Re: Sometimes I wonder why I even started programming...

On Feb 28, 2008, at 11:28 AM, Eric Butera wrote:

On Wed, Feb 27, 2008 at 5:12 PM, Daniel Brown <parasane@gmail.com> wrote:

On Wed, Feb 27, 2008 at 4:55 PM, Jason Pruim <japruim@raoset.com> wrote:

So I was supposed to go home a half hour ago but that didn't happen... I hate deadlines! :P

You whine like a mule. [snip!]

       function authentication($user, $pass, $authenticated, $table){

                       // Keep in mind, PASSWORD has meaning in MySQL
                       // Do your string sanitizing here
                       // (e.g. - $user = mysql_real_escape_string($_POST['user']);)
                       $salt = "salt";
                       $salt1 = $salt;
                       $salt1 .= $pass;

                       $password = md5("$salt1");
                       $loginQuery = "SELECT * FROM current WHERE loginName='".$user."'

AND loginPassword='".$password."' LIMIT 0,1;";

                       $loginResult = mysql_query($loginQuery) or die("Wrong data supplied

or database error" .mysql_error());

                       while($row1 = mysql_fetch_array($loginResult)) {
                               $_SESSION['user'] = $row1['loginName'];
                               $_SESSION['loggedin'] = "YES";
                               $authenticated = "true";
                               $table = $row1['tableName'];

                       }
               return $table;
               return $authenticated;
       }       \

I recognize that code, Jason! At least the base of it (and the comments). ;-P See in the first block how you're using $_SESSION? That's why you're able to read it later.... because you have two return $xxx lines in each function. As soon as a function reaches a return statement, it returns that data and exits, so the second return is never processed. -- </Dan> Daniel P. Brown Senior Unix Geek <? while(1) { $me = $mind--; sleep(86400); } ?> -- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php

Guess all your posts stating to sanitize data just really don't have an impact, huh? Perhaps you should stop posting code that doesn't validate/escape as it will be copied and pasted as I've told you before.

The code for escaping and sanitizing the input is in a different module of the program. I actually do it right before sending it to my authentication function. I didn't see the need to post it since it wasn't related to the problem :) And the comments were from Mr. Brown who gave me the code originally that has now been adapted to use in a different program :)

-- Jason Pruim Raoset Inc. Technology Manager MQC Specialist 3251 132nd ave Holland, MI, 49424-9337 www.raoset.com japruim@raoset.com