[tomasud]

Hello guys, ive just started to look at php and created a login form for my website, however ive run into a little snag.
The code works, but i want to check if they used my java program to get their infomation. (This is suppose to be a registration form for a gathering, and im using the registration to ensure that we keep track who is there or not) My problem is however, i can't get the if (md5($mac) == $seq) {} to work, no mater what i do it returns false. To clarify the java applet pulls the mac adress from the active adapter and displays it, aswell it converts it into a md5 hash to ensure that the mac address provided is generated by my software. Anyone had this problem before or can see the wrong doings in my code?

<?PHP


$seq = $_POST['seq'];
$mac = $_POST['mac'];

if (md5($mac) == $seq) {

//Database Information

$dbhost = localhost;
$dbname = *****;
$dbuser = *****;
$dbpass = *****;

//Connect to database

mysql_connect ( $dbhost, $dbuser, $dbpass)or die("Could not connect: ".mysql_error());
mysql_select_db($dbname) or die(mysql_error());


$name = $_POST['name'];
$email = $_POST['email'];    
$nick = $_POST['nick'];
$phone_number = $_POST['phone_number'];
$pref_game = $_POST['pref_game'];
$ref = $_POST['ref'];
$firewall_sts = $_POST['firewall_sts'];

$query = "INSERT INTO users (name, email, nick, phone_number, pref_game, ref, firewall_sts, seq, mac)
VALUES('$name', '$email', '$nick', '$phone_number', '$pref_game', '$ref', '$firewall_sts', '$seq', '$mac')";
mysql_query($query) or die(mysql_error());
mysql_close();
printf("<script>location.href='index.html'</script>");

} else {
echo 'Noe gikk galt :S Er du sikker på at du brukte programmet som fulgte med? Prøv igjen eller kontakt admin';
}

?>

The echo at the bottom is norwegian and says something about whether they used my software or not.

Cheers for help
-Thomas

This post has been edited by tomasud: 03 March 2010 - 05:46 PM

[CTphpnwb]

You have:

$seq = $_POST['seq'];
$mac = $_POST['mac'];

if (md5($mac) == $seq) {

in order for your if statement to work, the user would need to know the md5 hash for the text they typed in to the form for $_POST['mac']. They would then type that hash into the form for $_POST['seq']. I doubt that is what you intended.

[no2pencil]

Verify that you even got data, & what it is...

$err=0;
if(isset($_POST['seq'])) {
  $seq = $_POST['seq'];
}
else $err=1;
if(isset($_POST['mac'])) {
  $mac = $_POST['mac'];
}
else $err=1;

if($err==1) {
  echo "Values received :<hr>Seq : $seq<br>Mac : $mac<br>";
  die("Noe gikk galt :S Er du sikker på at du brukte programmet som fulgte med? Prøv igjen eller kontakt admin");
}

//Database Information

$dbhost = localhost;
$dbname = *****;
$dbuser = *****;
$dbpass = *****;

//.... & so on

[tomasud]

CTphpnwb, on 03 March 2010 - 06:17 PM, said:

You have:

$seq = $_POST['seq'];
$mac = $_POST['mac'];

if (md5($mac) == $seq) {

in order for your if statement to work, the user would need to know the md5 hash for the text they typed in to the form for $_POST['mac']. They would then type that hash into the form for $_POST['seq']. I doubt that is what you intended.

Like i said in first post they have to run a java applet that gives 2 pieces of info, here ill show you
Hash.jar Don't worry its not a virus or anything, ill garuantee it

Anyways, ill try to add that thing no2pencil said.

[tomasud]

well it did post now, heres the table if it helps

|1|Thomas *******|asd@gmail.com|Tomasu-Kun|9****427|WarCraft 3|UBERLEET|Ja|7f30651462882c3fe28aa0b518d8563|00-16-E6-80-70-75
id name email nick tlf game ref firewall md5 mac

As you can see it does post the correct value into seq, but for some reason md5(mac) != seq, see my problem?

This post has been edited by tomasud: 03 March 2010 - 07:47 PM

[no2pencil]

Can you show the output from my provided code? Based on what you posted, I can't determine that md5(mac) is or isnot equal to seq.

[tomasud]

The code dossn't seem to output anything, even if it does, im not sure how to see it, im very new to php, and im kinda stumbeling trough this.

[no2pencil]

Then values are being passed.

Change 1 to zero in the following :

if($err==1) {

Or better yet, try this!

$err=0;
if(isset($_POST['seq'])) {
  $seq = $_POST['seq'];
}
else $err=1;
if(isset($_POST['mac'])) {
  $mac = $_POST['mac'];
}
else $err=1;

if($err==1) {
  die("Not all values were passed!");
}

if(md5($mac) != $seq) {
  echo "Values received :<hr>Seq : $seq<br>Mac : $mac<br>";
  die("Noe gikk galt :S Er du sikker på at du brukte programmet som fulgte med? Prøv igjen eller kontakt admin");
}

//Database Information

$dbhost = localhost;
$dbname = *****;
$dbuser = *****;
$dbpass = *****;

//.... & so on

[tomasud]

Values received :
Seq : $seq
Mac : $mac

Thats whats being outputed if i removed all the if's from the first code

Values received :
Seq : 7f30651462882c3fe28aa0b518d8563
Mac : 00-16-E6-80-70-75
Noe gikk galt :S Er du sikker p� at du brukte programmet som fulgte med? Pr�v igjen eller kontakt admin

heres what i got from the second
and i used the if a != b statment on the last one, so something is wrong

This post has been edited by tomasud: 03 March 2010 - 08:01 PM

[tomasud]

Seq : 7f30651462882c3fe28aa0b518d8563
Mac : 7f30651462882c3fe28aa0b518d80563

i did
if(isset($_POST['mac'])) {
$mac = md5($_POST['mac']);
}

and theres one more char in the php md5 that in the one i made, how can this be?

There seems to be something wrong with my md5 creator in the java script

This post has been edited by tomasud: 03 March 2010 - 08:22 PM

[no2pencil]

md5 should always be the same amount of characters.

[tomasud]

Turns out the code i used to create the hash was total rubbish, ill try to fix it, and test again

[tomasud]

It works now, i just had to use some different code in the java, cheers for the help no2pencil!

[no2pencil]

Glad to see that you got it working