Saved Bookmarks
| 1. |
Solve : Re: php mysql issues? |
|
Answer» We are going to need a lot more information than that including how the site is built, exactly what goes wrong and any relevant code snippets.I agree with camerongray.
And finally: Code: [Select]<form> <div class="form" action='form.php'>The action attribute should be on the tag, not the Is this website for work, school/college/uni, or just your own interest in putting together a website. Firstly looking at your code you haven't closed your php off with "?>" (don't use the inverted commas please). The site below gives you information on Salted password hashing. This is a function you can add so that data written to your db will be encrypted first before being written to the hard disk drive (hdd). https://crackstation.net/hashing-security.htm#phpsourcecode If this is for a school or college project you're lecturer may NOT require you to do the hashing as they might want to see the data reaching the database. But for commercial use this is better to do for security purposes. Reason being if the db is compromised then it will take a long long time before anyone can crack the HASH code... unless they are a Dalek lol As camerongray has said there is also no validation here and you will have to change your code to use POST instead of GET. To validate your site you can use something like below, although you will have to tailor it to name of your form. Code: [Select]<script type="text/JavaScript"> function validate() { if(document.formOne.Email.value == "" || document.formOne.Password.value == "") { alert("Please fill in the boxes provided and try again "); return false; } else { parent.location="Login.php"; } } </script> Quote from: Base10 on October 25, 2014, 06:47:08 PM To validate your site you can use something like below, although you will have to tailor it to name of your form. While using Javascript is certainly a good idea to validate user input as it will minimize server calls but it's important to note that the user can do whatever they want with the Javascript therefore you cannot rely on it as total input validation. The backend in PHP will still have to validate all the inputs in the same way before it will finally allow the insert to take place.As camerongray has stated, quite rightly too as this is an important part to remember, that the PHP end will have to validate the inputs also before the insert takes place. Don't know why I never mentioned it lol. Thanks for pointing that out camerongray, much appreciated. This code is just an example and depending on the sql database you are using the syntax, again, will have to be tailored to suit... especially because my example is using MySQL. The code below should be on the .php page and not on the .html page. Code: [Select] // to check for the users details. mysql_select_db("the_name_of_your_database", $con); $Usercheck = $_POST['Email']; $Passcheck = $_POST['Password']; $checkUser = mysql_query("SELECT Email FROM yourtable WHERE Email = '$Usercheck'") or die(mysql_error()); $Check2 = mysql_num_rows($checkUser); //If the user isn't in your database this inserts the new user if ($Check2 == 0) mysql_query("INSERT INTO airusers (Email, Password) Values ('$Email','$Password')"); If the registered user is already registered and tries again you will need to code an alert to throw up; this is to tell them that they are using details that are already registered and a link to get them to a password page to reset their password for login. Quote i use xampp Are you going to be using Xampp on a live server that is on the web which could be targeted by hackers etc? Xampp is only really intended for testing of code on a staged sandbox of a server, and not really intended for a live server environment. If this is for school and just as a backbone to demonstrate your code etc its fine as long as offline mode of use, or used in a private network among trusted users etc, but if a system with xampp is placed out onto the DMZ or even a port forward to it from a private server environment, dont be surprised if a hacker gets in there and makes a mess of it all. There is info on the web on how to harden xampp installs for a live server connection, but its best to build it all up as secure as possible with the components that you will be using only ACTIVE etc, and each one manually installed and custom configured for security, vs using xampp with all features possible active to work no matter what someone is going to use xampp for and many points of entry or points of attack for hackers that would find it pretty quickly with probes and the first PLAN of attack would probably be to use the default authentication of xampp tested against it before moving on to other methods of attack. |
|