DaniWeb Forum Index > Web Development > PHP

Simple Login System: Need Advice.

Please support our PHP advertiser: PostgreSQL or MySQL? Compare and contrast the two most popular open source databases

Thread Solved

•

Join Date: May 2008

Posts: 110

Reputation: antwan1986 is an unknown quantity at this point

Solved Threads: 8

antwan1986 antwan1986 is offline

Offline

Junior Poster

Simple Login System: Need Advice.

Jun 1st, 2008

Hey everyone, I'm making a login system (in an attempt to advance my PHP knowledge). I've successfully made a system which registers the user (and uses md5 on their password), and also a login page which queries the database on the login info they supply (with the supplied password also being run through md5 so it matches the database).

My problem is this: What if someone forgets their password? md5 is (from what I've read) irreversible so my only option would be to reset the password right? If so then is this a logical step by step process?

1) Generate a random code and store it to that users record (meaning I'll need another field called deletion_code or something right?)
2) Email them the code
3) They'll go to a deletion confirmation page where they paste the code and their new password, and submit.
4) The password will be md5'd and updated. The deletion_code field of that users record will be blanked.

Any feedback would be much appreciated. I also have one other problem. Currently the unique ID of the members table is ID but should I change that to email? It seems more relevant, or can I have two primary keys?

Also if someone attempts to register an email already in the database, what is the error that comes back and how can I catch it? (for example in file uploads if the file size is too big, the 'error' attribute comes back with a value of 2).

Thanks for any help at all guys,

Anthony

"Beneath this mask there is more than flesh. Beneath this mask there is an idea, Mr. Creedy, and ideas are bulletproof." - V

•

Join Date: Dec 2007

Posts: 252

Reputation: ProfessorPC is an unknown quantity at this point

Solved Threads: 27

ProfessorPC ProfessorPC is offline

Offline

Posting Whiz in Training

Re: Simple Login System: Need Advice.

Jun 1st, 2008

Sounds like you got it right. I had ran into the same problem. I had created the random password and inserted that into the db as their password. Sent them a link including and identifier (reset.php?indent=12345). When the user clicks on this link they will go to the reset page. Here they need to enter their new password that was in the email, enter new password and confirm. This replaced the random password with the password of their choice.
I use and id as the primarykey auto incremented. This way its always unique. I think its easier to reference other tables as well.
Looks like your on the right track...

•

Join Date: Dec 2007

Posts: 252

Reputation: ProfessorPC is an unknown quantity at this point

Solved Threads: 27

ProfessorPC ProfessorPC is offline

Offline

Posting Whiz in Training

Re: Simple Login System: Need Advice.

Jun 1st, 2008

Missed your email question. I have used this in the past.

 Help with Code Tags 
 php Syntax (Toggle Plain Text) 
$emailcheck = $_POST['email'];
$check = mysql_query("SELECT email FROM users WHERE email = '$emailcheck'")
or die(mysql_error());
$check2 = mysql_num_rows($check);
 
//if the email exists it gives an error
if ($check2 != 0) {
die('Sorry, the email '.$_POST['email'].' is already in use.');
}
$emailcheck = $_POST['email'];
$check = mysql_query("SELECT email FROM users WHERE email = '$emailcheck'")
or die(mysql_error());
$check2 = mysql_num_rows($check);

//if the email exists it gives an error
if ($check2 != 0) {
die('Sorry, the email '.$_POST['email'].' is already in use.');
}

Hope this helps.

Last edited by ProfessorPC; Jun 1st, 2008 at 3:38 pm.

•

Join Date: Jan 2008

Posts: 74

Reputation: Vai is an unknown quantity at this point

Solved Threads: 5

Vai

Offline

Junior Poster in Training

Re: Simple Login System: Need Advice.

Jun 1st, 2008

Here is another way to create your table...

 Help with Code Tags 
 php Syntax (Toggle Plain Text) 
CREATE TABLE `users` (
  `ID` int(11) NOT NULL auto_increment,
  `Username` varchar(255) NOT NULL default '',
  `Password` varchar(255) NOT NULL default '',
  `date_registered` int(11) NOT NULL default '0',
  `Temp_pass` varchar(55) default NULL,
  `Temp_pass_active` tinyint(1) NOT NULL default '0',
  `Email` varchar(255) NOT NULL default '',
  `Active` int(11) NOT NULL default '0',
  `Level_access` int(11) NOT NULL default '2',
  `Random_key` varchar(32) default NULL,
  PRIMARY KEY  (`ID`),
  UNIQUE KEY `Username` (`Username`),
  UNIQUE KEY `Email` (`Email`)
) ENGINE=MyISAM ;
CREATE TABLE `users` (
  `ID` int(11) NOT NULL auto_increment,
  `Username` varchar(255) NOT NULL default '',
  `Password` varchar(255) NOT NULL default '',
  `date_registered` int(11) NOT NULL default '0',
  `Temp_pass` varchar(55) default NULL,
  `Temp_pass_active` tinyint(1) NOT NULL default '0',
  `Email` varchar(255) NOT NULL default '',
  `Active` int(11) NOT NULL default '0',
  `Level_access` int(11) NOT NULL default '2',
  `Random_key` varchar(32) default NULL,
  PRIMARY KEY  (`ID`),
  UNIQUE KEY `Username` (`Username`),
  UNIQUE KEY `Email` (`Email`)
) ENGINE=MyISAM ;

•

Join Date: May 2008

Posts: 110

Reputation: antwan1986 is an unknown quantity at this point

Solved Threads: 8

antwan1986 antwan1986 is offline

Offline

Junior Poster

Re: Simple Login System: Need Advice.

Jun 4th, 2008

Hey to the both of you and sorry for my late reply but I am just back for a short holiday.

ProfessorPC: I tried your suggestion about the unique email error handler and it works fine, thanks a lot for that one. Also, thanks for the insight into your own resetting password journey!

Vai: Thank you for your suggestion on how I could create my table. I have used the date_registered idea so that I can judge how long a user has been registered but inactive. Is there any way I could write a script that checks to see the date, and if it's more then seven days, it will automatically purge that registration from the database?

"Beneath this mask there is more than flesh. Beneath this mask there is an idea, Mr. Creedy, and ideas are bulletproof." - V