date:20050715

Re: [PHP-DB] User authentication and redirect

2005-07-15 Thread Thomas Dodson

Bastien Koert wrote:

I can't see why you simply dont do this

if ($LoginSuccessful)
{
 $location = "";
}else{
 $location = "../index.php";
}
header("location=$location");

If i don't have the solution, perhaps I am misunderstanding the problem

Bastien

From: "Vinny Lape" <[EMAIL PROTECTED]>
To: 
Subject: RE: [PHP-DB] User authentication and redirect
Date: Fri, 15 Jul 2005 09:01:52 -0400

I think I need to explain my question better.

I have a db and the table contains 4 fields uid(pk) username password
location
 I can authenticate the user / pass properly. The problem I am having is
getting the information from field location and defining it as 
$location so
I can do the following: (when I make $redirectLoginSuccess = 
"example.php"

all works fine)

$redirectLoginSuccess = "$location";
$redirectLoginFailed = "../index.php";

}
header("Location: " . $redirectLoginSuccess );
  }
  else {
header("Location: ". $redirectLoginFailed );

Here is where I query the db

$LoginRS__query=sprintf("SELECT username, password FROM webauth WHERE
username='%s' AND password='%s'",
get_magic_quotes_gpc() ? $loginUsername : 
addslashes($loginUsername),

get_magic_quotes_gpc() ? $password : addslashes($password));
  $LoginRS = mysql_query($LoginRS__query, $mysql) or die(mysql_error());

On the landing page im using this for security:
 0)
  $MM_referrer .= "?" . $QUERY_STRING;
  $MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" .
urlencode($MM_referrer);
  header("Location: ". $MM_restrictGoTo);
  exit;
}
?>
-Original Message-
From: Ahmed Saad [mailto:[EMAIL PROTECTED]
Sent: Thursday, July 14, 2005 8:34 AM
To: Vinny Lape
Cc: php-db@lists.php.net
Subject: Re: [PHP-DB] User authentication and redirect

hi Vinny,

On 7/13/05, Vinny Lape <[EMAIL PROTECTED]> wrote:
> If user validates then look at db entry location then redirect to
> mydomain.com/"location"/index.php

i don't think it's a good idea. what if the user bookmarked or took
down a notice with the URL to your "secured" page
(mydomain.com/location/index.php)? then he would just type the url
heading directly for the bypassing your login page! i think u might
want to put the user authorization code in your index php or even
better put it in a file and require() that file at the top of of any
page u want to protect. you can either use sessions or plain HTTP
authentication  (which is not a very good idea).

-ahmed

--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

you shouldn't do that (in my opinion) because of the following scenario: 
Bob needs access from a shared terminal. Bob puts in his (authorized) 
login information, and then bookmarks the resulting page. Fred comes 
along. Fred is not authorized to access the database. Fred follows the 
link out of curiosity, finds sensitive information, and either deletes 
it all, sells it to a competitor, or otherwise screws with it because he 
is bitter that he is being severly underpaid, all using either Bob's 
session information, or no session information, depending on how the 
session is set to expire. The best option is to put the login and login 
check functions in a file, include that file at the beginning of all 
your scripts which need access control, and then put the following code 
at the beginning of the script:

if(login_check($user, $pass)
{
  //allow access, main script body here
}
else
{
  //deny access
  echo "you aren't supposed to be here";
  exit;
}

i hope i understood your problem correctly, and i hope i was of some 
help...this is the way i wrote my project, but it was only 
access-controlled on certain pages (i.e. inserting and deleting records)

--
Thomas Dodson
Programmer, Bioinformatics
S-327 Ag. Science North
Department of Entomology
University of Kentucky
Lexington, KY 40546-0091
Phone (859) 257-3169
Fax (859) 323-1120
Cell: (859) 420-1696

--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

[suspicious - maybe spam] [PHP-DB] [suspicious - maybe spam] make your lady feels like a real ï¿½ï¿½ladyï¿½ï¿½, give her ladys quartz by frank mullers .

2005-07-15 Thread fritz laurenitis


you desire the finest ones from rolexes, cartiers, bvlgaries, frankmullers,
harry winstons, breguets, jaeger-lecoultre, brietilings, tagheuers and
tudors.
with the same features, setting, logo, serialnumber, stainlessteelbody,
sapphire crystal surface, they are classic. 

you will also flnd out how affordable the prices are. you might even vvant
2 or 3 watches for your collections.
 

 

http://x8.wosr.preferredtosave.com/b4i/



or farther up the town?" 
as a thing of course that they should dine with them. 
answered. "Heaven is as boundless as the love of our Creator; the dumb
animal is also His creature, and I firmly believe that no life will be lost,
but each will receive as much happiness as he can enjoy, which will be
sufficient for him."

`My God! what cold hands!' he said. 

-- 
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

RE: [PHP-DB] User authentication and redirect

2005-07-15 Thread Bastien Koert

I can't see why you simply dont do this

if ($LoginSuccessful)
{
 $location = "";
}else{
 $location = "../index.php";
}
header("location=$location");

If i don't have the solution, perhaps I am misunderstanding the problem

Bastien

From: "Vinny Lape" <[EMAIL PROTECTED]>
To: 
Subject: RE: [PHP-DB] User authentication and redirect
Date: Fri, 15 Jul 2005 09:01:52 -0400

I think I need to explain my question better.

I have a db and the table contains 4 fields uid(pk) username password
location
 I can authenticate the user / pass properly. The problem I am having is
getting the information from field location and defining it as $location so
I can do the following: (when I make $redirectLoginSuccess = "example.php"
all works fine)

$redirectLoginSuccess = "$location";
$redirectLoginFailed = "../index.php";

}
header("Location: " . $redirectLoginSuccess );
  }
  else {
header("Location: ". $redirectLoginFailed );

Here is where I query the db

$LoginRS__query=sprintf("SELECT username, password FROM webauth WHERE
username='%s' AND password='%s'",
get_magic_quotes_gpc() ? $loginUsername : addslashes($loginUsername),
get_magic_quotes_gpc() ? $password : addslashes($password));
  $LoginRS = mysql_query($LoginRS__query, $mysql) or die(mysql_error());

On the landing page im using this for security:
 0)
  $MM_referrer .= "?" . $QUERY_STRING;
  $MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" .
urlencode($MM_referrer);
  header("Location: ". $MM_restrictGoTo);
  exit;
}
?>
-Original Message-
From: Ahmed Saad [mailto:[EMAIL PROTECTED]
Sent: Thursday, July 14, 2005 8:34 AM
To: Vinny Lape
Cc: php-db@lists.php.net
Subject: Re: [PHP-DB] User authentication and redirect

hi Vinny,

On 7/13/05, Vinny Lape <[EMAIL PROTECTED]> wrote:
> If user validates then look at db entry location then redirect to
> mydomain.com/"location"/index.php

i don't think it's a good idea. what if the user bookmarked or took
down a notice with the URL to your "secured" page
(mydomain.com/location/index.php)? then he would just type the url
heading directly for the bypassing your login page! i think u might
want to put the user authorization code in your index php or even
better put it in a file and require() that file at the top of of any
page u want to protect. you can either use sessions or plain HTTP
authentication  (which is not a very good idea).

-ahmed

--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

--
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

RE: [PHP-DB] User authentication and redirect

2005-07-15 Thread Vinny Lape

I think I need to explain my question better.

I have a db and the table contains 4 fields uid(pk) username password
location
 I can authenticate the user / pass properly. The problem I am having is
getting the information from field location and defining it as $location so
I can do the following: (when I make $redirectLoginSuccess = "example.php"
all works fine)

$redirectLoginSuccess = "$location";
$redirectLoginFailed = "../index.php";

}
header("Location: " . $redirectLoginSuccess );
  }
  else {
header("Location: ". $redirectLoginFailed );

Here is where I query the db

$LoginRS__query=sprintf("SELECT username, password FROM webauth WHERE
username='%s' AND password='%s'",
get_magic_quotes_gpc() ? $loginUsername : addslashes($loginUsername),
get_magic_quotes_gpc() ? $password : addslashes($password));
  $LoginRS = mysql_query($LoginRS__query, $mysql) or die(mysql_error());

On the landing page im using this for security:
 0) 
  $MM_referrer .= "?" . $QUERY_STRING;
  $MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" .
urlencode($MM_referrer);
  header("Location: ". $MM_restrictGoTo); 
  exit;
}
?>
-Original Message-
From: Ahmed Saad [mailto:[EMAIL PROTECTED] 
Sent: Thursday, July 14, 2005 8:34 AM
To: Vinny Lape
Cc: php-db@lists.php.net
Subject: Re: [PHP-DB] User authentication and redirect

hi Vinny,

On 7/13/05, Vinny Lape <[EMAIL PROTECTED]> wrote:
> If user validates then look at db entry location then redirect to
> mydomain.com/"location"/index.php

i don't think it's a good idea. what if the user bookmarked or took
down a notice with the URL to your "secured" page
(mydomain.com/location/index.php)? then he would just type the url
heading directly for the bypassing your login page! i think u might
want to put the user authorization code in your index php or even
better put it in a file and require() that file at the top of of any
page u want to protect. you can either use sessions or plain HTTP
authentication  (which is not a very good idea).

-ahmed

-- 
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

-- 
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

[PHP-DB] PDO error

2005-07-15 Thread Holografix

Hi. When using this example from
http://netevil.org/talks/index.php?t=pdo&s=20, the site of pdo's author Wez 
Furlong, I
get this error:

Fatal error: Call to a member function fetchAll() on a non-object in
/www/home/testes/pdo_my1.php on line 8
query("SELECT * FROM foo");
$rows = $stmt->fetchAll();
$count = count($rows);
foreach ($rows as $row) {
print_r($row);
}
$stmt = null;
?>

What's wrong with the example?
I'm using php 5.1.0-dev, yesterday snapshot.

Greetings

-- 
PHP Database Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php

Re: [PHP-DB] User authentication and redirect

[suspicious - maybe spam] [PHP-DB] [suspicious - maybe spam] make your lady feels like a real ï¿½ï¿½ladyï¿½ï¿½, give her ladys quartz by frank mullers .

RE: [PHP-DB] User authentication and redirect

RE: [PHP-DB] User authentication and redirect

[PHP-DB] PDO error

5 matches

Site Navigation

Mail list logo

Footer information