Webwereld

[PHP] Log in systeem met cookies

Gestart doorDylan5 reacties27 weergaven
Log in om mee te praten

6 berichten · pagina 1 van 1

Dylan

Lid · Topicstarter

Berichten
14.025
Reputatie
1
Punten
0,01
Lid sinds
Laatst gezien
Hoi,
Ik heb een login systeem gevonden op google en ik heb hem beveiligd. Ik wil alleen weten of die echt helemaal veilig is.
Log in:

[COLOR= #0000BB]<?php[/COLOR] 

 [COLOR= #FF8000]// Connects to your Database [/COLOR]

 [URL="http://www.php.net/mysql_connect"]mysql_connect[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]""[/COLOR][COLOR= #007700],[/COLOR] [COLOR= #DD0000]""[/COLOR][COLOR= #007700],[/COLOR] [COLOR= #DD0000]""[/COLOR][COLOR= #007700])[/COLOR] or [URL="http://www.php.net/die"]die[/URL][COLOR= #007700]([/COLOR][URL="http://www.php.net/mysql_error"]mysql_error[/URL][COLOR= #007700]());[/COLOR] 

 [URL="http://www.php.net/mysql_select_db"]mysql_select_db[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]""[/COLOR][COLOR= #007700])[/COLOR] or [URL="http://www.php.net/die"]die[/URL][COLOR= #007700]([/COLOR][URL="http://www.php.net/mysql_error"]mysql_error[/URL][COLOR= #007700]());[/COLOR] 


 [COLOR= #FF8000]//Checks if there is a login cookie[/COLOR]

 [URL="http://www.php.net/if"]if[/URL][COLOR= #007700]([/COLOR][URL="http://www.php.net/isset"]isset[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$_COOKIE[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]ID_my_site[/COLOR][COLOR= #007700]]))[/COLOR]


 [COLOR= #FF8000]//if there is, it logs you in and directes you to the members page[/COLOR]

 [COLOR= #007700]{[/COLOR] 
     [COLOR= #0000BB]$username[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$_COOKIE[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]ID_my_site[/COLOR][COLOR= #007700]];[/COLOR] 

     [COLOR= #0000BB]$pass[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$_COOKIE[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]Key_my_site[/COLOR][COLOR= #007700]];[/COLOR]

          [COLOR= #0000BB]$check[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_query"]mysql_query[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"SELECT * FROM users WHERE username = "[/COLOR][COLOR= #007700].[/COLOR][URL="http://www.php.net/mysql_real_escape_string"]mysql_real_escape_string[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$username[/COLOR][COLOR= #007700]).[/COLOR][COLOR= #DD0000]""[/COLOR][COLOR= #007700])[/COLOR]or [URL="http://www.php.net/die"]die[/URL][COLOR= #007700]([/COLOR][URL="http://www.php.net/mysql_error"]mysql_error[/URL][COLOR= #007700]());[/COLOR]

     [URL="http://www.php.net/while"]while[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$info[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_fetch_array"]mysql_fetch_array[/URL][COLOR= #007700]([/COLOR] [COLOR= #0000BB]$check[/COLOR] [COLOR= #007700]))     

         {[/COLOR]

         [URL="http://www.php.net/if"]if[/URL] [COLOR= #007700]([/COLOR][COLOR= #0000BB]$pass[/COLOR] [COLOR= #007700]!=[/COLOR] [COLOR= #0000BB]$info[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]password[/COLOR][COLOR= #007700]]) 

             {

                          }[/COLOR]

         [URL="http://www.php.net/else"]else[/URL]

             [COLOR= #007700]{[/COLOR]

             [URL="http://www.php.net/header"]header[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"Location: member.php"[/COLOR][COLOR= #007700]);



             }

         }

 }[/COLOR]


 [COLOR= #FF8000]//if the login form is submitted [/COLOR]

 [URL="http://www.php.net/if"]if[/URL] [COLOR= #007700]([/COLOR][URL="http://www.php.net/isset"]isset[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]submit[/COLOR][COLOR= #007700]])) {[/COLOR] [COLOR= #FF8000]// if form has been submitted



 // makes sure they filled it in[/COLOR]

     [URL="http://www.php.net/if"]if[/URL][COLOR= #007700](![/COLOR][COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]username[/COLOR][COLOR= #007700]] | ![/COLOR][COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]pass[/COLOR][COLOR= #007700]]) {[/COLOR]

         [URL="http://www.php.net/die"]die[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]Je hebt niet alle velden ingevuld.[/COLOR][COLOR= #007700]);

     }[/COLOR]

     [COLOR= #FF8000]// checks it against the database[/COLOR]



     [URL="http://www.php.net/if"]if[/URL]  [COLOR= #007700](![/COLOR][URL="http://www.php.net/get_magic_quotes_gpc"]get_magic_quotes_gpc[/URL][COLOR= #007700]()) {[/COLOR]

         [COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]email[/COLOR][COLOR= #007700]] =[/COLOR] [URL="http://www.php.net/addslashes"]addslashes[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]email[/COLOR][COLOR= #007700]]);

     }[/COLOR]

     [COLOR= #0000BB]$check[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_query"]mysql_query[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"SELECT * FROM users WHERE username = "[/COLOR][COLOR= #007700].[/COLOR] [URL="http://www.php.net/mysql_real_escape_string"]mysql_real_escape_string[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]username[/COLOR][COLOR= #007700]]).[/COLOR][COLOR= #DD0000]""[/COLOR][COLOR= #007700])[/COLOR]or [URL="http://www.php.net/die"]die[/URL][COLOR= #007700]([/COLOR][URL="http://www.php.net/mysql_error"]mysql_error[/URL][COLOR= #007700]());[/COLOR]



 [COLOR= #FF8000]//Gives error if user dosent exist[/COLOR]

 [COLOR= #0000BB]$check2[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_num_rows"]mysql_num_rows[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$check[/COLOR][COLOR= #007700]);[/COLOR]

 [URL="http://www.php.net/if"]if[/URL] [COLOR= #007700]([/COLOR][COLOR= #0000BB]$check2[/COLOR] [COLOR= #007700]==[/COLOR] [COLOR= #0000BB]0[/COLOR][COLOR= #007700]) {[/COLOR]

         [URL="http://www.php.net/die"]die[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]Verkeerde login![/COLOR][COLOR= #007700]);

                 }[/COLOR]

 [URL="http://www.php.net/while"]while[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$info[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_fetch_array"]mysql_fetch_array[/URL][COLOR= #007700]([/COLOR] [COLOR= #0000BB]$check[/COLOR] [COLOR= #007700]))     

 {[/COLOR]

 [COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]pass[/COLOR][COLOR= #007700]] =[/COLOR] [URL="http://www.php.net/stripslashes"]stripslashes[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]pass[/COLOR][COLOR= #007700]]);[/COLOR]

     [COLOR= #0000BB]$info[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]password[/COLOR][COLOR= #007700]] =[/COLOR] [URL="http://www.php.net/stripslashes"]stripslashes[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$info[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]password[/COLOR][COLOR= #007700]]);[/COLOR]

     [COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]pass[/COLOR][COLOR= #007700]] =[/COLOR] [URL="http://www.php.net/md5"]md5[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]pass[/COLOR][COLOR= #007700]]);[/COLOR]



 [COLOR= #FF8000]//gives error if the password is wrong[/COLOR]

     [URL="http://www.php.net/if"]if[/URL] [COLOR= #007700]([/COLOR][COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]pass[/COLOR][COLOR= #007700]] !=[/COLOR] [COLOR= #0000BB]$info[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]password[/COLOR][COLOR= #007700]]) {[/COLOR]

         [URL="http://www.php.net/die"]die[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]Verkeerd wachtwoord![/COLOR][COLOR= #007700]);

     }[/COLOR]
     [URL="http://www.php.net/else"]else[/URL] 

 [COLOR= #007700]{[/COLOR] 

 
 [COLOR= #FF8000]// if login is ok then we add a cookie [/COLOR]

      [COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]username[/COLOR][COLOR= #007700]] =[/COLOR] [URL="http://www.php.net/stripslashes"]stripslashes[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]username[/COLOR][COLOR= #007700]]);[/COLOR] 

      [COLOR= #0000BB]$hour[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/time"]time[/URL][COLOR= #007700]() +[/COLOR] [COLOR= #0000BB]3600[/COLOR][COLOR= #007700];[/COLOR] 

 [URL="http://www.php.net/setcookie"]setcookie[/URL][COLOR= #007700]([/COLOR]ID_my_site[COLOR= #007700],[/COLOR] [COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]username[/COLOR][COLOR= #007700]],[/COLOR] [COLOR= #0000BB]$hour[/COLOR][COLOR= #007700]);[/COLOR] 

 [URL="http://www.php.net/setcookie"]setcookie[/URL][COLOR= #007700]([/COLOR]Key_my_site[COLOR= #007700],[/COLOR] [COLOR= #0000BB]$_POST[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]pass[/COLOR][COLOR= #007700]],[/COLOR] [COLOR= #0000BB]$hour[/COLOR][COLOR= #007700]);[/COLOR]     

 

 [COLOR= #FF8000]//then redirect them to the members area [/COLOR]

 [URL="http://www.php.net/header"]header[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"Location: member.php"[/COLOR][COLOR= #007700]); 

 } 

 } 

 }[/COLOR] 

 [URL="http://www.php.net/else"]else[/URL] 

[COLOR= #007700]{[/COLOR]     

 

 [COLOR= #FF8000]// if they are not logged in [/COLOR]

 ?> 

 <form action="login.php" method="post"> 

 <table border="0"> 

 <tr><td colspan=2><h1>Log in:</h1></td></tr> 

 <tr><td>Gebruikersnaam:</td><td> 

 <input type="text" name="username" maxlength="40"> 

 </td></tr> 

 <tr><td>WachtwoorD:</td><td> 

 <input type="password" name="pass" maxlength="50"> 

 </td></tr> 

 <tr><td colspan="2" align="right"> 

 <input type="submit" name="submit" value="Login"> 

 </td></tr> 

 </table> 

 </form> 

 [COLOR= #0000BB]<?php[/COLOR] 

 [COLOR= #007700]}[/COLOR] 

 

 ?>


member.php

[COLOR= #0000BB]<?php[/COLOR] 

 [COLOR= #FF8000]// Connects to your Database [/COLOR]

 [URL="http://www.php.net/mysql_connect"]mysql_connect[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]""[/COLOR][COLOR= #007700],[/COLOR] [COLOR= #DD0000]""[/COLOR][COLOR= #007700],[/COLOR] [COLOR= #DD0000]""[/COLOR][COLOR= #007700])[/COLOR] or [URL="http://www.php.net/die"]die[/URL][COLOR= #007700]([/COLOR][URL="http://www.php.net/mysql_error"]mysql_error[/URL][COLOR= #007700]());[/COLOR] 

 [URL="http://www.php.net/mysql_select_db"]mysql_select_db[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]""[/COLOR][COLOR= #007700])[/COLOR] or [URL="http://www.php.net/die"]die[/URL][COLOR= #007700]([/COLOR][URL="http://www.php.net/mysql_error"]mysql_error[/URL][COLOR= #007700]());[/COLOR] 

 
 [COLOR= #FF8000]//checks cookies to make sure they are logged in [/COLOR]

 [URL="http://www.php.net/if"]if[/URL][COLOR= #007700]([/COLOR][URL="http://www.php.net/isset"]isset[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$_COOKIE[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]ID_my_site[/COLOR][COLOR= #007700]])) 

 {[/COLOR] 

     [COLOR= #0000BB]$username[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$_COOKIE[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]ID_my_site[/COLOR][COLOR= #007700]];[/COLOR] 

     [COLOR= #0000BB]$pass[/COLOR] [COLOR= #007700]=[/COLOR] [COLOR= #0000BB]$_COOKIE[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]Key_my_site[/COLOR][COLOR= #007700]];[/COLOR] 

          [COLOR= #0000BB]$check[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_query"]mysql_query[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"SELECT * FROM users WHERE username = "[/COLOR][COLOR= #007700].[/COLOR] [URL="http://www.php.net/mysql_real_escape_string"]mysql_real_escape_string[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$username[/COLOR][COLOR= #007700]).[/COLOR][COLOR= #DD0000]""[/COLOR][COLOR= #007700])[/COLOR]or [URL="http://www.php.net/die"]die[/URL][COLOR= #007700]([/COLOR][URL="http://www.php.net/mysql_error"]mysql_error[/URL][COLOR= #007700]());[/COLOR] 

     [URL="http://www.php.net/while"]while[/URL][COLOR= #007700]([/COLOR][COLOR= #0000BB]$info[/COLOR] [COLOR= #007700]=[/COLOR] [URL="http://www.php.net/mysql_fetch_array"]mysql_fetch_array[/URL][COLOR= #007700]([/COLOR] [COLOR= #0000BB]$check[/COLOR] [COLOR= #007700]))      

         {[/COLOR] 

 

 [COLOR= #FF8000]//if the cookie has the wrong password, they are taken to the login page [/COLOR]

         [URL="http://www.php.net/if"]if[/URL] [COLOR= #007700]([/COLOR][COLOR= #0000BB]$pass[/COLOR] [COLOR= #007700]!=[/COLOR] [COLOR= #0000BB]$info[/COLOR][COLOR= #007700][[/COLOR][COLOR= #DD0000]password[/COLOR][COLOR= #007700]]) 

             {[/COLOR]             [URL="http://www.php.net/header"]header[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"Location: login.php"[/COLOR][COLOR= #007700]); 

             }[/COLOR] 

 

 [COLOR= #FF8000]//otherwise they are shown the admin area     [/COLOR]

     [URL="http://www.php.net/else"]else[/URL] 

             [COLOR= #007700]{[/COLOR] 

              [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]"<p>"[/COLOR][COLOR= #007700];[/COLOR] 

 [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]"hier komt het betaalsysteem!"[/COLOR][COLOR= #007700];[/COLOR] 

 [URL="http://www.php.net/echo"]echo[/URL] [COLOR= #DD0000]""[/COLOR][COLOR= #007700]; 

             } 

         } 

         }[/COLOR] 

 [URL="http://www.php.net/else"]else[/URL] 

 

 [COLOR= #FF8000]//if the cookie does not exist, they are taken to the login screen [/COLOR]

 [COLOR= #007700]{[/COLOR]             

 [URL="http://www.php.net/header"]header[/URL][COLOR= #007700]([/COLOR][COLOR= #DD0000]"Location: login.php"[/COLOR][COLOR= #007700]); 

 }[/COLOR] 

 ?>


Ik wil dit gaan gebruiken voor een betaal systeem. Let niet op hoe het is gescript. ik weet dat die en dat er geen goede mysql error gebeuren is. Ik wil alleen zeker zijn dat het veilig is tegen sql injections / xss enzovoort.

toevoeging op 20 mei 2012, 15:59:33:
En ohja, als je verkeerd inlogt krijg je een error
Notice: Undefined index: email in C:xampphtdocslogin.php on line 69
Verkeerde login!

dit moet met isset alleen als ik het probeer komen er errors
0
Antonn

Lid

Berichten
8.649
Reputatie
0
Punten
0,00
Lid sinds
Laatst gezien
Lijkt mij veilig alleen slecht gecodeerd.
0
Desire

Lid

Berichten
4.367
Reputatie
0
Punten
0,00
Lid sinds
Laatst gezien
if (!get_magic_quotes_gpc()) {

$_POST[email] = addslashes($_POST[email]);

}

Die klopt niet helemaal, daarom krijg je die error.
0
Antonn

Lid

Berichten
8.649
Reputatie
0
Punten
0,00
Lid sinds
Laatst gezien
Desire schreef:
if (!get_magic_quotes_gpc()) {

$_POST[email] = addslashes($_POST[email]);

}

Die klopt niet helemaal, daarom krijg je die error.
Indd, hij mist else.
0
Sebastiaanh

Lid

Berichten
9.953
Reputatie
0
Punten
0,00
Lid sinds
Laatst gezien
Else hoeft niet hoor..
0
Antonn

Lid

Berichten
8.649
Reputatie
0
Punten
0,00
Lid sinds
Laatst gezien
Sebastiaanh schreef:
Else hoeft niet hoor..
Mijn fout, ik zie dat hij var herschrijft, geen nieuwe aanmaakt.
0

Jouw reactie

Deel je idee, stel een vraag of help een ander verder.

Editor laden…

Praat mee met de One2xs-community.

Inloggen om te reageren