Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

Register Log in
  • Congratulations Mike Lewis on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

Check if the username & password exist in the database

Status
Not open for further replies.
Guest_imported

Guest_imported

New member
Jan 1, 1970
0
0
0
The following script should take the username and the password from the form and match it with the database. If the user exists then he can continue, otherwise he has to register. The thing is that although everything seems correct, it does not work! Could anyone tell me what's wrong? :-(

#!/usr/bin/perl

'usr/pub/prepare postgr';

use CGI;
use DBI;

$|=1;
print "Content-type: text/html\n\n";

#Get input from the web

if ($ENV{'REQUEST_METHOD'} eq "POST") {
read (STDIN, $buffer, $ENV{'CONTENT_LENGTH'});
} else {
$buffer = $ENV{'QUERY_STRING'};
}
@pairs= split(/&/, $buffer);
foreach $pair (@pairs) {
($name, $value) = split(/=/, $pair);
$value =~ tr/+/ /;
$value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack ("C", hex($1))/eg;
$contents{$name} = $value;
}

$regexp = &quot;[\<\>\|\;\,\']&quot;;


$mname = $contents{'username'};
$mname =~ s/$regexp//g; #remove suspect chars

$mpwd = $contents{'password'};
$mpwd =~ s/$regexp//g; #remove suspect chars



#opens database

my ($dbh, $sth, $z);

$dbtype = &quot;Pg&quot;;
$database= &quot;xxxx&quot;;
$dbserver= &quot;xxxxxxx&quot;;
$dbport= 5432;


$data_source = &quot;dbi:$dbtype:dbname=$database;host=$dbserver;port=$dbport&quot;;

$dbh = DBI->connect(&quot;$data_source&quot;, &quot;&quot;, &quot;&quot;);



$z = &quot;select username, password from supervisor where (($mname='username') and ($mpwd='password'))&quot;;

$sth = $dbh->prepare($z);
$sth->execute();


while (@row=$sth->fetchrow_array())
{
$html=$html.&quot;@row&quot;;
}

$sth->finish();
$dbh->disconnect;


if ($html eq &quot; &quot;)
{
print <<&quot;HTMLHEAD&quot;;
<HTML>
<HEAD>
<TITLE>WRONG!</TITLE>
</HEAD>
<BODY>
<P>
<CENTER>
<A HREF=&quot;<P>
</BODY>
</HTML>
HTMLHEAD
}
else
{
print <<&quot;HTMLHEAD&quot;;
<HTML>
<HEAD>
<TITLE>RIGHT PASSWORD AND USERNAME</TITLE>
</HEAD>
<BODY>
<h2><center>You have successfully logged in!</center></h2>
<h2><center>Click on the link to enter..</center></h2>
<CENTER>
<A HREF=&quot;</CENTER>
</BODY>
</HTML>
HTMLHEAD
}
 
Sort by date Sort by votes
A few things catch my attention.

First off, what is this?
Code: 
'usr/pub/prepare postgr';

Perhaps those are meant to be backticks (`)? Or just fun with anonymous scalars?

Next, as far as the suspect chars thing goes, your regex might be better expressed as [^\w] which would remove anything that was not a letter, number or underscore. You can then start to allow other characters, one by one. This is a common technique in firewall design -- deny all, then allow things one at a time, rather than trying to specifically deny each individual item.

Third, I think the SQL statement that you use declares the comparisons in the wrong order... I believe that it goes [column name] = [data], rather than [data] = [column name]. So instead of:
Code: 
(($mname='username') and ($mpwd='password'))&quot;;
You would have:
Code: 
((username='$mname') and (password='$mpwd'))&quot;;

Four: Instead of creating a scalar with the data from your query, and testing against its emptiness, just set a flag in the first execution of your while{} statement and move on. So your while loop/if statement looks like:
Code: 
while(my @row = $sth->fetchrow_array) {
    $flag = 1; last;
}
if($flag) { validated }
else  { not validated }
This avoids errors in DBI's $sth->rows() function and seems the easiest way to fix the problem in this script. Of course, this is Perl, so TMTOWTDI.

Lastly, perhaps this is just for testing, but understand that as this code stands right now, it offers no security. All one would have to do is directly access and bypass authentication entirely.

Hope this helps,

brendanc@icehouse.net
 
Upvote 0 Downvote
Thank you, you had absolutely right about the SQL statement, it works fine now. I am trying now to change this script so that it can check if the username and the password belong to a stuent or a tutor. I've tried that by adding an if statement but this doesn't really help.

Do you have any suggestions? :cool:
 
Upvote 0 Downvote
I don't know what your database field for student-or-tutor is called, but for the sake of argument, let's call it &quot;status&quot;. Change your select statement to &quot;select username,password,status ...&quot;. Then on success @row will contain 3 elements: $row[0] is username, $row[1] is password, and $row[2] is status. Then you just need to an if that says:
Code: 
if ( $row[2] eq &quot;student&quot; ) {
   # student stuff here
} elsif ( $row[2] eq &quot;tutor&quot; ) {
   # tutor stuff here
} else {
   # not student or tutor
}
Tracy Dryden
tracy@bydisn.com

Meddle not in the affairs of dragons,
For you are crunchy, and good with mustard.
 
Upvote 0 Downvote
You're quite welcome! Glad I could be of assistance.
Tracy Dryden
tracy@bydisn.com

Meddle not in the affairs of dragons,
For you are crunchy, and good with mustard.
 
Upvote 0 Downvote
I just had to stop and say that Dragon is the BEST man. Not only does he know everything about Perl (or where to find out where the info is) but he takes the time to teach us what he knows. You're the man dragon!
 
Upvote 0 Downvote
Gee, thanks! :~/ Believe it or not, I don't know everything. sophisticate and goBoating in particular have taught me a few new things too. Tracy Dryden
tracy@bydisn.com

Meddle not in the affairs of dragons,
For you are crunchy, and good with mustard.
 
Upvote 0 Downvote
I concur - kudos to the Dragon! Good work.


keep the rudder amid ship and beware the odd typo
 
Upvote 0 Downvote
Status
Not open for further replies.

Similar threads

Dino_1000
  • Locked
  • Question
Use the perl debugger to dump all the data in a string variable
Replies
0
Views
81
Dino_1000
Dino_1000
Anurag Sinha
  • Locked
  • Question
calling perl script on click of the button
Replies
0
Views
72
Anurag Sinha
Anurag Sinha
newbie1238585
  • Locked
  • Question
Perl how to read string in csv file * as wildcard operator
Replies
2
Views
114
mikrom
mikrom
ss_ham
  • Locked
  • Question
in Perl find call looking to exclude folder and ignore duplicate finds.
Replies
2
Views
82
ss_ham
ss_ham
rob54321
  • Question
Perl how to read line from file with interpolation 1
Replies
6
Views
181
rob54321
rob54321

Part and Inventory Search

Sponsor

Back
Top