I'm VERY new to PHP and have begun writing a basic login for a website that uses data from a Microsoft SQL server to display information on the web. Below are 3 snippets of code (two functions from the same file and one controller file that calls them.)
Connect to MSSQL to validate user (from phplib)
With this, I take the login credentials stored in a MySQL database, and use them to connect to a MSSQL database. (As seen in the "createUser" case of the controller).
function PDOConn(&$IPAddress, &$userAdmin, &$passAdmin, &$Database, $sess_client)
{
global $host,
$username,
$password,
$db_name,
$tbl_name_client;
try {
$conn = new PDO("mysql:host=$host; dbname=$db_name", $username, $password);
$stmt = $conn -> prepare("SELECT stuff
FROM $tbl_name_client
WHERE client = :clientId");
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$stmt->execute(array('clientId' => $sess_client));
$result = $stmt->fetchAll();
if ( count($result) == 1 )
{
foreach($result as $row)
{
$IPAddress = $row['IP'];
$userAdmin = $row['Username'];
$passAdmin = $row['Password'];
$Database = $row['database'];
}
}
else if (count($result) > 1)//Primative error handling
{
exit( "<h1>There are multiple rows in the clients table with the same clientID, which is really strange...</h1>");
}
else
{
exit( "<h1>ID isn't in the table. No rows returned. Sorry bro...");
}
}
catch(PDOException $e)
{
echo 'ERROR: '. $e->getMessage();
}
}
Check Function (from phplib)
This is the function that get called from the main login screen. function PDOCheckLogin($myusername, $mypassword) { global $host, $username, $password, $db_name, $tbl_name;
try {
$conn = new PDO("mysql:host=$host; dbname=$db_name", $username, $password);
$stmt = $conn->prepare("SELECT * FROM $tbl_name WHERE username = :myusername");
$conn->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
$stmt->execute(array('myusername' => $myusername));
$result = $stmt->fetchAll();
if ( count($result) == 1 )
{
foreach($result as $row)
{
$validpass = $row['password'];
$hashsalt = substr($validpass, 0, 128); //get the salt from the front of the hash
$testhash = hash('sha512', $hashsalt.$mypassword);
$testhash = $hashsalt.$testhash;
if($testhash === $validpass)
{
$sess_empno = $row['employeeno'];
$sess_client = $row['ClientId'];
$sess_username = $row['username'];
$_SESSION['sess_empno'] = $sess_empno;
$_SESSION['sess_client'] = $sess_client;
$_SESSION['sess_username'] = $sess_username;
header("location:../index.php");
}
else
{
exit("<h1>WRONG PASSWORD >:(</h1>");
}
}
}
else if (count($result) > 1)
{
exit( "<h1>There are multiple users with that username in the database...Whoops...</h1>");
}
else
{
exit( "<h1>That's not a username...</h1>");
}
}
catch(PDOException $e) {
echo 'ERROR: '. $e->getMessage();
}
}
My...Well Whatever this is...Controller I guess.
This receives posts from various forms and then calls the correct functions.
<?php
ob_start();
include_once('../phplib.php');
session_start();
$form = $_POST['form'];
switch ($form) {
case 'login': //When the User Logs in
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];
PDOCheckLogin($myusername, $mypassword);//Do this function
break;
case 'createUser': //MSSQL verification for the user for user creation
$client=$_POST['clientId'];
$email=$_POST['email'];
PDOConn($IPAddress, $userAdmin, $passAdmin, $Database, $client);//Get the login credentials from the database
$Login = $userAdmin;
$Password = $passAdmin;
$conn=mssql_connect($IPAddress,$Login,$Password); //Connect to the database
if (!$conn )
{
die( print_r("Unable to connect to server", true));
}
mssql_select_db($Database, $conn);
$sql="SELECT stuff FROM table WHERE email = '$email'"; //Make sure your email is in the MSSQL database
$rs=mssql_query($sql);
$count=mssql_num_rows($rs);
if ($count == 0 || $count > 1)
{
echo("Email Not Found or Valid");//You liar...
}
else{
while ($row = mssql_fetch_array($rs))
{
$EmpNo = $row['employee_number'];
}
}
PDONewUser($EmpNo, $email, $client, $tempSess);
break;
default:
# code...
break;
}
ob_end_flush();
?>
I'm not thrilled with the state of my mssql_connect() code but I really don't know the alternative as the PDO drivers are extremely complicated and, from what I gather, experimental.
I salt my passwords (so I'm ahead of LinkedIn) but that's about it. I'm looking into measures to stop Brute force and XSS but I want to make sure this isn't completely broken first.
Is this secure? Is there a better way to be doing thing? OOP probably would be a smart move but I really do struggle with the concepts. I wrote my first line of HTML code in February of this year and had no real computer experience prior to that.
My Controller file currently points to 5 different cases (better than my old approach of five files point to different functions, which in turn was better than 5 files that didn't even have functions, they just ran procedural code and then redirected as necessary.) Is that bad coding?
Any suggestions would be great.
