Please use [php], [html] or [code] tags (as appropriate) to separate and format code.
var_dump would provide a little more information about the variable contents, such as the type, and make it more obvious whether or not the variable held an empty string.
empty would be a better test than isset, since a variable can be set but empty. For example:
PHP Code:
$foo = '';
isset($foo) && empty($foo); # True.
Originally Posted by
chriscrowe43
When you say that its telling that there is nothing in id array 1 im not sure what to thing about that as far as the database goes everything appears correct? unless i just dont understand what it means by nothing being there.
Just what he says. Consider:
PHP Code:
$data = 'abc';
$parts = explode('/', $data);
$parts has exactly one item (at index 0). There are no items at indices 1 or above because '/' doesn't appear in $data. Similarly, "nm2c0c4y3dn3727553" must not be appearing in $decryptedID, so $id_array has exactly 1 item (since a negative limit isn't passed to explode).
Originally Posted by
chriscrowe43
PHP Code:
$decryptedID = base64_decode($_COOKIE['idCookie']);
Base64 is an encoding. It provides no encryption. A less misleading name for the variable would be $decodedID. If you think this is a minor point, consider that the name is an assertion that the data is protected somehow by encryption, which provides a false sense of security that can result in an unsafe security protocol. Basically, when your users' accounts get hacked, it won't seem so insignificant.
Originally Posted by
chriscrowe43
PHP Code:
$userID = $id_array[1];
$userPass = $_COOKIE['passCookie'];
// Get their user first name to set into session var
$sql_uname = mysql_query("SELECT username FROM myMembers WHERE id='$userID' AND password='$userPass' LIMIT 1");
The sample code is vulnerable to SQL injection, which is a very serious security risk. Both the user ID and password are submitted by the user, so either can be used as an injection vector. To fix this hole, switch from the outdated mysql extension to PDO and use prepared statements. If you need a PDO tutorial, try "Writing MySQL Scripts with PHP and PDO". The site you save may just be your own.
Originally Posted by
chriscrowe43
PHP Code:
if ($numRows == 0) {
echo 'Something appears wrong with your stored log in credentials. <a href="login.php">Log in again here please</a>';
exit();
}
Don't use die or exit when outputting HTML. You'll get invalid HTML.
Originally Posted by
chriscrowe43
PHP Code:
while($row = mysql_fetch_array($sql_uname)){
Since you fetch at most 1 record, and have previously checked that the result has a row, the while is completely unnecessary. Simply:
PHP Code:
$row = $result->fetch();
$username = $row["username"];
Note: this example uses PDO rather than the mysql extension.
Originally Posted by
chriscrowe43
PHP Code:
$_SESSION['idx'] = base64_encode("g4p3h9xfn8sq03hs2234$userID");
What's the purpose of this value?
LinkBack URL
About LinkBacks
Reply With Quote
