PHP user account creation code

-=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- (c) WidthPadding Industries 1987 0\|722\|0 -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=-
Socoder -> Web Development -> PHP user account creation code
Mon, 09 Oct 2006, 12:09
HoboBen	Heya, Well, another newbie question... I'm writing to a file to create usernames and passwords. I'm not using MySQL, because I honestly can't figure out how to get it working and I want to see what I can manage with file read/write commands. I managed to get creation of 5 letter passwords and usernames, but now I'm trying to get any length values, with a hash "#" after each username or password, and a plus "+" to signify end of file (probably not needed). After messing around, I got things semi working... And kinda botched it all up again. I've spent about 4 hours doing that today, with each modification often yeilding worse results. Could someone sort me out a little? What do I need to look at? <html> <head> <title>Create Account</title> </head> <body> <? $UpTo = 50; $infile = "data/users.dat"; if(!($fp = fopen($infile, "r"))) die ("$infile failed to open for read."); echo "<b>Existing users:</b> "; for ($AL = 0; $AL < $UpTo; $AL++) { $userIN=""; $passIN=""; $getC=0; $getH=""; for ($BL = 0; $BL < 25; $BL++) { if($getH = fread($fp, 1)) { // if ( (!($getH == "+")) && ($getC==2) ) if ($getC==2) { if ($getC==1) { if ($getH == "#") { $getC=2; } else { $passIN = $passIN . $getH; } } if ($getC==0) { if ($getH == "#") { $getC=1; } else { $userIN = $userIN . $getH; } } } else { $BL=24; $getC=0; } //getC==2 / "+" } else { $BL=24; $UpTo=$AL; } //Read } // BL echo "User $AL - $userIN ($passIN) "; $userST[$AL] = $userIN; $passST[$AL] = $passIN; } //AL if($_POST["action"] == "Create") { fclose($fp); echo " <hr> "; if(!($fp = fopen($infile, "w"))) die ("$infile failed to open for write."); { for ($AL = 0; $AL < $UpTo; $AL++) { fwrite($fp, $userST[$AL]); fwrite($fp, "#"); fwrite($fp, $passST[$AL]); fwrite($fp, "#"); } } $Tusrn = strip_tags($_POST[Ausrn]); $Tusrn = Stripcslashes($Tusrn); $Tusrn = Stripslashes($Tusrn); $Tusrn = stristr($Tusrn, "#"); $Tusrn = stristr($Tusrn, "+"); $Tpwrd = strip_tags($_POST[Apwrd]); $Tpwrd= Stripcslashes($Tpwrd); $Tpwrd = Stripslashes($Tpwrd); $Tpwrd = stristr($Tpwrd, "#"); $Tpwrd = stristr($Tpwrd, "+"); if ((strlen($Tusrn) > 10) \|\| (strlen($Tpwrd) > 10)) die ("Username and Password must be less than 11 characters in length. No HTML or PHP tags, or slashes will be accepted in passwords or usernames."); $userST[$AL] = $_POST[Tusrn]; $passST[$AL] = $_POST[Tpwrd]; fwrite($fp, $_POST[Ausrn]); fwrite($fp, "#"); fwrite($fp, $_POST[Apwrd]); fwrite($fp, "#"); fwrite($fp, "+"); fclose($fp); echo "<b>Created Account!</b> "; echo "<b>Username:</b> $userST[$AL] <b>Password:</b> $passST[$AL] "; } ?> <form method="POST" enctype="multipart/form-data" name="user_add_form" action="<?$_SERVER["PHP_SELF"];?>"> <input type="text" name="Ausrn" size="5"> <input type="text" name="Apwrd" size="5"> <input type="submit" value="Create" name="action"> </form> <a href="createaccount.php">Refresh Existing User List</a> <? if(is_array($error)) { while(list($key, $val) = each($error)) { echo $val; echo " \n"; } } ?> </body> </html> --v I'm sorry for all these questions, but I am learning loads from this and I really appreciate your time. This is certainly not going to be the last PHP question I post, but I think that once this is sorted, I'll be pretty confident for a little while. Thank you all! \|edit\| Note to self - must bother to indent code! \|edit\| -=-=- blog \| work \| code \| more code
Wed, 11 Oct 2006, 10:53
HoboBen	Yay, I managed to solve it (it needed two days to sleep on it). Working pretty fine, too! Next stop - actually logging in with these saved passwords and usernames! \|edit\| 1% done - Your profile folders automatically created... with nothing in! \|edit\| \|edit\| Actually, now the folders are generated with 3 files filled with crap. They will be: index.php - gets all details from: details.dat, which contains the contents of the text and stuff, editied by edit.php, which causes details.dat to change, changing index.php, provided that the log-in details are correct, and they are back in a folder that generates a server-error if a non-PHP script accesses it, a lucky accident. ... Much to do, but I'm fully devoted to the revolution until two weeks monday, and can't update. index.php will be a simple php template copied from an existing location on the server, to avoid generating it. edit.php will be a template copied the same way. and the data file will be generated with minimal information to start, and will contain the only unique content. \|edit\| ... Plus checking usernames don't already exist, no matter the upper/lower case (easy, but I'm gonna grab food first)... \|edit\| Done \|edit\| ... And doing stuff, while you're logged in... ... Plus a decent layout... Bah, need a proper to-do list! See all progress at My Face I've tried to make it hackproof, even if you can still get usernames with exclaimation marks, which won't work when it comes to your account URL... So I'll get rid of that too. \|edit\| Semi-done \|edit\| Any bugs / security problems, please give a yell. \|edit\| Bug with zeros... \|edit\| \|edit\| Solved \|edit\| -=-=- blog \| work \| code \| more code
Wed, 11 Oct 2006, 19:45
Stealth	I messed around with it and couldn't find any flaws. I would really recommend learning how to use MySQL. Its not too difficult to use and it would make things a lot easer. -=-=- Quit posting and try Google.
Sat, 04 Nov 2006, 01:23
andrewsoltan	There is a small problem with the script (though it's good on all of the other points). Because you aren't using mysql, then all a hacker has to do is got to: www.yourdomain.com/users.dat and there are all of your passwords. The best solution is to use mysql, but if you don't want to you should make the name of the dat file something along the lines of: 964371584430674hgvhvghg.dat Although that's still not 100% secure, it's unlikely someone will guess that name.
Sat, 04 Nov 2006, 01:32
shroom_monk	All you need to do to fixed andrew's problem is to encrypt all the data with some cypher, that you can only code to, not decode. Then, when someone enters their password, it's encrypted, then checked against the database. No need for complex files. Also, isn't it possible to make your server make some files restricted? -=-=- A mushroom a day keeps the doctor away... Keep It Simple, Shroom!
Sat, 04 Nov 2006, 01:37
andrewsoltan	Or you could do both for extra protection. But there is one other option. Put the passwords in the php script itself using a command such as: $num_to_guess = array ("password 1","password2and so on"); foreach ($num_to_guess as $val) And make a simple input command to input the password for you.
Sat, 04 Nov 2006, 12:00
HoboBen	It's alright, I think - not only is it encrypted now, but the data directory is password protected / throws an error if it is accessed by anyone other than the PHP scripts on the server. -=-=- blog \| work \| code \| more code