/    Sign up×
Community /Pin to ProfileBookmark

Simple PHP Login: Check password for username entered.

I have a simple sticky login form(user name, password, and confirm password) that uses a session; it is for local network use. I have that form input sent to another page that checks if the user name is in one array, and I need it to check the password against the password for the particular user name entered. This instead of just checking against all of the passwords in the second array. Checking the $user_name works fine: but, checking the password for the user name entered is FALSE no matter what I try.

I thought the basic “check” would look something like this after getting the inputs; I just made up the $names, and $passwords, arrays for now:

[CODE]// Get form input
$user_name = trim($_REQUEST[‘user_name’]);
$password = trim($_REQUEST[‘password’]);
$password_one = trim($_REQUEST[‘password_one’]);

// Arrays to check input against
$names = array(‘Ben’, ‘Wess’, ‘Dave’, ‘Robin’, ‘Sarah’);
$passwords = array(‘Ben’=>”argh”, ‘Wess’=>”fffff”, ‘Dave’=>”harry”,
‘Robin’=>”987654321″, ‘Sarah’=>”trueBlue”);

// Check Form Input
if (!empty($user_name) AND in_array($user_name, $names))
{
if (!empty($password) AND !empty($password_one) AND $password==$password_one AND in_array($password, $passwords[‘$user_name’]))
{
print “You have logged in successfully”;
} [/CODE]

I think I’m doing something wrong on this line:

[CODE]AND in_array($password, $passwords[‘$user_name’])[/CODE]

But I’m relatively new to PHP, and I can’t seem to get it working properly.
Any help would be greatly appreciated, Thank you!

to post a comment
PHP

5 Comments(s)

Copy linkTweet thisAlerts:
@NogDogDec 20.2009 — There is really no reason for two arrays since you already have the user names in the $passwords array:
[code=php]
if ( !empty($user_name)
AND !empty($password)
AND $password==$password_one
AND isset($passwords[$user_name])
AND $password == $passwords[$user_name]
) {
print "You have logged in successfully";
}
[/code]


(Also: don't quote your variable names when using them as an array index.)
Copy linkTweet thisAlerts:
@WestWebauthorDec 20.2009 — Well I tried that: but, I didn't think that code checked The $user_name though, so I added one more part in. I think it now checks if the $user_name exists in the $user_info array.

if (!empty($user_name) AND isset($user_name, $user_info[$user_name]))

{

if (!empty($password) AND !empty($password_one) AND $password==$password_one

AND $password == $user_info[$user_name])

{

print "You have logged in successfully";

}

It works great now, Thanks for the Help!
Copy linkTweet thisAlerts:
@NogDogDec 20.2009 — This checks the user name, since it is the array key in the $passwords array:
[code=php]
AND isset($passwords[$user_name])
[/code]

In other words, this already has the user name [b]and[/b] password data in it:
[code=php]
$passwords = array(
'manny' => 'pwd1',
'moe' => 'pwd2',
'jack' => 'pwd3'
);
[/code]

So there is really no reason for a second array to duplicate those same user names (it's just one more thing to have to maintain).
Copy linkTweet thisAlerts:
@WestWebauthorDec 20.2009 — Yes, I had already got rid of the $names array and renamed the other array "$user_info": which, is now my only array.

Ahh I see, that makes it a little shorter for the name check code. I am using two if statements because I want the user to know if they mess up on the $user_name or the $password; here is the whole page that checks the form, and again... Thanks so much for the help!

[CODE]<?php
ob_start();
if (!isset($_SESSION))
{
session_start();
}

$user_name = strip_tags(trim($_REQUEST['user_name']));
$password = strip_tags(trim($_REQUEST['password']));
$password_one = strip_tags(trim($_REQUEST['password_one']));

$user_info = array('Ben'=>"argh", 'Wess'=>"fffff", 'Dave'=>"harry", 'Robin'=>"987654321", 'Sarah'=>"trueBlue");

// Check user_name input...
if (!empty($user_name) AND isset($user_info[$user_name]))
{
// ... and if no errors then check password...
if (!empty($password) AND !empty($password_one) AND $password==$password_one
AND $password == $user_info[$user_name])
{
print "You have logged in successfully";
}
else
{
// if errors with password, go back to login.php and display alert
$_SESSION['alert'] = "Your passwords do not match, or are incorrect";
$_SESSION['user_name'] = $user_name;
header('location: login.php');
}
}
else
{
// if errors with user_name, go back to login.php and display alert
$_SESSION['alert'] = "The user name you have entered does not exist";
$_SESSION['user_name'] = $user_name;
header('location: login.php');
}

?>[/CODE]
Copy linkTweet thisAlerts:
@NogDogDec 21.2009 — 
...I am using two if statements because I want the user to know if they mess up on the $user_name or the $password...[/QUOTE]


Many would argue that that gives too much information to a potential hacker by telling him that he's correctly guessed the user name, so all he has to work on now is the password.

But then we're probably (hopefully?) not looking at a critical, high security site if we're putting the passwords in plain text in the source code, right? ?
×

Success!

Help @WestWeb spread the word by sharing this article on Twitter...

Tweet This
Sign in
Forgot password?
Sign in with TwitchSign in with GithubCreate Account
about: ({
version: 0.1.9 BETA 5.4,
whats_new: community page,
up_next: more Davinci•003 tasks,
coming_soon: events calendar,
social: @webDeveloperHQ
});

legal: ({
terms: of use,
privacy: policy
});
changelog: (
version: 0.1.9,
notes: added community page

version: 0.1.8,
notes: added Davinci•003

version: 0.1.7,
notes: upvote answers to bounties

version: 0.1.6,
notes: article editor refresh
)...
recent_tips: (
tipper: @Yussuf4331,
tipped: article
amount: 1000 SATS,

tipper: @darkwebsites540,
tipped: article
amount: 10 SATS,

tipper: @Samric24,
tipped: article
amount: 1000 SATS,
)...