Sign In
Register
Help
The aim was to write a script where you provide your username and password. And with a successfull login the $_SESSION var 'login' would be set. There was also the problem of bruteforce cracking which was taken care of by only allowing one try every 30 seconds and after 3 trys banning the ip for half an hour.
For that script i used PHP and mysql.
you can see the code at work here: http://bwl.cositel.com/login.php
the right username/password is: username/passwort
for the aboce script to work you need mysql.class.php (just rename the txt)
mysql.class.txt (3.4K)
Number of downloads: 162
<?
/* login.php - a hopefully "secure" login Script
Mysql tables we need :
1. ipdatenbank :
CREATE TABLE `ipdatenbank` (
`ip` VARCHAR( 15 ) NOT NULL ,
`count` TINYINT( 1 ) NOT NULL ,
`time` INT( 10 ) NOT NULL
);
2. benutzer :
CREATE TABLE `benutzer` (
`username` VARCHAR( 255 ) NOT NULL ,
`passwort` VARCHAR( 255 ) NOT NULL
);
255 is very high.
by Gotisch :)
*/
function check_ip($ip) {
global $DB;
$ip = mysql_escape_string($ip);
$ipcheck = $DB->query("SELECT count, time FROM `ipdatenbank` WHERE `ip`='$ip'");
if (mysql_num_rows($ipcheck) == 0)
{
$upd = $DB->query("INSERT INTO `ipdatenbank` (count, time, ip) VALUES ('1', UNIX_TIMESTAMP(), '$ip')");
return 0;
}
$array = mysql_fetch_array($ipcheck);
if ($array['count'] > 3)
{
if ($array['time'] + 1800 < time())
{
$upd = $DB->query("UPDATE `ipdatenbank` SET `count`='1', `time`=UNIX_TIMESTAMP() WHERE `ip`='$ip'");
return 0;
}
return "You have been blocked for 30 min.";
}
if ($array['time'] + 30 < time())
{
$upd = $DB->query("UPDATE `ipdatenbank` SET `count`=count+1, `time`=UNIX_TIMESTAMP() WHERE `ip`='$ip'");
return 0;
}
return "You have to wait 30sec.";
}
function check_user($username, $passwort) {
global $DB;
$username = mysql_escape_string($username);
$usercheck = $DB->query("SELECT passwort FROM `benutzer` WHERE `username`='$username'");
if (mysql_num_rows($usercheck) != '0')
{
$array = mysql_fetch_array($usercheck);
if ($array['passwort'] == $passwort)
{
return 0;
}
}
return "This Username/Password is not OK.";
}
/* username and pass where given.*/
$login = "Please Enter your Username and Password";
if ($_POST['username'] && $_POST['passwort'])
{
//connect to database.
require("mysql.class.php");
$DB=new FM_SQL_CLASS;
$DB->server="localhost";
$DB->dbname="yourdb";
$DB->username="yourusername";
$DB->password="yourpass";
$DB->connect();
$login = check_ip($_SERVER['REMOTE_ADDR']);
if ($login == '0')
{
$login = check_user($_POST['username'], $_POST['passwort']);
if ($login == '0')
{
$_SESSION['login'] = true;
$login = "You are now Logged in";
}
}
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title><? echo $login; ?></title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
</head>
<body>
<?
if($_SESSION['login'])
{
echo "You are now loggin in and login is set to true;)";
} else {
echo $login; ?>
<br />
<form name="form1" id="form1" method="post" action="<? echo $_SERVER['PHP_SELF']; ?>">
<input type="text" name="username" />
<input type="password" name="passwort" />
<input type="submit" name="Submit" value="Einloggen" />
</form>
<?
}
?>
</body>
</html>Any suggestions bugs / comments are highly welcome.
MultiQuote
