[No Mysql]Loging script

There we go all know im finnish guy so i have typed this script in finnish language but i have transilaited it.

Info:
Just make users.txt and chmode it and whooo!

[PHP]<?php
session_start();
$userfilu = "users.txt"; // Where go all user.
$tunmin = "3";// Username min letters require
$pasmin = "3"; // password min letters require
if($_GET['act'] == "login"){
$u = $_POST['tunnus'];
$f = file("$userfilu");
for($a=0;$a<count($f);$a++){
$t = explode("|",$f[$a]);
if($u == $t[0]){
if($_POST['tunnus'] == $t[0]){
if($t[1] == sha1($_POST['salasana'])){
session_register("tun");
$_SESSION['tun'] = $_POST['tunnus'];
session_register("iposo");
$_SESSION['ipodo']= $_SERVER['REMOTE_ADDR'];
echo'Login<br><br>
<a href="'.$_SERVER['PHP_SELF'].'">Home</a><br><br>';
}
}
}
}
}
if($_GET['act'] == "logout"){
session_start();
session_unregister("tun");
session_unregister("iposo");
echo'You logged out<br><br>
<a href="'.$_SERVER['PHP_SELF'].'">Home</a><br><br>';
}
if($_GET['act'] == "rek"){
echo'<form method="post" action="'.$_SERVER['PHP_SELF'].'?act=send">
Username<br>
<input type="text" name="tunnari"><br>
password<br>
<input type="text" name="passu"><br>
password again<br>
<input type="password" name="passu2"><br><br>
<input type="submit" value="Register"><br><br>
</form>';
}
if($_GET['act'] == "send"){
if(!trim($_POST['tunnari']) or !trim($_POST['passu']) or !trim($_POST['passu2'])){
exit('You must fill all forms');
}
if($_POST['passu'] == $_POST['passu2']){
$tu = array();
$fi = file("$userfilu");
for($e=0;$e<count($fi);$e++){
$tt = explode("|",$fi[$e]);
$tu[$e] = $tt[0];
}
if(!in_array($_POST['tunnari'],$tu)){
if(strlen($_POST['tunnari'])< $tunmin) exit('Username is too short');
if(strlen($_POST['passu'])< $pasmin) exit('Password is too short');
$tunnari = $_POST['tunnari'];
$passu = sha1($_POST['passu']);
$tunnari = htmlspecialchars($tunnari);
$tunnari = stripslashes($tunnari);
$passu = htmlspecialchars($passu);
$passu = stripslashes($passu);
$f = fopen("$userfilu","a");
flock($f,2);
fwrite($f,"$tunnari|$passu|\n");
flock($f,3);
fclose($f);
echo'Registeration is complited!<br><br>
<a href="'.$_SERVER['PHP_SELF'].'">Login</a><br><br>';
} else {
exit('Username is already taked :(');
}
}else {
exit('Wrong username or password.');
}
}
if(empty($_SESSION['tun']) and empty($_SESSION['iposo'])){
echo'<form method="post" action="'.$_SERVER['PHP_SELF'].'?act=login">
Username<br>
<input type="text" name="tunnus"><br>
password<br>
<input type="password" name="salasana"><br><br>
<input type="submit" value="Login">
</form>
<a href="'.$_SERVER['PHP_SELF'].'?act=rek">Rekister

It's a nice script, but do you think its secure enough to work with??? Many people are looking for register / login pages to make / get.. and they use DBs for their games.

If you CHMOD users.txt to 777 it means EVERYONE can access the file and see the passwords + usernames.

Make a script with DBconnection to MSSQL DBs and MySQL DBs... 2 different registerpages / logins ofc.. not for me.. but to share with people who can maybe use them for their own site / gameserve.

.htaccess is friend or you can rename it like 483sdf9683946346u83946837463876378683768735734tu45tufddjkbdjn574867t78455.txt or you can do /sdkofos/dkskg/sofsaof/sdlgskgs/dsokmgslm/895458489/wsidhqwuwe/wuwhf94944.txt.

Quote:

---

Originally Posted by Maitokahvi

.htaccess is friend or you can rename it like 483sdf9683946346u83946837463876378683768735734tu45tufddjkbdjn574867t78455.txt or you can do /sdkofos/dkskg/sofsaof/sdlgskgs/dsokmgslm/895458489/wsidhqwuwe/wuwhf94944.txt.

---

Renaming or placing in a weird location wont improve security mate. And when ppl can view the users table, they know the hashes...and than they can crack your passwords in minutes. There are SOO many hash table on the internet. You'd better make a combination of md5 and sha1 several times, than its really secure :P (especially when they dont see the hash).

And yes, I know you tried to make it better than passie's script, which wasnt difficult ^^, but I dont think we should fill the showcase forum with "Logging scripts", because they are so easy...you'd better make it a tutorial with a bit of explaination etc and place it in the coders paradise main forum. Else this showcase forum gets somewhat dull and useless for the average codings visitor...

Quote:

---

Originally Posted by Daevius

Renaming or placing in a weird location wont improve security mate. And when ppl can view the users table, they know the hashes...and than they can crack your passwords in minutes. There are SOO many hash table on the internet. You'd better make a combination of md5 and sha1 several times, than its really secure :P (especially when they dont see the hash).

And yes, I know you tried to make it better than passie's script, which wasnt difficult ^^, but I dont think we should fill the showcase forum with "Logging scripts", because they are so easy...you'd better make it a tutorial with a bit of explaination etc and place it in the coders paradise main forum. Else this showcase forum gets somewhat dull and useless for the average codings visitor...

---

I must say, good words, you're familiar with PHP don't you.

and btw you from the Netherlands, same here. hehe

Quote:

---

Originally Posted by Nortie

I must say, good words, you're familiar with PHP don't you.

and btw you from the Netherlands, same here. hehe

---

Hehe. thanks :). Ofcourse: Netherlands FTW :P. Small innovative country with good economy and most ppl per square km ^^,

Quote:

---

Originally Posted by Daevius

Hehe. thanks :). Ofcourse: Netherlands FTW :P. Small innovative country with good economy and most ppl per square km ^^,

---

You betcha! But after all in a year I'll move to spain and goto work there and live there. so its "la viva el espanos!"

lol Finnish "El

you're from spain o.0

no. hola?

Also chmoding is for linux only, with a windows os you need to give the file permissions (web server or user depending).

Quote:

---

Originally Posted by Wh005h

Also chmoding is for linux only, with a windows os you need to give the file permissions (web server or user depending).

---

Daam. In windows have already chmoded so no need chmode.