I am not able to execute the below code .. i am not able to login

shekarsuhas · September 10, 2014, 5:13am

<?php
include ("config/connection.php");

if(isset($_POST['mode']) && $_POST['mode']=='login')
	{
		$uname=saveValue(trim($_POST['rtuname']));
		$passwd=saveValue(trim($_POST['rtpassword']));
		
		require_once "formvalidator.php";
		$validator = new FormValidator();
		$validator->addValidation("rtuname","req","Please enter Username!");
		$validator->addValidation("rtpassword","req","Please enter Password!");
		
		$error='';
		
		
		if($validator->ValidateForm())
		{
		
			
			$query="select * from employees where 03_username='".$uname."' and 03_password=password('".$passwd."') and 03_status='1' ";
			$result=mysql_query($query);
			$num=mysql_num_rows($result);
			if($num>0)
			{
				session_start();
				$info=mysql_fetch_array($result);
				session_register("EMPLOYEEID");
				session_register("EMPLOYEE_LOGIN");
				session_register("DEPTID");
				session_register("SUBDEPID");
				session_register("SUBSUBDEPID");
				session_register("EMPLOYEELEVEL");
				$_SESSION['EMPLOYEEID']=$info['03_employeeid'];
				$_SESSION['EMPLOYEE_LOGIN']=$info['03_employeetype'];
				$_SESSION['DEPTID']=$info['03_deptid'];
				$_SESSION['SUBDEPID']=$info['03_subdeptid'];
				$_SESSION['SUBSUBDEPID']=$info['03_subsubdeptid'];
				$_SESSION['EMPLOYEELEVEL']=$info['03_employeelevel'];

				
				
				
				
				if($_POST['pg']=="")
				{
					
					echo "<script>window.location='dashboard.php'</script>";
				}
				else
				{
					
					echo "<script>window.location='".saveValue($_POST['pg'])."'</script>";
				}
					
			
				
			}
			else
			{
				
				$_REQUEST['emsg']=1;
			}
		}
		else
		{
			$error_hash = $validator->GetErrors();
		
			foreach($error_hash as $inpname => $inp_err)
			{
				$error=$error.$inp_err."<br />";
			
			} 
			
		}
	}

?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title><?php echo $siteTitle;?> - Employee Login</title>
<script type='text/javascript' src='js/form.scripts.js'></script>
<script type='text/javascript' src='js/emailvalidate.js'></script>

<script language="javascript">

function validate()
{
	var formObj=Object(document.form1);
	if(onSubmitCheck(formObj))
	{
		var emailID=formObj.remail;
		if (echeck(emailID.value)==false){
		emailID.focus();
		return false;
		}
		return true;
	
	}else
	{
	
			return false;
	}
}
</script>
<link href="css/style.css" rel="stylesheet" type="text/css" />
</head>

<body onload="document.getElementById('rtuname').focus();">
<form name='form1' id='form1' action="checklogin.php" method='post' onsubmit="return validate();">
<input type='hidden' name='mode' id='mode' value='login' />
<input type='hidden' name='pg' id='pg' value='<?php echo @$_REQUEST['pg'];?>' />
<table width="1000" border="0" align="center" cellpadding="0" cellspacing="0">
  <tr align="center" valign="middle">
    <td>&nbsp;</td>
  </tr>
  <tr>
    <td align="center"><h1><?php echo $siteTitle;?></h1></td>
  </tr>
  <tr>
    <td>&nbsp;</td>
  </tr>
  <tr>
    <td>&nbsp;</td>
  </tr>
  <tr>
    <td align="center" valign="top"><font color="#FF0000"><?php if(isset($_REQUEST['emsg'])){echo "Either Username or Password is Incorrect!";} ?></font></td>
  </tr>
  <?php if(isset($_REQUEST['sexp']) && $_REQUEST['sexp']==1){?>
  <tr>
    <td align="center" class="error"><font color="#FF0000">You session has expired! Please login again.</font></td>
  </tr>
  <?php }?>
   <?php if(isset($error) && $error!=''){?>
    <tr>
    <td align="center" class="error"> 
           <?php echo @$error;?>
           </td>
            
  </tr>
  <?php }?>
  <tr><td>&nbsp;</td></tr>
  <tr>
    <td align="center" valign="middle"><table width="100%" border="0" cellspacing="0" cellpadding="0">
      <tr>
        <td>&nbsp;</td>
        <td align="center"><table width="80%" border="1" align="center" cellpadding="0" cellspacing="0" bordercolor="#DADADA">
            <tr>
              <td align="center"><table width="100%" border="0" cellpadding="0" cellspacing="0">
                  <tr align="left" valign="middle">
                    <td height="8" align="center" valign="middle" bgcolor="#F8F8F8"></td>
                  </tr>
                  <tr align="left" valign="middle">
                    <td height="38" align="center" valign="middle" bgcolor="#F8F8F8" class="pageHeadTxt"><strong>Employee Login </strong></td>
                  </tr>
                  <tr>
                    <td  align="center" valign="middle" bgcolor="#DADADA"  height="2" ></td>
                  </tr>
                  <tr>
                    <td align="center" valign="top"><table width="100%" border="0" cellspacing="0" cellpadding="0">
                        <tr>
                          <td width="36%" rowspan="8" align="center" valign="top" class="text1"><img src="images/admin.gif" alt="" /></td>
                          <td align="left" valign="top" class="text1"></td>
                          <td height="10" align="left" valign="top" class="text1"></td>
                          <td align="left" valign="top"></td>
                        </tr>
                        <tr>
                          <td width="3%" align="left" valign="top" class="text1">&nbsp;</td>
                          <td width="20%" align="left" valign="middle"><strong class="txtLabel12">Username</strong></td>
                          <td width="41%" align="left" valign="middle"><label>
                            <input name="rtuname" type="text" class="btntextbox" id="rtuname"  title="Username" size="40" maxlength="50"/>
                          </label></td>
                        </tr>
                        <tr>
                          <td align="left" valign="top" class="text1"></td>
                          <td align="left" valign="middle"></td>
                          <td height="8" align="left" valign="middle"></td>
                        </tr>
                        <tr>
                          <td align="left" valign="top" class="text1">&nbsp;</td>
                          <td align="left" valign="middle"><strong class="txtLabel12">Password</strong></td>
                          <td align="left" valign="middle"><input name="rtpassword" type="password" class="btntextbox" id="rtpassword"  title="Password" size="40" maxlength="50"/></td>
                        </tr>
                        <tr>
                          <td></td>
                          <td></td>
                          <td height="10" align="left" valign="top"></td>
                        </tr>
                        <tr>
                          <td>&nbsp;</td>
                          <td>&nbsp;</td>
                          <td align="left" valign="top"><label>
                            <input name="submit" type="submit" class="btn"  id="submit" value="    Login     " />
                          </label></td>
                        </tr>
                        <tr>
                          <td>&nbsp;</td>
                          <td>&nbsp;</td>
                          <td align="left" valign="top">&nbsp;</td>
                        </tr>
                        <tr>
                          <td>&nbsp;</td>
                          <td>&nbsp;</td>
                          <td align="left" valign="top"><a href="Mailto:LeaveManagement@novonordisk.com">Forgot Password</a></td>
                        </tr>
                    </table></td>
                  </tr>
                  <tr >
                    <td height="1" align="center" valign="top" ></td>
                  </tr>
              </table></td>
            </tr>
        </table></td>
        <td>&nbsp;</td>
      </tr>
    </table></td>
  </tr>
  <tr>
    <td align="center" valign="middle">&nbsp;</td>
  </tr>
  <tr>
    <td>&nbsp;</td>
  </tr>
</table>
</form>

PHP 5.6.0
mysql Ver 14.14 Distrib 5.6.20, for Linux (x86_64) using EditLine wrapper

Is there any changes required, kindly suggest

Br,
Suhas

pbsonawane · September 10, 2014, 5:35am

are you getting any error?

also session_register() is DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0.

click here to check

shekarsuhas · September 10, 2014, 5:42am

No error, Its “The website cannot display the page”

pbsonawane · September 10, 2014, 5:55am

display error setting may be disabled on server, so enable it check the link

write error_reporting(E_ALL); at the top of the page and check if you get any errors

also you need to replace session_register() function with $_SESSION[''], as session_register() will not support in your server PHP version

shekarsuhas · September 10, 2014, 5:58am

Thanks … i have removed the session_register() and it worked…

Thanks a ton…

SpacePhoenix · September 10, 2014, 6:48am

There’s a few things you need to consider with your code:

The mysql_* extension is deprecated and will likely be removed in the next version of php. You should be using either the mysqli_* extension or PDO
Your code is wide open to SQL injection as at the very least you should be escaping any user submitted data.
If it’s not already, all passwords should be stored in hashed form, never in plain text
You shouldn’t be using $_REQUEST, if the form data is being submitted via POST then you should use $_POST, if it’;s being passed via a URL you should use $_GET and if it’s coming from a cookie, you should use $_COOKIE
Make sure your site will be usable by someone who has got javascript disabled for whatever reason
With any SELECT query, don’t use the * selector, list in the SELECT clause, just the fields that you’re going to be making use of
When writing any query, try to make use of the leading comma convention and make use of indentation as it’ll make your queries easier to read

shekarsuhas · September 10, 2014, 6:54am

Thanks SpacePhoenix

felgall · September 10, 2014, 7:29pm

Since PHP 5.5 (and able to be added to 5,3) there are special functions for handling passwords to make sure they are stored in a safe manner.