My "I Love Physics" site is almost done but currently I have concerns over security. Even though its just a school site for my Physics teacher, I am worried that the user passwords could easily be attained by "dodgy" personnel. So I would like to store encrypted passwords on the database.
How does one go about using the md5 function?
CODE
<?
//connect to database//
$db_name="ilovephysics";
$connection = @mysql_connect("localhost","root","password") or die(mysql_error());
$db = @mysql_select_db($db_name,$connection) or die(mysql_error());
//collect data from previous page and assign to variables//
$title=$_POST['title'];
$fname=$_POST['firstname'];
$lname=$_POST['lastname'];
$email=$_POST['emailaddress'];
$password=$_POST['password'];
$add1=$_POST['streetaddress1'];
$add2=$_POST['streetaddress2'];
$bdate=$_POST['birthdate'];
$bmonth=$_POST['birthmonth'];
$byear=$_POST['birthyear'];
$pcode=$_POST['postcode'];
$town=$_POST['town'];
$county=$_POST['county'];
$cnumber=$_POST['contactnumber'];
$squestion=$_POST['secretquestion'];
$sanswer=$_POST['secretanswer'];
//assign SQL query to a variable//
$sql="INSERT INTO tbl_users (title, fname, lname, add1, add2, bdate, bmonth, byear, pcode, town, county, cnumber, squestion, sanswer, email, password) VALUES
('$title', '$fname', '$lname', '$add1', '$add2', '$bdate', '$bmonth', '$byear', '$pcode', '$town', '$county', '$cnumber', '$squestion', '$sanswer', '$email', '$password'";
//run the query//
$result=@mysql_query($sql) or die(mysql_error());
?>
To complicate matters for myself slightly I also have a "View User" page for admin which echos the users password.
CODE
<?
//connect to database//
$db_name = "ilovephysics";
$connection = @mysql_connect("localhost","root","password") or die(mysql_error());
$db= @mysql_select_db($db_name,$connection) or die(mysql_error());
$id=$_GET['ID'];
//assign a SQL query text to a variable//
$sql="SELECT id, admin, title, fname, lname, add1, add2, bdate, bmonth, byear, pcode, town, county, cnumber, squestion, sanswer, email, password FROM tbl_users WHERE ID=$id;";
//run the query and assign all the rows that are returned to the variable $result//
$result = @mysql_query($sql) or die(mysql_error());
//count the number of rows in the output//
$numrows=mysql_numrows($result);
//each time the loop executes, assign a value from the database to the variables//
$admin=mysql_result($result,$i,"admin");
$title=mysql_result($result,$i,"title");
$fname=mysql_result($result,$i,"fname");
$lname=mysql_result($result,$i,"lname");
$add1=mysql_result($result,$i,"add1");
$add2=mysql_result($result,$i,"add2");
$bdate=mysql_result($result,$i,"bdate");
$bmonth=mysql_result($result,$i,"bmonth");
$byear=mysql_result($result,$i,"byear");
$pcode=mysql_result($result,$i,"pcode");
$town=mysql_result($result,$i,"town");
$county=mysql_result($result,$i,"county");
$cnumber=mysql_result($result,$i,"cnumber");
$squestion=mysql_result($result,$i,"squestion");
$sanswer=mysql_result($result,$i,"sanswer");
$email=mysql_result($result,$i,"email");
$password=mysql_result($result,$i,"password");
?>
Here is the echo:
CODE
<td>Password</td>
<td><? echo "$password"; ?></td>
Upon using the md5 function would I need to remove this password feature? Or is there a way to "un"encrypt the password and display it on the View User page in its normal form.
CODE
<?php require_once('../Connections/ilovephysics.php'); ?><?php
// *** Validate request to login to this site.
if (!isset($_SESSION)) {
session_start();
}
$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($_GET['accesscheck'])) {
$_SESSION['PrevUrl'] = $_GET['accesscheck'];
}
if (isset($_POST['email'])) {
$loginUsername=$_POST['email'];
$password=$_POST['password'];
$MM_fldUserAuthorization = "";
$MM_redirectLoginSuccess = "../buy/user.php";
$MM_redirectLoginFailed = "loginfail.php";
$MM_redirecttoReferrer = false;
mysql_select_db($database_ilovephysics, $ilovephysics);
$LoginRS__query=sprintf("SELECT email, password FROM tbl_users WHERE email='%s' AND password='%s'",
get_magic_quotes_gpc() ? $loginUsername : addslashes($loginUsername), get_magic_quotes_gpc() ? $password : addslashes($password));
$LoginRS = mysql_query($LoginRS__query, $ilovephysics) or die(mysql_error());
$loginFoundUser = mysql_num_rows($LoginRS);
if ($loginFoundUser) {
$loginStrGroup = "";
//declare two session variables and assign them
$_SESSION['MM_Username'] = $loginUsername;
$_SESSION['MM_UserGroup'] = $loginStrGroup;
if (isset($_SESSION['PrevUrl']) && false) {
$MM_redirectLoginSuccess = $_SESSION['PrevUrl'];
}
header("Location: " . $MM_redirectLoginSuccess );
}
else {
header("Location: ". $MM_redirectLoginFailed );
}
}
?>
The last bit of problem lies within the login page. So the user enters in their password. The password entered needs to be encrypted and compared against the encrypted password in the database. How would I go about this? I've only started learning PHP this year and its taking time to get the hang of it.
I'd appreciate any help offered in attaining a solution. Thanking you in advance.
| 