Cannot login after host switched off register globals...

AshleyQuick · #1 (**permalink**) 08-29-07, 12:46 PM

Can someone assist? Here's the login page:

PHP Code:


			
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">



<html>

<head>

    <title></title>

</head>



<body>



<table>

    <form method="post" action="<? echo $PHP_SELF ?>?action=login">

    <tr>

        <td><b>Login name:</b><br>

        <input type="text" size="30" name="loginname"></td>

    </tr>

    <tr>

        <td><b>Password:</b><br>

        <input type="password" size="30" name="password"></td>

    </tr>

    <tr>

        <td><p><? if (substr($PHP_SELF,-9) == "login.php") { echo "<p>Do not link to this file!</p>"; } else { echo "<input class=send type=submit value=\"Login!\">"; } ?></p></td>

    </tr>

    </form>

</table>        



</body>

</html>

Here's protect.php

PHP Code:


			
<?



$user_passwords = array (

    "demo" => "demo"

    );



$logout_page = "logout.php";



$login_page = "login.php";



$invalidlogin_page = "invalidlogin.php";





if ($action == "logout")

{

    Setcookie("logincookie[pwd]","",time() -86400);

    Setcookie("logincookie[user]","",time() - 86400);

    include($logout_page);

    exit;

}

else if ($action == "login")

{

    if (($loginname == "") || ($password == ""))

    {

        include($invalidlogin_page);

        exit;

    }

    else if (strcmp($user_passwords[$loginname],$password) == 0)

    {

        Setcookie("logincookie[pwd]",$password,time() + 86400);

        Setcookie("logincookie[user]",$loginname,time() + 86400);

    }

    else

    {

        include($invalidlogin_page);

        exit;

    }

}

else

{

    if (($logincookie[pwd] == "") || ($logincookie[user] == ""))

    {

        include($login_page);

        exit;

    }

    else if (strcmp($user_passwords[$logincookie[user]],$logincookie[pwd]) == 0)

    {

        Setcookie("logincookie[pwd]",$logincookie[pwd],time() + 86400);

        Setcookie("logincookie[user]",$logincookie[user],time() + 86400);

    }

    else

    {

        include($invalidlogin_page);

        exit;

    }

}

?>

Keith · #2 (**permalink**) 08-29-07, 01:32 PM

There are plenty of proper answers here:
http://www.codingforums.com/showthread.php?t=122487

bizzar528 · #3 (**permalink**) 08-29-07, 01:34 PM

Instead of $password and $loginname, use $_POST['password'] and $_POST['logginname']

blinn_shade · #4 (**permalink**) 08-30-07, 03:37 PM

Thats a very unsecure login script. I suggest look at hotscripts.com for a secure login script.

Register globals control the way POST, GET, COOKIE, GLOBALS get read.