Login process did't work

Dev Shed Forums Sponsor:

August 17th, 2007, 01:44 AM

agnes01

Registered User

Join Date: Aug 2007

Location: manado

Posts: 1

Time spent in forums: 1 h 27 m 42 sec
Reputation Power: 0

Login process did't work

I am new on WAP programming.
i need help, my code didn't work,
when I browse it using emulator in my computer localhost.
i use M3GATE emulator. if empty nick and pass this code work.
but when nick and pass not match, user and nick match(right),
this code also go to else(proses login gagal).
Could any one help me to check my code, please?

user_login.wml
==================

php Code:

Original - php Code

<?xml version="1.0"?>
<!DOCTYPE wml PUBLIC "-//WAPFORUM//DTD WML 1.1//EN"> 
<wml> 
<card id="pesanbuku" title=" USER LOGIN " newcontext="true">
<do type="accept" label="Login">
 <go method="post" href="user_logincek.php">
 <postfield name="nick_user" value="$nick"/>
 <postfield name="password_user" value="$pass"/>
 </go>
</do>
 
<p align="center">
 <b> TOKO BUKU <big> "G" </big></b><br/>
 <img src="buku.wbmp" alt="gambar"></img><br/>
 <small>Turut Mencerdaskan Bangsa</small><br/>
 </p>
 
<p align="center">
 <b> Pemesanan Buku Online </b><br/>
 </p>
 
<p align="left"><br/>
<small> &nbsp; Nick User: </small>
<input type="text" name="nick" maxlength="15"/>
<small> &nbsp; Password : </small>
<input type="password" name="pass" maxlength="15"/>
<br/></p>
 
<p align="center"><br/>
<small>[<a href="user_menu.wml"> Kembali </a> &nbsp;]
</small>
</p>
</card>
</wml>

user_logincek.php
===================

php Code:

Original - php Code

<?php
header('Content-type:text/vnd.wap.wml');
echo('<?xml version="1.0"?>');
echo('<!DOCTYPE wml PUBLIC "-//WAPFORUM//DTD WML 1.1/EN">');
?>
 
<wml>
<card id="pesanlogin" title=" KONFIRMASI " newcontext="true">
<p align="center">
<small>
<?php
 
$host ='localhost';
$user = '*****';
$pass = '****';
$db   = '*****';
mysql_connect($host,$user,$pass);
mysql_select_db($db); 
 
 
$nick= $_REQUEST['nick_user'];
$pass= $_REQUEST['password_user'];
    
if ($nick=="")
    {
        echo " <br/> <big><b> ERROR </b></big><br/> ";
         echo "<br/><big> Nick User Belum dimasukkan </big><br/><br/><br/><br/>";
         echo "[ <a href=\"user_login.wml\">Ulangi</a>&nbsp;]";  
    }
else if ($pass=="")
    {
         echo " <br/> <big><b> ERROR </b></big><br/> ";
         echo"<br/><big>Password Belum dimasukkan </big><br/><br/><br/><br/>";
         echo "[ <a href=\"user_login.wml\">Ulangi</a>&nbsp;]";  
    }
else 
    {
        $sql=mysql_query("SELECT * FROM user WHERE
                    nick_user='$nick_user' 
                    AND password_user=password('$password_user')");
        $cek=mysql_num_rows($sql);
        if($cek>=1)
        {
             
    $date=date("d/m/Y");
    $sekarang=getdate();
    $jamsek=date("H:i:s");
    echo"<br/><big><b> SELAMAT DATANG <br/></b>
           Sistem Pemesanan Buku </big> <br/><br/>";
    echo"<b>User:$nick_user</b><br/>";
    echo"Anda Login Ke WAP Server <br/> Toko Buku  'G' <br/>";
    echo"Pukul : $jamsek<br/>";
    echo"Tanggal : $date<br/>";
    echo"========================<br/><br/>";
    echo"[<a href=\"cari_buku.php\"> Cari Buku</a>]";
    echo"[<a href=\"user_logout.php\"> Logout </a>&nbsp;]";
        
        }
        else
        {
            echo"<br/><b><big>PROSES LOGIN GAGAL</big> </b>";
            echo"======================<br/>";
            echo"<br/> User ini Belum Terdaftar !<br/>";
            echo " Username : $nick_user <br/>";
            echo " Password : ********* <br/> <br/> <br/> ";
            echo "[&nbsp;<a href=\"user_login.wml\">Ulangi</a>&nbsp;]";   
 
        }
    }
?>
 
</small>
</p>
</card>
</wml>

Last edited by jabba_29 : August 17th, 2007 at 07:46 AM. Reason: Put code in highlight tags

August 17th, 2007, 08:09 AM

jabba_29

Back in HEL

Join Date: Feb 2002

Location: Finland

Posts: 8,910

Folding Points: 57777 Folding Title: Beginner Folder

Time spent in forums: 3 Months 4 Weeks 1 Day 11 h 24 m 59 sec
Reputation Power: 1693

Send a message via Google Talk to jabba_29

Hi there, welcome to Dev Shed.
Thanks for sharing your database information - credentials duly noted

I have edited your post
1) to make it more readable
2) remove your database credentials

As to your actual code:

First off, you shouldn't really tell the user that they have failed due to wrong name or wrong password separately.
I know it is a PITA for a user when they are not sure what aspect of login was wrong,
but you should use a generic message - secutiry through obscurity or something like that.

You have no error trapping on database -
you should be using mysql_error() etc.... in development at least.
I have no sympathy if you are actually getting mysql errors and you don't report then

PHP Code:

snippet


		
			
 $sql=mysql_query("SELECT * FROM user WHERE

nick_user='$nick_user'

AND password_user=password('$password_user')");

You must always validate user input, whether it is from a form or not...

Have the passwords been saved in mysql password format?
If they have, and you only have a small user base - I suggest changing to SHA1

this is at least portable should you upgrade to progresSQl database for example.

This is an close to the way I would do it.

php Code:

Original - php Code

<?php
mysql_connect($host,$user,$pass); // (1)
mysql_select_db($db);  // (2)
 
$nick = isset($_REQUEST['nick_user'])     ? htmlentities($_REQUEST['nick_user'])     : '';
$pass = isset($_REQUEST['password_user']) ? htmlentities($_REQUEST['password_user']) : '';
 
if ($nick == '' OR $pass == ''){
  echo 'You have left an empty field somewhere - do something!';
  } else {
 
        $sql = mysql_query("SELECT * FROM user 
                        WHERE nick_user   = '$nick_user' 
                        AND password_user = password($password_user)"
                       );  // (3)
    
    if ( mysql_num_rows($sql) > 0 ) {
        // do your successful stuff
        } else {
        echo 'No rows returned, username or password incorrect';
        }
}

Feel free to add mysql_error() at mentioned points.
You can always add print_r($_REQUEST) to the page on processing,
see what parameters are actually being sent through the form.

HTH. Good luck.

__________________
Cheers,

Jamie

# mdb4u | mobile movie database] | Please help to test and promote
# skiFFie | Home of the 'accessibility module' for Drupal
# Jamie Burns [me] Accessibility Module [drupal]
# guidelines | search | wap resources | not getting help | fold to cure

__________________

Let the might of your compassion arise to bring a quick end
to the flowing stream of the blood and tears .....
Please hear my anguished words of truth.

__________________

Last edited by jabba_29 : August 17th, 2007 at 08:11 AM.

September 6th, 2007, 02:26 PM

MasterBirdIggy

Registered User

Join Date: Sep 2007

Location: Columbus, Georgia

Posts: 8

Time spent in forums: 1 h 37 m 11 sec
Reputation Power: 0

Thanks for the good info.

Thread Tools	Search this Thread
Email this Page	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode	Rate This Thread: