PHP Login form with HTML form

Question

Im trying to create a login form. THis is my HTML form code

<html> 
<head>
<title>Login</title>
<link rel="stylesheet" type="text/css" href="style.css" />
</head>
<body>
<div class="container login">
<form action="login.php" method="post" class="form-signin" id = "login_form" >
<h2 class="form-signin-heading">User Login</h2>
<input type="text" name="username" size="20" placeholder="Username">
<input type="password" name="password" size="20" placeholder="Password"></br>
<input type="submit" value="Log In" class="btn btn-large btn-primary">
<a href="signup.html">Sign Up</a>        
</form>
</div>
</body>
</html>
<?php
}
?>

and this is my php code

<?php
    if (isset($_POST) && !empty($_POST)) {
        session_start();
        //connecting to the database
        include("config.php");

        //Storing username in $username variable.
        $username = mysql_real_escape_string(stripslashes($_POST['username']));

        //Storing password in $password variable.
        $password = mysql_real_escape_string(stripslashes(md5($_POST['password'])));


        $match = "SELECT id FROM $table WHERE username = '" . $username . "' and password'" . $password . "';";

        $qry = mysql_query($match);

        $num_rows = mysql_num_rows($qry);

        if ($num_rows <= 0) {

            echo "Sorry, there is no username $username with the specified password.";

            echo "Try again";

            exit;

        } else {

            $_SESSION['user'] = $_POST["username"];
            header("location:index.html"); // Page to redirect user after login.
        }
    } //else{}
?>

Ive inserted 'mark99' username and '1234' password into thedatabase however it keeps giving my an error saying the username doesn't exists. Any ideas?

hi check out the answer below.. you hve insert 1234 as password in table while other hand you are hashing the password in query so it will not be 1234 any more that's why saying no user.. — Deepak Sharma, Feb 18 '14 at 15:30
Hi thanks . that worked however does that mean the password isnt encrytped anymore? — user3293736, Feb 18 '14 at 15:33
Word of advice and you can ask me why after, **DO NOT USE THIS CODE!!** — Funk Forty Niner, Feb 18 '14 at 15:34
[MD5 is not recommended](http://www.php.net/manual/en/faq.passwords.php#faq.passwords.fasthash) as a password hashing algorithm — Anigel, Feb 18 '14 at 15:34
@user3293736 if my answer working then let me know.. I said either insert the encrypted password in table or in $password variable don't hash the password. well I answered below you can check it out.. — Deepak Sharma, Feb 18 '14 at 15:37
md5 it recommended or not that's the different issue.. well currently in this code its so easy to create sql injection but that's the different issue,, first issue is whats the problem in current code..!! — Deepak Sharma, Feb 18 '14 at 15:38
Yeah it worked.Thanks a lot. But Fred why not use this code? — user3293736, Feb 18 '14 at 15:41
For a few reasons, you're using `mysql_*` functions which are deprecated and not safe to use. I recommend you move over to `mysqli_*` (notice the added `i`?) with prepared statements or PDO (you can Google those terms). Plus, MD5 is technology that dates back to 1996 and is considered unsafe and "too fast" a hashing method. [`Read this article`](http://stackoverflow.com/q/60174/) and look into [`crypt()`](http://php.net/crypt) or PHP's [`password()`](http://www.php.net/manual/en/faq.passwords.php) function. @user3293736 - You stand at (*eventually*) getting hacked. — Funk Forty Niner, Feb 18 '14 at 15:44
Another point to consider is that you are assigning the unsanitised user input to your session array rather than the sanitised information that matched in the database, if you then reuse that username from the session array later on, you will have no end of problems as it potentially will not match what is in the database, especially if you then use that $_SESSION['user'] in a query without sanitising it all over again. — Anigel, Feb 18 '14 at 15:47
@DeepakSharma some one coming to kill me its a different issue.... there is earth quack and i am sitting in hotel its a different issue ... i just want to eat my Apple pie ( i dont know how to open pack)..... thats not going to work ... code must be secure other wise there is no use of that code in production — NullPoiиteя, Feb 18 '14 at 15:47
see I have suggested this also, that this code is not correct.. but the first thing is that why its not working.. so I told him why is not working, then I also suggested why should not use this code. I think you should read my all comments and answer. — Deepak Sharma, Feb 18 '14 at 15:49
@DanLugg You're 50% right, and 50% wrong => http://en.wikipedia.org/wiki/MD5 — Funk Forty Niner, Feb 18 '14 at 16:02
@DanLugg Aaaahhh I see, and I "get it" now! (lol) Good one ;-) — Funk Forty Niner, Feb 18 '14 at 16:21
@Fred-ii- I actually goofed it; shoulda been "MD5 is not a *password* hashing algorithm" -- whatev's :-P — Dan Lugg, Feb 18 '14 at 16:22

CD001 · Answer 1 · 2014-02-18T17:10:19.490

Just for the sake of headstuff (so you'll have an idea as to why Fred -ii- said not to use this code) - I'm going to somewhat take this apart, in order, as I go through it (it's not a personal dig at the person posing the question - but just to give an idea that trying to build a halfway secure application on the LAMP stack requires a little bit of care and forethought ... and bloody-minded cynicism paired with assuming the worst in humanity helps):

Point 1

Not a biggy - but really if you're going to start a session you should start a session irrespective as to whether there's $_POST data or not. You should probably require your config file and start the session at the top before anything else.

Not a terminal error (as you've no session validation) - just weird.

Point 2

You've got output in this file (echo) therefore it must be under the document root and available in the web tree.

include("config.php");

This isn't really written properly it should probably be require_once 'config.php'; (assuming it's a required program file and not an optional include that can be allowed to fail) but that's not the error. The error is that you've got your config file inside your document root. A server misconfiguration or simple typo in that file could, theoretically, allow the contents of that file to be output to the screen in plain text, potentially revealing your database connection strings (and who knows what else) to world + dog.

Configuration files should exist outside of the web tree or, failing that, inside a directory protected with something like .htaccess Deny from all. They should never be accessible over HTTP.

Point 3

The mysql library is deprecated and shouldn't be used at all; MySQLi or PDO are the way to go, ideally with bound parameters/values:

http://uk3.php.net/PDO

http://uk3.php.net/mysqli

Personally I'd got for PDO.

Points 4 & 5

$password = mysql_real_escape_string(stripslashes(md5($_POST['password'])));

First off, the order of this is wrong. You're hashing $_POST['password'] and then attempting to stripslashes - there won't be any slashes once it's been hashed. However if you're trying to prevent people from using slashes (or whatever) in passwords you'd need to remove them before hashing the string.

Next md5 shouldn't be used as a password hashing algorithm it has been found to be weak and can be brute forced to create string collisions far more frequently than it should.

Yes, you should only store hashes or "fingerprints" of the passwords rather than the passwords themselves but, ideally you want to salt and hash (with at least sha1) those passwords rather than simply throwing them into an md5() function.

See: http://uk3.php.net/mcrypt for instance

And do a search on "password salting hashing" using your search engine of choice.

Point 6

SELECT id FROM $table 
WHERE username = '" . $username . "' 
and password = '" . $password . "';

I added in the = that was missing from the original question, but still, don't match on username and password in your query ... if someone managed to get an SQL injection into your username the password would never be checked. Imagine:

SELECT user.id 
FROM user WHERE user.username = 'fred' OR 1 = 1 
-- AND user.password = 'abc123'

It's better to select the user id and password fingerprint from the database and then evaluate the password in the application rather than to trust a password check in the database layer. It also means you can use a dedicated hashing and salting algorithm in the application itself to validate your passwords.

Point 7

$_SESSION['user'] = $_POST["username"];

This is merely storing the username in the session? This in no way should be used as a "login verifier" especially as there's (apparently) nothing in your session to prevent hijacking.

The session id could easily be sniffed from the cookie of a live session and that's all that would be required to "borrow" someone else's login. You should at least attempt to mitigate the chance of the session being hijacked by associating the user's IP address, UserAgent string or some other combination of relatively static data that you can compare against on every page... there are drawbacks to practically any approach though (especially, as I've found, if you've got visitors using AOL) - but you can make a probably 99+% effective session fingerprint to mitigate hijacking with very little chance of the user's session being erroneously dumped.

Ideally you may also want to create a token for the session to mitigate CSRF attacks when the user needs to perform a "privileged" action on the database (update their details or whatever). The token could be an utterly random and unique code stored in the database and/or in an SSL cookie when the user logs in (assuming the user can't perform any action that updates the database outside of HTTPS as that would just transmit the data in clear text across the Internet - which would be a bad idea).

The token is put into a hidden form field for any/all forms and checked against the value stored in the cookie (or session or database) whenever that form is submitted. This ensures that the person submitting the form has a live session on your website at least.

score -1 · Accepted Answer · answered Feb 18 '14 at 15:28

-1

you said you have inserted 1234 as password in table right??

and in

$password = mysql_real_escape_string(stripslashes(md5($_POST['password'])));

you are hasing the password mean it will not be 1234 any more in $password variable that's why its giving error.

either remove the md5() or insert the md5 value of 1234 in table

answered Feb 18 '14 at 15:28

Deepak Sharma

4,124
1
14
31

then why don't you use this code is that.. this code is very prone to sql injection.. and remember is login form very use where class for **user and password** both. run the query for **user** then fetch the password and compare it. its the correct way ..!! I hope you got the point. – Deepak Sharma Feb 18 '14 at 15:47
@DeepakSharma its not good behavior .... A user cast vote on content. – NullPoiиteя Feb 18 '14 at 15:51
only on content?? mean if I answer correct but not so long answer mean a user will vote me **-1**.?? well if you think I am getting rude then I am sorry, I will try to keep myself cool..!! SORRY.. !! :( – Deepak Sharma Feb 18 '14 at 15:53
@DeepakSharma you are very rude.. It deserves aleast -1 – Ronni Skansing Feb 18 '14 at 15:54
hey I accepted my fault.. sorry guys..!! If I hurt someone..!! :( – Deepak Sharma Feb 18 '14 at 15:55
@DeepakSharma stuff happens. You could edit you post to improve its quality or delete it. – Ronni Skansing Feb 18 '14 at 15:56
I don't think I need to edit the answer..!! but yeah the comments below the answers are not good.. so definitely I will edit that comment – Deepak Sharma Feb 18 '14 at 15:57

score -1 · Answer 3 · answered Feb 18 '14 at 15:30

There may be a couple of issues causing this.

Firstly on your $match statement you are missing an equals operator by password:

This:

$match = "SELECT id FROM $table WHERE username = '".$username."' and password'".$password."';";

Should be this:

$match = "SELECT id FROM $table WHERE username = '".$username."' and password = '".$password."';";

Secondly are you inserting the password into the database after hashing it using md5?

If not then your query is trying to match md5(password) against password.

PHP Login form with HTML form

3 Answers3

Linked