PHP Login Error

I’m creating a admin page for my repo and I’m running across this error on my index.php when I’m logged in.

Deprecated: Function session_is_registered() is deprecated in apt.technologx.pw/admin/login.php on line 2 Welcome Technologx

Here is what my login.php looks like:
[php]<?php
if (!session_is_registered(‘loginid’) || !session_is_registered(‘username’))
{
// user is not logged in.
if (isset($_POST[‘cmdlogin’]))
{
// retrieve the username and password sent from login form
// First we remove all HTML-tags and PHP-tags, then we create a md5-hash
// This step will make sure the script is not vurnable to sql injections.
$u = strip_tags($_POST[‘username’]);
$p = md5(strip_tags($_POST[‘password’]));
//Now let us look for the user in the database.
$query = sprintf(“SELECT loginid FROM login WHERE username = ‘%s’ AND password = ‘%s’ LIMIT 1;”,
mysql_real_escape_string($u), mysql_real_escape_string($p));
$result = mysql_query($query);
// If the database returns a 0 as result we know the login information is incorrect.
// If the database returns a 1 as result we know the login was correct and we proceed.
// If the database returns a result > 1 there are multple users
// with the same username and password, so the login will fail.
if (mysql_num_rows($result) != 1)
{
// invalid login information
echo “Wrong username or password!”;
//show the loginform again.
include “loginform.php”;
} else {
// Login was successfull
$row = mysql_fetch_array($result);
// Save the user ID for use later
$_SESSION[‘loginid’] = $row[‘loginid’];
// Save the username for use later
$_SESSION[‘username’] = $u;
// Now we show the userbox
show_userbox();
}
} else {
// User is not logged in and has not pressed the login button
// so we show him the loginform
include “loginform.php”;
}
} else {
// The user is already loggedin, so we show the userbox.
show_userbox();
}
?>[/php]

I’d like to know what I could do to fix the error?

session_is_registered is deprecated / will be removed in future PHP versions. You need to use an alternative way to check if something is set in session, ie $_SESSION[‘key’]

So I need to replace [php]if (!session_is_registered(‘loginid’) || !session_is_registered(‘username’))[/php] with [php]$_SESSION[‘key’][/php]?

No, he means you could do something like

[php]

<?php ... session_start() if(isset($_SESSION['key'])){ //do something if the session is set echo "Success!"; } else { //do something if it's not set die("Session not set!"); } ?>

[/php]

Also md5() is very faulty and you need something like sha512 or sha256. They have md5() decrypts online.

[php]

<?php … $p = hash("sha512", $_POST['password']); ?>

[/php]

1 more thing before I let you off the hook, haha

Mysql is also deprecated and you should be using Mysqli or PDO() class. I prefer PDO, but mysqli is easier if you’re not use to OOP. You should also used prepared statements learn here:

http://www.w3schools.com/php/php_mysql_prepared_statements.asp

Thank you guy’s after I posted that reply I found one that works with no errors. I’d post the link but I haven’t reached 10 posts yet.

Please use Bcrypt or pbkdf2 instead. Bcrypt beeing a natural choice since its what was chosen for phps default password hash api

Ah yes, I never thought of that… Sha512 is what I was taught haha

But yes…

Sponsor our Newsletter | Privacy Policy | Terms of Service