This is what worked. Of course, there may be a more efficient way of doing this, and may require a session to be implemented, but it’s a start.
Registration form (could be in HTML code):
[php]echo ‘’;
echo '
Name:
';
echo '
E-mail (This will be your username):
';
echo '
Password:
';
echo ‘’;[/php]
Process the form and add to the DB:
[php]<?php
// C O L L E C T P O S T E D F O R M V A L U E S
$name=$_POST[‘student_name’];
$email=$_POST[‘student_e-mail’];
$pwd=$_POST[‘student_pwd’];
$salt=’$2a$07$gi74FUurEWqlEo42f5FmPe5$’; // $2a$07$ and the final $ are used for blowfish encryption
if (!get_magic_quotes_gpc())
{
$name=addslashes($name);
$email=addslashes($email);
}
$pwdsf=addslashes(crypt($pwd, $salt)); // H A S H P A S S W O R D A N D S A L T - for some reason this fails in the if routine above
echo $pwdsf;
// C O N N E C T T O D B
@ $db = new mysqli(‘localhost’, ‘user’, ‘pass’, ‘DB’);
if (mysqli_connect_errno())
{
echo ‘Could not connect to db.’;
exit;
}
//A D D V A L U E S T O D B
$query = “insert into students values (’’,’”.$name."’,’".$email."’,’".$pwdsf."’)";
$result = $db->query($query);
// confirmation message
if ($result)
{
echo $db->affected_rows.’ student registered’; // F O R T E S T I N G or A D D A S U C C E S S M E S S A G E
}
else
echo ‘
Could not register you, please go back and try again.
’;
/*Prepare an e-mail confirmation of registration
N E E D S T O B E S A N I T I S E D
*/
$query = “select * from students WHERE student_email=’”.$email."’";
$result = $db->query($query);
$num_results = $result->num_rows;
for ($i=0; $i <$num_results; $i++)
{
$row = $result->fetch_assoc();
$name=stripslashes($row[‘student_name’]);
echo '
Name: '.$name;
$mail=stripslashes($row[‘student_email’]);
echo '
Your e-mail is: '.$mail;
}
$subj = “E-mail subject”;
$mesg = ‘Thank you for registering …’;
$from = ‘From: [email protected]’;
mail($mail, $subj, $mesg, $from);
?>[/php]
Login form (could be a HTML form with PHP embedded):
[php]echo ‘’;
echo ‘
Username (registered e-mail): .
’;
echo '
Password:
';
echo ‘’;[/php]
Process the form:
[php]<?php
$user=$_POST[‘uname’];
$user=stripslashes($user);
$pwd=$_POST[‘pwd’];
// C H E C K F O R P A S S W O R D E N T E R E D
if (!$pwd)
{
echo ‘No password’;
exit;
}
else
{
// P R E P A R E P A S W O R D F O R D B C O M P A R I S O N
$salt=’$2a$07$gi74FUurEWqlEo42f5FmPe5$’; // S A M E S A L T A S R E G I S T R A T I O N
$pwddump=stripslashes(crypt($pwd, $salt));
@ $db = new mysqli(‘localhost’, ‘user’, ‘pass’, ‘DB’);
if (mysqli_connect_errno())
{
echo ‘Could not connect to db.’;
exit;
}
echo $pwddump; // S H O W H A S H F O R T E S T I N G P U R P O S E S
// P U L L U S E R N A M E A N D P A S S W O R D F R O M D B T O C O M P A R E W I T H V A R I A B L E S
$query = “select * FROM students WHERE student_email=’”.$user."’ AND student_pwd=’".$pwddump."’";
$result= $db->query($query);
$num_results = $result->num_rows;
for ($i=0; $i <$num_results; $i++)
{
// A L L T A B L E R O W S L O A D E D F O R F U R T H E R U S E I N M Y C O D E
$row = $result->fetch_assoc();
$dbid=stripslashes($row[‘student_ID’]);
$dbname=stripslashes($row[‘student_name’]);
$dbemail=stripslashes($row[‘student_email’]);
$dbpwd=stripslashes($row[‘student_pwd’]);
}
if ($dbpwd != $pwddump)
{
echo ‘Wrong username or password’;
}
else
{
// R E S T O F P A G E C O D E[/php]
I hope someone finds this useful.
and we can go from there. I see a lot of code online using MD5 encryption. Let us know what you have…