Login Script

[ironside]

Hi, I can't seem to get my login script to work properly. The user name and password are referenced against a mysql database. If the credentials are correct the user gets forwarded to another page. If not, a error message is displayed.

Verifying the username works fine, but verifying the password does not. Attached is the code. Any help would be much appreciated. Thanks.

if ($ENV{REQUEST_METHOD} eq "GET")
{
    &header();
    &dsp();
}
else
{
    &header();
    &verify_form();
    &logged_in();
}    


#Print Header   

sub header {

    $cgi_object=new CGI;
    print $cgi_object->header('text/html');
}


#Verify Form 

sub verify_form {

    $missing = 0;
    ###   Get form values   ###    
    foreach ($cgi_object->param()) 
    {
        $form{$_} = $cgi_object->param($_);
        
        $uname = $form{user_name};
        $pword = $form{pass_word};
    
        if ($form{$_} eq "")
        {
            $missing = 1;
            $error="Incorrect Username and/or Password";
        }
        
        $select = qq~select user,pass from users where user = '$uname'
+~;
        $dbh=DBI->connect($connectionInfo,$user,$passwd);
        $sth=$dbh->prepare($select);
        $sth->execute();

        if (@row = $sth->fetchrow_array())
        {
            
            if ($row[1] ne $pword)
            {
                $error="Incorrect Password";
                $missing = 1;
            }
        }
    }
    if ($missing == 1)
    {
        &dsp();
        exit;
    }
}

[Corion]

How does verifying the password fail? Have you logged the values that you get for $pword and from the database?

Also, why are you looping over $cgi_object->param() and checking the password inside that loop every time? Is that maybe your error?

[scorpio17]

The code where you retrieve your form parameters should like something like this:

my $user_name = $cgi_object->param('user_name'} || '';
my $passwd = $cgi_object->param('passwd') || '';
unless ($user_name && $passwd) {
# handle cgi param error
}

The database query needs to use a placeholder, and check for errors - something like this:

eval {
  $sth = $dbh->prepare("select pass from users where user=?");
  $sth->execute($user_name);
};
if ($@) {
# handle database error
}

Since HTML is stateless, you need to use something like CGI::Session to remember that a particular user is logged in.

Using a framework will make your life much easier. Here's a link to a simple login tutorial I wrote:
RFC: Proposed tutorial - simple login script using CGI::Application

That should help get you started.

[ironside]

That's a big help. Thank you.