[MySQL][PHP] Small Usersystem

[Hexadecimal]

I'll consider using SALTs in the future, but wouldn't it be safer to have a salt on each side of the password? Otherwise, you could just use SubStr on the password until you have removed the salt.

<?php

$salt = "ABBBCBCBCBBCBCBCBCB0109293839299292920902";
function enc($in) { return sha1($salt.md5($in).$salt); }

?>

That would be a much safer alternative.

Go for it. If you know what you're doing, and feel it's a good thing to do, then try it.

I suggest using special characters in your SALT, such as "!*%!SGJ*!!()*!"

[XCON]

I have recoded the usersystem from scratch, the design has been updated and new features have been added.

There is now a page with a member list plus a user profile page.
There is also a page that lets you read and send private messages to other users.

I was thinking maybe coding a chatbox or a mini-forum.

[Markshall]

If it works, great! But I'm with other people on this, I don't like the way you capitalize things such as expressions, but like I said if it works... great.

I also don't like the way you stretch functions onto one line instead of line breaking them and indenting. I know other people viewing the website won't see the PHP coding, but I have 'OCD' with my PHP and like to keep it all tidy behind the scenes, lol.

Nice work with it though.

[XCON]

I removed the capitalizations, while I do admit that it does look nicer, it will take some time to get used to.

I can also inform you that I wont be using functions in the same way this time, I wont have a function for getting the information from users and similar, the only functions I have now is for securing inputs from forms and encrypting passwords.

[skylle]

nice 1

[XCON]

Thanks.

I haven't got the private messaging system working 100%, some problems with the Javascripts that are supposed to work.
EDIT: Works now. I hate that \n and \r breaks Javascript codes.

[zkemppel]

You should add an authorization level system, for admins and such.

    function verifyauth($sessuser, $variable)
    {
        $query = mysql_query("SELECT AUTH FROM users WHERE ID = '".$sessuser."'");
        $run = mysql_fetch_assoc($query);

        if($variable == 1)
        {
            if($run["AUTH"] >= 1)
            {
                return true;
            }
        }        
        elseif($variable == 2)
        {
            if($run["AUTH"] >= 2)
            {
                return true;
            }
        }
        else
        {
            return false;
        }
    }

define("AUTH_1", (verifyauth($_SESSION["user"], 1)));
define("AUTH_2", (verifyauth($_SESSION["user"], 2))); 

[XCON]

There is an authorization system, just not completed yet, I'm working on that.

I added the feature to enable and disable private messaging.
I added the feature to hide and show your email address on your profile page.

[zkemppel]

I only glanced at the code, just throwing some ideas at you. authorization system shouldn't take too much work. with that code you just wrap different functions with:

if(AUTH_1)
{
//execute code
}
else
{
echo "You do not have sufficient authorization.";
} 

[XCON]

What would I need an authorization system for? I have a rank system coded, in place and its working perfectly fine.

[s-p-n]

Try to make your code look like the code examples here:
Manual :: Coding Standards

Particularly your function definitions:
http://pear.php.net/manual/en/standards.funcdef.php

Also keep your lines limited to 75-85 characters, where a tab is 4 or 8 spaces (not both/either- pick one or the other.. pick 4).

Also this is already a bool:

IsSet($_SESSION["id"]) && UserExist(Secure($_SESSION["id"])) 

So you don't need to append ' ? true : false ', as it's already going to be true/false. In fact, never use a control statement to evaluate to true/false.. it's already true/false.


Finally, refrain from your nesting habit.

if(condition1)
{
    // condition1 code

    if(condition2)
    {
        // condition2 code

        if(condition3)
        {
            // condition3 code

        } else {
            error3
        }
    } else {
        error2
    }
} else {
    error1
} 

can easily be improved like so:

if (!condition1)
{
    error1
}

// condition1 code

if (!condition2)
{
    error2
}

// condition2 code

if (!condition3)
{
    error3
}

// condition3 code 

If you're not going to have code for each condition, this is even better:

if (   condition1
    && condition2
    && condition3
) {
    // code here
} 

No matter what you're coding, the goal is to keep it readable for your future self or other developers, as it's not going to be perfect the first time.

[zkemppel]

What would I need an authorization system for? I have a rank system coded, in place and its working perfectly fine.

If someone is an administrator, they have authorization to access certain functions, but a regular user without authorization would not be able to. This might be what you mean by rank system. Stuff such as editing/deleting users.

[XCON]

s-p-n, thanks for the advice, but I'm used to my way of coding, and I will probably keep using it.

zkemppel, the rank system I coded is very efficient and extendable, the authorization system you suggested isnt, but thank you for your advice.
Posted via Mobile Device

[Donkjam]

Welcome back ^^. Looks alright ^^ I'm maybe learning php so will look at how it works
Posted via Mobile Device

[XCON]

Thanks Donkjam, but as s-p-n made very clear, my code isn't the best learning source, however, if you do learn anything from me, I'm glad I could help.