Re: Get/Post and Security Issues [UPDATE]

I've solved the problem. url_rewriter.tags = "" Once I uncommented this and emptied the string out, everything worked fine. "Brian Graham" <croakingfrog@hotmail.com> wrote in message news:20020624072756.44947.qmail@pb1.pair.com... > Apache 1.3.26 > PHP 4.2.1 > > When I enter username and password information onto a page, it uses Get and > puts the session ID along with the username and the password into the URL, > despite my saying "method=post" in the form attributes. > > This seems like it would be a common problem, but my research isn't bringing > up anything even remotely about it. > > I've done very, very little tweaking to my php.ini and httpd.conf to give > you an idea of what defaults are in place still. Here is the function code: > > function user_login() { > global $usern; > global $userp; > global $feedback; > global $loginswitch; > if (!isSet($usern) && !isSet($userp)) > return FALSE; > if ($usern == '' or $userp == '') { > $loginswitch = FALSE; > $feedback = "Username and/or password is missing."; > return FALSE; > } > $uname = strtolower($usern); > $query = "SELECT user_name, user_pass, user_isconfirmed > FROM user > WHERE user_name = '$usern' > AND user_pass = '$userp'"; > $results = mysql_query($query) or die(mysql_error()); > $row = mysql_fetch_row($results); > if ($usern == $row[0] && $userp == $row[1]) { > $_SESSION['loginswitch'] = TRUE; > $_SESSION['username'] = $usern; > $feedback = "You are now logged in."; > return TRUE; > } > else { > $_SESSION['loginswitch'] = FALSE; > $feedback = "Username of password are incorrect."; > return FALSE; > } > } > > > > > >