Quick Code Overview

Quote:

---

Originally Posted by Crypt0nite

PHP Code:

---

$password = md5(sha1($mysqli->filter($_POST["password"]))); 


---

You don't have to sanitize this input.

---

Yes, that's occurred to me. At the time my passwords weren't encrypted.

Having some issues with cookies:

PHP Code:

---

            setcookie('ticket', 'whatwhat_inthebutt'); 


---

This sets a cookie (I view them using EditThisCookie for Chrome).

This does not.

PHP Code:

---

        $time = time() + 30;
            setcookie('ticket', 'whatwhat_inthebutt', $time); 


---

I've tried putting time() + 30; directly in there, but no luck. I've tried making $time a string and escaping it, but that, too, is a fruitless effort.

Is the browser an issue?

Quote:

---

Originally Posted by FullmetalPride

Yes, that's occurred to me. At the time my passwords weren't encrypted.

Having some issues with cookies:

PHP Code:

---

            setcookie('ticket', 'whatwhat_inthebutt'); 


---

This sets a cookie (I view them using EditThisCookie for Chrome).

This does not.

PHP Code:

---

        $time = time() + 30;
            setcookie('ticket', 'whatwhat_inthebutt', $time); 


---

I've tried putting time() + 30; directly in there, but no luck. I've tried making $time a string and escaping it, but that, too, is a fruitless effort.

Is the browser an issue?

---

No, the browser is not the issue.

PHP Code:

---

<?php
setcookie('test', 'value', time() + 1337);

echo $_COOKIE['test'];
?>

---

This must work properly, I don't see any problems at all in your code.

Quote:

---

Originally Posted by FullmetalPride

Yes, that's occurred to me. At the time my passwords weren't encrypted.

Having some issues with cookies:

PHP Code:

---

            setcookie('ticket', 'whatwhat_inthebutt'); 


---

This sets a cookie (I view them using EditThisCookie for Chrome).

This does not.

PHP Code:

---

        $time = time() + 30;
            setcookie('ticket', 'whatwhat_inthebutt', $time); 


---

I've tried putting time() + 30; directly in there, but no luck. I've tried making $time a string and escaping it, but that, too, is a fruitless effort.

Is the browser an issue?

---

Maybe because it expires in 30 secs? Try making that a longer period of time

Quote:

---

Originally Posted by EliteGM

Maybe because it expires in 30 secs? Try making that a longer period of time

---

I thought about that, but it doesn't take more than 30 seconds to process the page and code, etc.

Quote:

---

Originally Posted by EliteGM

Maybe because it expires in 30 secs? Try making that a longer period of time

---

Nah, don't think so. 30 seconds are enough to output the cookie in your browser.

Quote:

---

Originally Posted by FullmetalPride

I thought about that, but it doesn't take more than 30 seconds to process the page and code, etc.

---

Perhaps a fuckup between timezones?

Quote:

---

Originally Posted by EliteGM

Perhaps a fuckup between timezones?

---

If he's on a development machine, while he's locally connected, it's not possible.

But, you can be right. If you're running on a server in another country, it could be possible.

Quote:

---

Originally Posted by Crypt0nite

If he's on a development machine, while he's locally connected, it's not possible.

But, you can be right. If you're running on a server in another country, it could be possible.

---

Actually, this was a possibility I just considered. I think my PHP instance thinks it's in PST. That, or the server does. I'll check to make sure.

Giving EliteGM and I a big hand.

PHP Code:

---

[16-Sep-2013 22:00:25 America/Los_Angeles] 


---

No way in hell I'm going to Los Angeles any time soon. No fucking way.

Did some updates to your script, added a couple of comments as to what has changed

PHP Code:

---

private $username;
private $password;
private $mysqli;


public function __construct($username, $password, $mysqli) 
{
    //If your going to assign $mysqli then assign the others as well?
    $this->mysqli = $mysqli;
    $this->username = $username;
    $this->password = $password;
    session_start();
    if ($this->validateUser() == true) 
    {
        $_SESSION["username"] = $this->username;
        $_SESSION["ticket"] = "BRITE-USA-" . rand(1000, 10000) . "-" . rand(1400,1500) . "-" . rand(1290, 1600) .  "-" . rand(1500, 10000) . "";
        echo $_SESSION["ticket"];
    }
}

private function validateUser() 
{
    $loginQuery = $this->mysqli->exec("SELECT * FROM users WHERE username = '" . $this->username . "' LIMIT 1");
    $loginData = $loginQuery->fetch_array();

    if ($password == $loginData["password"]) 
    {
        $ip = $_SERVER['REMOTE_ADDR'];
        //If you have got this far you don't need the password on the where clause as you have already authenticated
        //Add limit, as you are only updating 1 row, stop the query after first result
        //Combine both querys
        $this->mysqli->exec("UPDATE users SET last_login = UNIX_TIMESTAMP(), last_ip = '{$ip}' WHERE username = '{$this->username}' LIMIT 1");
        return true;
    }

    return false;
} 


---

Quote:

---

Originally Posted by ItSnowsInHell

Did some updates to your script, added a couple of comments as to what has changed

PHP Code:

---

private $username;
private $password;
private $mysqli;


public function __construct($username, $password, $mysqli) 
{
    //If your going to assign $mysqli then assign the others as well?
    $this->mysqli = $mysqli;
    $this->username = $username;
    $this->password = $password;
    session_start();
    if ($this->validateUser() == true) 
    {
        $_SESSION["username"] = $this->username;
        $_SESSION["ticket"] = "BRITE-USA-" . rand(1000, 10000) . "-" . rand(1400,1500) . "-" . rand(1290, 1600) .  "-" . rand(1500, 10000) . "";
        echo $_SESSION["ticket"];
    }
}

private function validateUser() 
{
    $loginQuery = $this->mysqli->exec("SELECT * FROM users WHERE username = '" . $this->username . "' LIMIT 1");
    $loginData = $loginQuery->fetch_array();

    if ($password == $loginData["password"]) 
    {
        $ip = $_SERVER['REMOTE_ADDR'];
        //If you have got this far you don't need the password on the where clause as you have already authenticated
        //Add limit, as you are only updating 1 row, stop the query after first result
        //Combine both querys
        $this->mysqli->exec("UPDATE users SET last_login = UNIX_TIMESTAMP(), last_ip = '{$ip}' WHERE username = '{$this->username}' LIMIT 1");
        return true;
    }

    return false;
} 


---

---

Thanks, but the script's actually had most of those fixes added. I'm interested in how you're escaping the variables in the query though? I've been using '" . $variable . "', but that looks much easier. Can I use any query that way?


Here's the new class if you want to take a look:

PHP Code:

---

    public function __construct($mysqli) {

        $this->mysqli = $mysqli;
        session_start();


    }


    public function validateUser($username, $password) {

        $loginQuery = $this->mysqli->exec("SELECT * FROM users WHERE username = '" . $username . "' LIMIT 1");
        $loginData = mysqli_fetch_array($loginQuery);

        if ($password == $loginData["password"]) {

            $_SESSION["username"] = $username;
            $_SESSION["ticket"] = "BRITE-USA-" . rand(1000, 10000) . "-" . rand(1400,1500) . "-" . rand(1290, 1600) .  "-" . rand(1500, 10000) . "";
            $this->mysqli->exec("UPDATE users SET last_login = UNIX_TIMESTAMP(), last_ip = '" . $_SERVER["REMOTE_ADDR"] . "', ticket = '" . $_SESSION["ticket"] . "' WHERE username = '" . $username . "' AND password = '" . $password . "'");

            return true;

        }

        else {

            return false;

        }


    }


    public function ticketArray($username, $ticket) {

        $ticketQuery = $this->mysqli->exec("SELECT * FROM users WHERE ticket = '" . $ticket . "' LIMIT 1");
        $this->ticketData = mysqli_fetch_array($ticketQuery);

        return $this->ticketData;

} 


---

Another thing, I don't set the $username and $password variables until the validation part because they need to be able to change. That's why I've added a function that changes session variables. And because I define $session in briteCore.php, where $username and $password aren't passed.

Quote:

---

Originally Posted by FullmetalPride

Thanks, but the script's actually had most of those fixes added. I'm interested in how you're escaping the variables in the query though? I've been using '" . $variable . "', but that looks much easier. Can I use any query that way?


Here's the new class if you want to take a look:

PHP Code:

---

    public function __construct($mysqli) {

        $this->mysqli = $mysqli;
        session_start();


    }


    public function validateUser($username, $password) {

        $loginQuery = $this->mysqli->exec("SELECT * FROM users WHERE username = '" . $username . "' LIMIT 1");
        $loginData = mysqli_fetch_array($loginQuery);

        if ($password == $loginData["password"]) {

            $_SESSION["username"] = $username;
            $_SESSION["ticket"] = "BRITE-USA-" . rand(1000, 10000) . "-" . rand(1400,1500) . "-" . rand(1290, 1600) .  "-" . rand(1500, 10000) . "";
            $this->mysqli->exec("UPDATE users SET last_login = UNIX_TIMESTAMP(), last_ip = '" . $_SERVER["REMOTE_ADDR"] . "', ticket = '" . $_SESSION["ticket"] . "' WHERE username = '" . $username . "' AND password = '" . $password . "'");

            return true;

        }

        else {

            return false;

        }


    }


    public function ticketArray($username, $ticket) {

        $ticketQuery = $this->mysqli->exec("SELECT * FROM users WHERE ticket = '" . $ticket . "' LIMIT 1");
        $this->ticketData = mysqli_fetch_array($ticketQuery);

        return $this->ticketData;

} 


---

Another thing, I don't set the $username and $password variables until the validation part because they need to be able to change. That's why I've added a function that changes session variables. And because I define $session in briteCore.php, where $username and $password aren't passed.

---

You can only use {} within " ", not ' '.

Read my validateUser() you don't need that much stuff in it, you don't need an else on the if, just return false, I have no idea what those last couple of sentences mean. I only modified the script shown

Quote:

---

Originally Posted by ItSnowsInHell

You can only use {} within " ", not ' '.

Read my validateUser() you don't need that much stuff in it, you don't need an else on the if, just return false, I have no idea what those last couple of sentences mean. I only modified the script shown

---

The session is started via the global file, not each file locally. I guess since I'm including the global file I could use your __construct function, but I'm feeling good about how it's going right now.

I do have one question, what's the best way to end a session after a set expiry time? time() is being difficult since the outcome of converting the UTC time to their's will be different for each timezone.

Quote:

---

Originally Posted by FullmetalPride

The session is started via the global file, not each file locally. I guess since I'm including the global file I could use your __construct function, but I'm feeling good about how it's going right now.

I do have one question, what's the best way to end a session after a set expiry time? time() is being difficult since the outcome of converting the UTC time to their's will be different for each timezone.

---

Use the time() for all dates, then when the user wants to see their time have a function that converts it to their local time?

Quote:

---

Originally Posted by ItSnowsInHell

Use the time() for all dates, then when the user wants to see their time have a function that converts it to their local time?

---

I have an idea about how I get their location, but not how to use that location to determine the timezone.