Posted by programming on 04/05/07 03:13

On Apr 5, 1:46 pm, Jerry Stuckle <jstuck...@attglobal.net> wrote:
> programming wrote:
> > Hi all,
>
> > i have been having trouble with a login script that works on my
> > windows machine, however when i upload it to the Unix server through
> > VPN, the same script won't work! It won't parse member.txt properly i
> > think. The password and usernames i am using are at the bottom of this
> > post.
> > Each time i go to login on the unix server, it clears the username and
> > password field. I have been attempting to solve the problem, but have
> > been baffled to see why there is such an issue. I have taken out the
> > HTML, and just given you the PHP script that i am running. The
> > original programming was done on Unix!.
>
> > My question to people on here is why does my script run on Windows and
> > not on Unix? How can i fix the problem?
>
> > Here is the source code i have been looking at:
> > \-------------------------------------------------------------------------------------------------------------------------------------------------------------------
> > <?
> > session_start();
>
> > if ($userid && $password)
>
> > {
> > //listf stores a reference to the file itself
> > $listf=fopen("username/member.txt","r");
>
> > #read the file
> > list($duserid,$dpassword)=fgetcsv($listf,1024,"|");
>
> > $duserid=trim($duserid);
> > $dpassword=trim($dpassword);
>
> > //keep reading until the end of the file is reached
> > while(!feof($listf)){
>
> > if(($userid==$duserid)&&($password==$dpassword))
> > {
> > $_SESSION['valid_user']=$userid;
> > break;
> > }
> > list($duserid,$dpassword)=fgetcsv($listf,1024,"|");
> > $duserid=trim($duserid);
> > $dpassword=trim($dpassword);
> > }
> > fclose($listf);
> > }
>
> > ?>
> > ------HTML-------
> > <?
> > $tempstr=$_SESSION['valid_user'];
>
> > if (isset($_SESSION['valid_user'])){
> > echo "You are logged in as: $tempstr<br>";
> > echo "<a href=\"admin_home.php\">Admin Home</a><br>";
> > }
> > else{
> > if (isset($userid)) {
> > // if they've tried and failed to log in
> > echo "Could not log you in";
> > }
> > else{
> > // they have not tried to log in yet or have logged out
> > echo "<table border=0 width=\"600\" cellspacing=0 cellpadding=0
> > border=0 valign=\"top\" align=\"center\">";
> > echo "<tr><td>You are not logged in.<br></td>";
> > echo "</table>";
> > }
> > // provide form to log in
> > echo "<form method=post action=\"login.php\">";
> > echo "<table border=0 width=\"600\" cellspacing=0 cellpadding=0
> > border=0 valign=\"top\" align=\"center\">";
> > echo "<tr><td>Userid:</td>";
> > echo "<td><input type=text name=userid></td></tr>";
> > echo "<tr><td>Password:</td>";
> > echo "<td><input type=password name=password></td></tr>";
> > echo "<tr><td colspan=2 align=right>";
> > echo "<input type=submit value=\"Log in\">";
> > //echo "<tr><td colspan=1 align=center>";
> > echo "<input type=reset value=\"Reset\"></td></tr>";
> > echo "</table></form>";
> > }
> > ?>
> > --------------------------------------------------------------------------------------------------------------------------------------------------------------------
> > Here is the Windows copy of the member.txt that only works with ASCII
> > block terminator at the end of the file:
> > ------------------------------------------------------------------------------------------------------------------------------------------------------------------
> > admin|1234|School|Computing|bhk...@utas.edu.au|University of Tasmania|
> > 1
> > bhkang|abcd1234|Kang|ByeongHo|bhk...@utas.edu.au|Computing|2
> > --------------------------------------------------------------------------------------------------------------------------------------------------------------------
>
> > Cheers,
>
> > Peri.
>
> Peri,
>
> You have register_globals enabled on your Windows machine (VERY BAD) and
> disabled on your Unix machine (VERY GOOD).
>
> --
> ==================
> Remove the "x" from my email address
> Jerry Stuckle
> JDS Computer Training Corp.
> jstuck...@attglobal.net
> ==================

Ok Jerry thanks for the advice, it is strange that most of the code i
have adapted here comes from some tutorial work i have been doing, and
that
it suppose to be tested initially on the Unix server. So, you are
telling me that the problem is not in the program reading the text
file, but a security
problem that exists within the script and the PHP ini file has been
set to off with register globals....

[Back to original message]