Error: "Use of undefined constant" Help!

[nathanpacker]

    Administrator Login

LoginUsername: Password:

Can't remember your password?

[stymiee]

Try adding quotes"

setcookie("ID_my_site", $_POST['username'], $hour);

setcookie("Key_my_site", $_POST['pass'], $hour);

[nathanpacker]

Thanks. That seemed to do the trick. I'm confused then as to why it broke all of the sudden, when it was working before without the quotes. Perhaps a user was created that had a space in the password or something? Curious.

[stymiee]

That is a good question. Might be a configuration change on the server as well.

[devdan]

Thanks. That seemed to do the trick. I'm confused then as to why it broke all of the sudden, when it was working before without the quotes. Perhaps a user was created that had a space in the password or something? Curious.

Just a comment on the code structure.

Your code as it is could be prone to hacking.

You should escape any values passed to a query with sqlesc or any1 who is that way inclined could hack your login script and bypass the login process. by manipulating either cookie information or the POST values.

You should also sanitise your POST and the variables they use also.

The following lines are HIGHLY unsafe and need sorting.

[php]
$check = mysql_query("SELECT * FROM mytable WHERE username = '$username'")or die(mysql_error())

$check = mysql_query("SELECT * FROM mytable WHERE username = '".$_POST['username']."'")or die(mysql_error());
[/php]

I recommend reading up on php and database security and go through all your code checking for things like the above. Its better to be safe than sorry as they say

[nathanpacker]

Thanks for the tips, but it's taken a lot of reading up on PHP just to get scripts like this to work. I'm a long way from making my scripts totally secure. Just getting them to work is a bonus for me. I promise I'll look into security later on. Besides, none of the scripts I write are business critical or anything, they're all just personal stuff.

[leelee]

Mission critical or not, it's actually possible to delete your entire database with one carefully formed query.

Unless you want to lose all your hard work it might be an idea to read up, as Devdan mentioned. It's not a big job, at all.

[codezilla]

quotes works for me too ! ! ! ! THANKS!!!!!!

[daydah]

Quotes did the trick! Thanks guys! You rock!

[patmaherjfm]

I know this is a old thread but their is a receint post..

I suspect the reason you find the site breaks for no reson, is that php has been updated, Newer versions are trying to prevent you from using unsecure code.

Their are really easy things you can do to fix the security problems shown here, as stated, the script shown here would indeed alow any of us telling you its unsafe to mess with youre data base, steal / destroy your data, and bypass the log in.

BTW: the quotes worked for me too :)

Regards Pat.

[fasins]

Hello am new too daniweb much more php coding but this 'quotes' thing worked for me too!! thanks guys.

[Art_95148]

Yaaap. The quote works. Now, I'm ready to venture further into the world of PHP and MYsql. Thanks a lot,guys - Art