1983 User rank is First Lieutenant (10000 - 20000 Reputation Level)paulh1983 User rank is First Lieutenant (10000 - 20000 Reputation Level)paulh1983 User rank is First Lieutenant (10000 - 20000 Reputation Level)paulh1983 User rank is First Lieutenant (10000 - 20000 Reputation Level)paulh1983 User rank is First Lieutenant (10000 - 20000 Reputation Level) 
Time spent in forums: 2 Weeks 1 Day 11 h 4 m
Reputation Power: 201
in that code i cannot see any reference to "accesscheck"? var being set?

what i can see is $loginStrGroup = mysql_result($LoginRS,0,'prilevel_id'); where i think script is getting the privilege but is not doing anything with this? is that all the code or is there some below you have omitted?

What i would do to debug is place
echo "n"; after various parts of the script to see the execution step. (i.e. echo 1, then echo 2 and so on....)
Reply With Quote
  #4  
Old January 18th, 2013, 08:49 AM
E-Oreo's Avatar
E-Oreo E-Oreo is offline
Lost in code
Click here for more information.
  
Join Date: Dec 2004
Posts: 7,947 E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)  Folding Points: 945 Folding Title: Novice Folder
Time spent in forums: 2 Months 10 h 37 m 24 sec
Reputation Power: 7053
Most likely the login is working correctly, but either the session isn't sticking or the code for checking whether the user is logged in isn't working. It looks like the user is being logged in, redirected to the getting started page, then being returned to the login page because the getting started page thinks they're not logged in.

Something like extra space at the bottom of the Connections/dbconnec.php file could cause this if output buffering was enabled by default on the old server but not on the new server. If error messages were enabled it would throw a warning if that were the case.
__________________
PHP FAQ
How to program a basic, secure login system using PHP
Connect with me on LinkedIn


Quote:
Originally Posted by Spad
Ah USB, the only rectangular connector where you have to make 3 attempts before you get it the right way around
Reply With Quote
  #5  
Old January 18th, 2013, 08:54 AM
Triple_Nothing Triple_Nothing is offline
Contributing User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jun 2009
Posts: 297 Triple_Nothing User rank is Corporal (100 - 500 Reputation Level)Triple_Nothing User rank is Corporal (100 - 500 Reputation Level)Triple_Nothing User rank is Corporal (100 - 500 Reputation Level)Triple_Nothing User rank is Corporal (100 - 500 Reputation Level) 
Time spent in forums: 3 Days 8 h 45 m 39 sec
Reputation Power: 5
I know the URL is not as desired, but does the user arrive at the correct page? If so, does the server have URL Rewriting set up? If not, this is perhaps the original way the user is forwarded. Just a guess...
Reply With Quote
  #6  
Old January 18th, 2013, 11:48 AM
GreeneStreet GreeneStreet is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jan 2013
Posts: 5 GreeneStreet User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 55 m 28 sec
Reputation Power: 0
Someone else recommended changing

PHP Code:
 $MM_redirectLoginSuccess = $_SESSION['PrevUrl']; 


to

PHP Code:
 $MM_redirectLoginSuccess = urldecode($_SESSION['PrevUrl']); 


But that didn't change anything

Allow me a second and I will answer all your questions in order:

@portcity
As far as matching cases- you are referring to database, table names, and column names-correct?

I am uncertain of the original server's settings. I'm a contracted worker for this company and it is my understanding that they were just lucky to receive access to their Cpanel just to back up their files for transfer b/c the original company was headed for a restructure. Idk what was going on there. But the new VPS is running:
Apache 2.2.23
Linux Server- Centos 5.9
Php 5.3.20
MySQL 5.5



@PaulH

Here's the rest of the code below that script
Code:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- InstanceBegin template="/Templates/defaultv2.dwt.php" codeOutsideHTMLIsLocked="false" -->
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<!-- InstanceBeginEditable name="doctitle" -->
<title>Fix Your Persistency</title>
<!-- InstanceEndEditable -->
<link href="stylesv2.css" rel="stylesheet" type="text/css" />
<!-- InstanceBeginEditable name="head" --><!-- InstanceEndEditable -->
</head>

<body>
<div id="page">
	<div id="header"><a href="https://www.fixyourpersistency.com/index.php">Home</a> | <a href="https://www.fixyourpersistency.com/login.php">Login</a> | <a href="https://www.fixyourpersistency.com/services.php">Services</a> |<a href="https://www.fixyourpersistency.com/contact-us.php"> Contact Us</a></div>

	<div id="banner"></div>

	<div id="menu"><!-- InstanceBeginEditable name="menu" --><!-- InstanceEndEditable --></div>
	<div id="content"><!-- InstanceBeginEditable name="content" -->
	  <h1>Login
	  </h1>
	  <?php if ($_GET['access'] == 'failed') { // IF LOGIN FAILS?>
	  		<div class="error-block">
			<h1>Access not granted</h1>
			<p>Please check your email address and password. </p>
			<p><a href="forgotpassword.php">Forgot Your Password?</a> </p>
			<p>If you feel you are receiving this message in error please <a href="contact-us.php">contact us</a>. </p>
			</div>
	   <?php }
	  		if (isset($accesscheck)) { // IF TRIED TO ACCESS RESTRICTED PAGE
			  	echo '<div class="error-block">You must login to access that page. </div>' ;
				}
	   ; ?>
	  <form ACTION="<?php echo $loginFormAction; ?>" method="POST" name="login" id="login">
                <table border="0">
                  <tr>
                    <td align="right">Email Address: </td>
                    <td><input name="email" type="text" id="cust_email" /></td>
                  </tr>
                  <tr>
                    <td align="right">Password:</td>
                    <td><input name="password" type="password" id="password" /></td>
                  </tr>
                  <tr>
                    <td align="right">&nbsp;</td>
                    <td><input type="submit" name="Submit" value="Login" /></td>
                  </tr>
                  <tr align="center">
                    <td colspan="2"><a href="v2/forgotpassword.php">Forgot your password?</a></td>
                  </tr>
        </table>
    </form>
  <!-- InstanceEndEditable --></div>

	<div id="footer"><span class="footer"><a href="https://www.fixyourpersistency.com/index.php">Home</a> | <a href="https://www.fixyourpersistency.com/login.php">Login</a> | <a href="https://www.fixyourpersistency.com/services.php"> Services</a> | <a href="https://www.fixyourpersistency.com/contact-us.php">Contact Us</a> | <a href="https://www.fixyourpersistency.com/privacy.php">Privacy Statement</a> | <a href="https://www.fixyourpersistency.com/termsofuse.php">User Agreement</a></span></div>
	<div id="disclaimer">FixYourPersistency.com is a Decko Enterprises, LLC company and*is in no way affiliated with Primerica Financial Services or any Primerica Financial Services company or subsidiary.</div>
	<div id="pageFooter"><div id="siteCopy"><script src="ScriptLibrary/copyright.js">
	</script> Decko Enterprises, LLC. All rights reserved.</div>
			<div id="wnmg-logo">
		<a href="http://www.greenestreetdesigns.com" target="_blank"><img src="images/gsd_logo7.png" width="75" height="45"
		alt="Hosted and Managed by Greene Street Designs LLC" border="0" /</a>
		</div>
	</div>


</div>
</body>
<!-- InstanceEnd --></html>


@Oreo

I tried this- while I did find an extra space at the end of the last line of code following the closing ";", it did not produce any changes in the process.

@Triple
Oreo is spot on with what is happening I believe:
"It looks like the user is being logged in, redirected to the getting started page, then being returned to the login page because the getting started page thinks they're not logged in."

It doesn't go to the next page, which should be the /subscribers/getting-started.php page.
Reply With Quote
  #7  
Old January 18th, 2013, 12:56 PM
GreeneStreet GreeneStreet is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jan 2013
Posts: 5 GreeneStreet User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 55 m 28 sec
Reputation Power: 0
getting-started.php
I just wanted to include the code from the getting-started.php file since Oreo mentioned that might be where I'm getting kicked back from.

Code:
<?php
session_start();
$MM_authorizedUsers = "";
$MM_donotCheckaccess = "true";
$rvp = $_SESSION['MM_UserGroup'];
// *** Restrict Access To Page: Grant or deny access to this page
function isAuthorized($strUsers, $strGroups, $UserName, $UserGroup) { 
  // For security, start by assuming the visitor is NOT authorized. 
  $isValid = False; 

  // When a visitor has logged into this site, the Session variable MM_Username set equal to their username. 
  // Therefore, we know that a user is NOT logged in if that Session variable is blank. 
  if (!empty($UserName)) { 
    // Besides being logged in, you may restrict access to only certain users based on an ID established when they login. 
    // Parse the strings into arrays. 
    $arrUsers = Explode(",", $strUsers); 
    $arrGroups = Explode(",", $strGroups); 
    if (in_array($UserName, $arrUsers)) { 
      $isValid = true; 
    } 
    // Or, you may restrict access to only certain users based on their username. 
    if (in_array($UserGroup, $arrGroups)) { 
      $isValid = true; 
    } 
    if (($strUsers == "") && true) { 
      $isValid = true; 
    } 
  } 
  return $isValid; 
}

$MM_restrictGoTo = "../login.php";
if (!((isset($_SESSION['MM_Username'])) && (isAuthorized("",$MM_authorizedUsers, $_SESSION['MM_Username'], $_SESSION['MM_UserGroup'])))) {   
  $MM_qsChar = "?";
  $MM_referrer = $_SERVER['PHP_SELF'];
  if (strpos($MM_restrictGoTo, "?")) $MM_qsChar = "&";
  if (isset($QUERY_STRING) && strlen($QUERY_STRING) > 0) 
  $MM_referrer .= "?" . $QUERY_STRING;
  $MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" . urlencode($MM_referrer);
  header("Location: ". $MM_restrictGoTo); 
  exit;
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- InstanceBegin template="/Templates/v2-page.dwt.php" codeOutsideHTMLIsLocked="false" -->
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<!-- InstanceBeginEditable name="doctitle" -->
<title>Fix Your Persistency</title>
<!-- InstanceEndEditable -->
<link href="../stylesv2.css" rel="stylesheet" type="text/css" />

<!-- InstanceBeginEditable name="head" -->
<script language="JavaScript" type="text/javascript">
<!--
function MM_goToURL() { //v3.0
  var i, args=MM_goToURL.arguments; document.MM_returnValue = false;
  for (i=0; i<(args.length-1); i+=2) eval(args[i]+".location='"+args[i+1]+"'");
}
//-->
</script>
<!-- InstanceEndEditable -->
<!-- InstanceParam name="login_form" type="boolean" value="false" -->
<!-- InstanceParam name="subcriber_menu" type="boolean" value="true" -->
</head>

<body>
<div id="page">
	<div id="header"><a href="https://www.fixyourpersistency.com/index.php">Home</a> | <a href="https://www.fixyourpersistency.com/login.php">Login</a> | <a href="https://www.fixyourpersistency.com/services.php">Services</a> |<a href="https://www.fixyourpersistency.com/contact-us.php"> Contact Us</a></div>
	
	<div id="banner"></div>
	
	<div id="menu">
	
	
	
	<strong>Subscriber Menu:</strong> <a href="getting-started.php">Getting Started</a> | <a href="help-documents.php">Help & Documentation</a> | <a href="profile.php">Update Profile</a> | <a href="/support">Support Desk</a> | <a href="logout.php">Logout</a></div>
	<div id="content">
	<h1><!-- InstanceBeginEditable name="page-title" -->Getting Started <!-- InstanceEndEditable --></h1>
	<div id="format">
                    <!-- InstanceBeginEditable name="page-content" -->

              <?php if($rvp != "1") { ; ?>
              <h2>Getting  Started for those Below RVP</h2>
              <p> When Calculating Your Team Numbers Use the Following  Steps<br />
                Step 1: Pull the following  reports: </p>
              <ul>
                <li>REP Profile Persistency Focus Report (Found at POL/REP Profile/Persistency)</li>
                <li>17 Month Detail Report* for you and all of the REPs on your team that have written business over the last 17 months (Found at POL/Business Tracking/Persistency)</li>
                <li>Lapsed Reports for you and your team members that have written business over the last 17 months (Found at POL/Business Tracking/Persistency)</li>
                <li>Not Taken Report* for you and your team members that have written business over the last 17 months (Found at POL/Business Tracking/Persistency)</li>
                <li>The next month’s Daily Blast All Activity Report (Found at POL/Daily Blast/All Activity and select the next month from the pull down menu)</li>
                <li>The list of policies issued in the last 60 days (Found at POL/Life Manager/ Issued Polices as Requested Only) </li>
                <li>The list of policies that have been issued with requirements (Found at POL/Life Manger/ Issued Policies with Requirements Only)</li>
                <li>The list of policies that are scheduled to close incomplete within the next 30 days (Found at POL/Life Manager/Underwriting/ Closing less than 30 days)</li>
              </ul>
              <p>
		Step 2: Click on the Support Desk menu link.  Once there register for the Support Desk.  The Support Desk will allow you to participate in the “Ask the Expert” function and the “Body of Knowledge” 
		portions of the site.  You will not be able to utilize this portion of the site without doing so.<br/><br/>
		
		Step 3:  Register for the QBI Maximizer Tutorial by clicking on the icon located on the home page or by phone at <strong>919-806-0204 Ext.130.  You can attend the QBI Maximizer Tutorial as often as you 
		like.  There are three levels of the tutorial.</strong><br/><br/>
		
		Step 4: Insert the data from the previous month in the appropriate fields. This information is located on your REP Profile Persistency Focus Report. Click Calculate.<br/><br/>
		
		Step 5: Combine the Submitted, Placed, Lapsed and NTO numbers for you and your team.* Enter data that you can’t control such as Lapsed Cases Rolling Off, Placed Cases Rolling Off, 
		Submitted Cases Rolling Off and Not Takens Rolling Off which can be found on your 17 Month Detail Report.<br/><br/>
		
		Step 6: Enter the number of New Lapsed and Not Taken cases. This information can be found on the next month’s Daily Blast All Activity Report.** You will also need to look at the number of policies that 
		have been issued with requirements to see if they will go NTO within the month that you are studying.* In addition, you will also have to consider the number of policies that are scheduled to close incomplete 
		within the next 30 days to determine which of those cases will occur during the month you are studying.* The policies issued with requirements and policies closing incomplete in the next 30 days that will occur 
		in the month you are studying will also count as New Not Takens.<br/><br/>
		
		Step 7: Look at your list of policies issued as requested.* Notice the “Days Issued’ column.* You will need to determine how many policies have been issued in the current month you are studying.* To determine how 
		many have been issued you must take the current date and subtract 1 from it.* Count the number of policies that have been issued from that number and less.<br/>
		For example, let’s say today is the 29th of the month.* You must subtract 1 from 29, which is 28.* Therefore, you will count how many policies have been issued as requested for at least 28 days or less.* You will also 
		need to subtract out policies that were related to policy changes or reinstatements.* In addition, poll your REPs for the number of apps they expect to submit this month as well as the number of policies they expect to 
		get issued without stop signs.<br/><br/>
		
		Step 8: Determine how many NTOs you will get reopened and on the computer by the end of the calendar month.* Enter that number into the appropriate field.<br/><br/>
		
		Step 9:Determine how many Reinstatements will get reinstated and on the computer by the end of the calendar month.* Enter that number into the appropriate field.<br/><br/>
		
		Step 10: Press Calculate.
		</p>
		
              <p>When Calculating Your Personal Numbers Use the  Following Steps<br />
                Step 1: Pull the following  reports: </p>
              <ul>
                <li>Persistency Report (Found at POL/Business Tracking/Click on Persistency/ Choose Persistency from the Report Type drop down menu/ Choose Who to View Base shop/ Choose what to view Personal/ Click View)</li>
                <li>Taken Report (Found at POL/Business Tracking/Click on Persistency/ Choose Taken from the Report Type drop down menu/ Choose Who to View Base shop/ Choose what to view Personal/ Click View)</li>
                <li>17 Month Detail Report* for you only (Found at POL/Business Tracking/Persistency)</li>
                <li>Lapsed Reports for you only (Found at POL/Business Tracking/Persistency)</li>
                <li>Not Taken Report* for you only (Found at POL/Business Tracking/Persistency) </li>
                <li>The next month’s Daily Blast All Activity Report (Found at POL/Daily Blast/All Activity and select the next month from the pull down menu) Your personal cases are all you need from this report.</li>
                <li>The list of policies issued in the last 60 days (Found at POL/Life Manager/ Issued Polices as Requested Only)* Your personal cases are all you need from this report.</li>
                <li>The list of policies that have been issued with requirements (Found at POL/Life Manger/ Issued Policies with Requirements Only) Your personal cases are all you need from this report.</li>
                <li>The list of policies that are scheduled to close incomplete within the next 30 days (Found at POL/Life Manager/Underwriting/ Closing less than 30 days) Your personal cases are all you need from this report.</li>
              </ul>
              <p>
		Step 2: Insert the data from the previous month in the appropriate fields. This information is located on your Persistency and Taken Reports. Click Calculate.<br/><br/>
		
		Step 3: Enter data that you can’t control such as Lapsed Cases Rolling Off, Placed Cases Rolling Off, Submitted Cases Rolling Off and Not Takens Rolling Off which can be found on your 17 Month Detail Report.<br/><br/>
		
		Step 4: Enter the number of personal New Lapsed and Not Taken cases. This information can be found on the next month’s Daily Blast All Activity Report.** You will also need to look at the number of policies that 
		have been issued with requirements to see if they will go NTO within the month that you are studying.* In addition, you will also have to consider the number of policies that are scheduled to close incomplete within
		the next 30 days to determine which of those cases will occur during the month you are studying.* The policies issued with requirements and policies closing incomplete in the next 30 days that will occur in the 
		month you are studying will also count as New Not Takens.<br /><br/>
		 
		Step 5: Look at your list of policies issued as requested.* Notice the “Days Issued’ column.* You will need to determine how many policies have been issued in the current month you are studying.* To determine how 
		many have been issued you must take the current date and subtract 1 from it.* Count the number of policies that have been issued from that number and less.<br/>
		For example, let’s say today is the 29th of the month.* You must subtract 1 from 29, which is 28.* Therefore, you will count how many policies have been issued as requested for at least 28 days or less.* Note:* Only 
		count the cases for which you are responsible.<br/><br/>
		
		Step 6: Determine how many NTOs you will get reopened and on the computer by the end of the calendar month.* Enter that number into the appropriate field.<br/><br/>

		Step 7: Determine how many Reinstatements will get reinstated and on the computer by the end of the calendar month.* Enter that number into the appropriate field.<br/><br/>

              Step  8: Press Calculate
			  <?php } else {; ?>

				              <h2>Getting  Started for RVPs</h2>
              <p> When Calculating Your Team Numbers Use the Following  Steps<br />
                Step 1: Pull the following  reports: </p>
              <ul>
                <li>REP Profile Persistency Focus Report (Found at POL/REP Profile/Persistency)  </li>
                <li>17 Month Detail Report  (Found at POL/Business Tracking/Persistency)</li>
                <li>Lapsed Reports (Found at POL/Business Tracking/Persistency) </li>
                <li>Not Taken Report  (Found at POL/Business Tracking/Persistency) </li>
                <li>The next month’s Daily Blast All Activity Report (Found at POL/Daily Blast/All Activity and select the next month from the pull down menu) </li>
                <li>The list of policies issued in the last 60 days (Found at POL/Life Manager/ Issued Polices as Requested Only) </li>
                <li>The list of policies that have been issued with requirements (Found at POL/Life Manger/ Issued Policies with Requirements Only) </li>
                <li>The list of policies that are scheduled to close incomplete within the next 30 days (Found at POL/Life Manager/Underwriting/ Closing less than 30 days) </li>
              </ul>
              <p>Step 2: Click on the Support Desk menu link.  Once there register for the Support Desk.  The Support Desk will allow you to participate in the “Ask the Expert” function and the “Body of Knowledge” portions 
              of the site.  You will not be able to utilize this portion of the site without doing so.<br /><br/>
                Step 3:  Register for the QBI Maximizer Tutorial by clicking on the icon located on the home page or by phone at <strong>919-806-0204 Ext.130.  You can attend the QBI Maximizer Tutorial as often as you like.  
                There are three levels of the tutorial.</strong><br /><br/>
		Step 4: Insert the data from the previous month in the appropriate fields. This information is located on your REP Profile Persistency Focus Report. Click Calculate.<br /><br/>
		Step 5: Enter data that you can’t control such as Lapsed Cases Rolling Off, Placed Cases Rolling Off, Submitted Cases Rolling Off and Not Takens Rolling Off which can be found on your 17 Month Detail Report.<br /><br/>
		Step 6: Enter the number of New Lapsed and Not Taken cases. This information can be found on the next month’s Daily Blast All Activity Report.** You will also need to look at the number of policies that have
		 been issued with requirements to see if they will go NTO within the month that you are studying.* In addition, you will also have to consider the number of policies that are scheduled to close incomplete within
		  the next 30 days to determine which of those cases will occur during the month you are studying.* The policies issued with requirements and policies closing incomplete in the next 30 days that will occur in the 
		  month you are studying will also count as New Not Takens.<br/><br/>
		Step 7:  Look at your list of policies issued as requested.* Notice the “Days Issued’ column.* You will need to determine how many policies have been issued in the current month you are studying.* To determine how 
		many have been issued you must take the current date and subtract 1 from it.* Count the number of policies that have been issued from that number and less.* 
For example, let’s say today is the 29th of the month.* 
		
You must subtract 1 from 29, which is 28.* Therefore, you will count how many policies have been issued as requested for at least 28 days or less.* You will also need to subtract out policies that were related to 
		
policy changes or reinstatements.* In addition, poll your REPs for the number of apps they expect to submit this month as well as the number of policies they expect to get issued without stop signs<br/><br/>
                Step 8: Determine how many NTOs you will get reopened and on the computer by the end of the calendar month.* Enter that number into the appropriate field.<br/><br/>
                Step 9: Determine how many Reinstatements will get reinstated and on the computer by the end of the calendar month.* Enter that number into the appropriate field.<br/><br/>
                Step 10: Press Calculate.
                </p>
             
			  
			  <?php } ; ?>
			  <p>
                  <input name="Button" type="button" onclick="MM_goToURL('parent','/subscribers/model.php');return document.MM_returnValue" value="Continue" />
                </p>		

				 
            <!-- InstanceEndEditable --></td>
	</div>
  </div>
	
	<div id="footer"><span class="footer"><a href="https://www.fixyourpersistency.com/index.php">Home</a> | <a href="https://www.fixyourpersistency.com/login.php">Login</a> | <a href="https://www.fixyourpersistency.com/services.php"> Services</a> | <a href="https://www.fixyourpersistency.com/contact-us.php">Contact Us</a> | <a href="https://www.fixyourpersistency.com/privacy.php">Privacy Statement</a> | <a href="https://www.fixyourpersistency.com/termsofuse.php">User Agreement</a></span></div>
	<div id="disclaimer">FixYourPersistency.com is a Decko Enterprises, LLC company and*is in no way affiliated with Primerica Financial Services or any Primerica Financial Services company or subsidiary.
</div>	
	<div id="pageFooter"><div id="siteCopy"><script src="../ScriptLibrary/copyright.js">
	</script> Decko Enterprises, LLC. All rights reserved.</div> 
			<div id="wnmg-logo">
		<a href="http://www.greenestreetdesigns.com" target="_blank"><img src="../images/gsd_logo7.png" width="75" height="45" 
		alt="Hosting and Management by Greene Street Designs LLC Columbia, SC" border="0" /></a>
		</div>
	</div>


</div>
</body>
<!-- InstanceEnd --></html>
Reply With Quote
  #8  
Old January 18th, 2013, 05:01 PM
E-Oreo's Avatar
E-Oreo E-Oreo is offline
Lost in code
Click here for more information.
  
Join Date: Dec 2004
Posts: 7,947 E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)  Folding Points: 945 Folding Title: Novice Folder
Time spent in forums: 2 Months 10 h 37 m 24 sec
Reputation Power: 7053
For debugging purposes, directly below session_start(); in getting-started.php add
PHP Code:
 var_export($_SESSION); exit; 


And then determine what it says when you try to log in.
Reply With Quote
  #9  
Old January 18th, 2013, 05:06 PM
GreeneStreet GreeneStreet is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jan 2013
Posts: 5 GreeneStreet User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 55 m 28 sec
Reputation Power: 0
Quote:
Originally Posted by E-Oreo
For debugging purposes, directly below session_start(); in getting-started.php add
PHP Code:
 var_export($_SESSION); exit; 


And then determine what it says when you try to log in.



The output just says
"array ( )"

The url in the browser now reads sitename.com/subscribers/getting-started.php
Reply With Quote
  #10  
Old January 18th, 2013, 08:48 PM
E-Oreo's Avatar
E-Oreo E-Oreo is offline
Lost in code
Click here for more information.
  
Join Date: Dec 2004
Posts: 7,947 E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)E-Oreo User rank is General 91st Grade (Above 100000 Reputation Level)  Folding Points: 945 Folding Title: Novice Folder
Time spent in forums: 2 Months 10 h 37 m 24 sec
Reputation Power: 7053
OK, so the problem is your session isn't working, which means there is probably a problem with the cookie.

What do you get if you add var_export(headers_sent()); before the call to session_start() on your login.php page.
Reply With Quote
  #11  
Old January 18th, 2013, 10:52 PM
GreeneStreet GreeneStreet is offline
Registered User
Dev Shed Newbie (0 - 499 posts)
  
Join Date: Jan 2013
Posts: 5 GreeneStreet User rank is Just a Lowly Private (1 - 20 Reputation Level) 
Time spent in forums: 55 m 28 sec
Reputation Power: 0
Code:
false
Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/persist/public_html/subscribers/getting-started.php:2) in /home/persist/public_html/subscribers/getting-started.php on line 3
array ( )


Should I have removed the other line of code first?
This is what I get without that statement
Code:
false
Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/persist/public_html/subscribers/getting-started.php:2) in /home/persist/public_html/subscribers/getting-started.php on line 3

Warning: Cannot modify header information - headers already sent by (output started at /home/persist/public_html/subscribers/getting-started.php:2) in /home/persist/public_html/subscribers/getting-started.php on line 41
Reply With Quote
Reply

Viewing: Dev Shed Forums > Programming Languages > PHP Development > PHP-Security - Trouble with my login-page code

« Previous Thread | Next Thread »

Developer Shed Advertisers and Affiliates



Thread Tools  Search this Thread 
Search this Thread:

Advanced Search
Display Modes  Rate This Thread 
Linear Mode Linear Mode
Rate This Thread:


Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
View Your Warnings | New Posts | Latest News | Latest Threads | Shoutbox
Forum Jump

Forums: » Register « |  User CP |  Games |  Calendar |  Members |  FAQs |  Sitemap |  Support | 
  
 


Powered by: vBulletin Version 3.0.5
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.

© 2003-2013 by Developer Shed. All rights reserved. DS Cluster - Follow our Sitemap