[epidemik]

i have a form to witch i put the login info in, but for some reason it does not log the user in. I use a hash to encrypt the password. Can any find any wrong with my script that can cause it not to function properly?

login form:

<div id="login">
<cfif session.logged_in eq 0>
        <font color="#FFFF00">Login</font> <a href="register.cfm">Register</a>
        <form action="process/loggedin.cfm" method="post">
   Username: <input type="text" name="user_name">
   Password: <input type="password" name="user_password">
   <input type="submit" value="Log In"><BR>
</form>

Process the form code:


	<cfelseif session.logged_in neq 0>
    <cfoutput>
   <div class="login_welcome"> Welcome #session.user_name#</div>
    </cfoutput>
</cfif>
</div>

process code:

<cfset user_password = hash(form.user_password)>

<cfquery datasource="#dsn#" name="check_login">
select user_id, user_name, user_password, user_level, user_dob, verify, verifcode
from Members 
where user_name = <cfqueryparam cfsqltype="cf_sql_varchar" value="#form.user_name#" maxlength="50"> and user_password = <cfqueryparam cfsqltype="cf_sql_varchar" value="#user_password#">
</cfquery>



<cfoutput query="check_login">
<cfif #verify# EQ "No">
	<cflocation url="../verify/verify_check.cfm?vid=#verifcode#">
</cfif> 
</cfoutput>

<cfset session.logged_in = 0>

<cfif check_login.recordcount eq 0>
	<script language="Javascript">

<!--
// please keep these lines on when you copy the source
// made by: Nicolas - http://www.javascript-page.com

alert ("Your Login info was not correct")
//-->

</script>
<cflocation url="../index.cfm">
<cfelseif check_login.recordcount eq 1>

	<cfset session.user_name = check_login.user_name>
    <cfset session.user_level = check_login.user_level>
    <cfset session.user_id = check_login.user_id>
    <cfset session.user_dob = check_login.user_dob>
	<cfset session.logged_in = 1>
	<cflocation url="../index.cfm">
    <cfelse>
    	<script language="Javascript">

<!--
// please keep these lines on when you copy the source
// made by: Nicolas - http://www.javascript-page.com

alert ("there was a problem with your login info, please contact admin...")
//-->

</script>
		<cflocation url="..index.cfm"> 
</cfif>

This post has been edited by epidemik: 26 August 2011 - 01:00 PM
Reason for edit:: fixed code tags

[Craig328]

Could be two things. You have a form.user_password that you hash and the result of the hash is stored in...an unscoped variable called user_password. So, when you pass that variable into your query, your page has two variables: user_password and form.user_password. It's entirely possible that CF is selecting the explicitly scoped user_password variable which would be form. Try naming the variable holding the hashed password value to something else and submitting that in your query or (and this is always a good idea) scope all your variables, always. Coldfusion has an order it progresses through in looking through the various available scopes when referencing an unscoped variables. In fact, if you look at my August 3rd post in this thread you can see the progression CF used a few versions ago.

The other problem is: why are you hashing the value? Are you saving the passwords as hashed values in the database? It seems obvious but if you're not hashing them or you're hashing them with a different algorithm then the values won't match between what the user is passing in and the value stored in the database.

This post has been edited by Craig328: 26 August 2011 - 01:55 PM

[epidemik]

I figured out the issue, I didnt know it was case sensitive. I am using CF9 in the older version of coldfusion

[Craig328]

CF itself isn't case sensitive. Your database can be though.

[epidemik]

Oh ok then that answer the question then

Edit: closing topic because it's become a spam target recently.

This post has been edited by Craig328: 10 September 2011 - 07:22 AM