-1
Good afternoon guys, I am taking a course of a real estate portal system in PHP that I bought and I I stopped at the time to make the portal login system. The course uses PHP below version 5 and the instructor uses the automatic feature of generating login scripts in msql of Dreamweaver, I’ve been reading that this feature of Dreamweaver does not work very well. My PHP is 7.0 so I had to adapt the mysql connection code to PDO by picking up a ready login connection code and register from a trusted website. The connection to the database I think worked, but did not authorize the user to enter the other page when validating the correct password that is already in the user row of the database table. PHP accuses error 403 of access forbidden, I also noticed that it also accuses the following error together in the URL of broswer 20%20Undefined%20variable:%20loginFormAction%20in%20"
I have tried everything to fix this error, already configured apache and changed all ports of xampp, and still prohibiting access. I don’t know if in PHP you have to give some sort of permission in the script folders. The funny thing is that when I test the ready registration and login code separately in xampp it authorizes access and goes to the other page normally, without any error, wanted to know what has to be done to authorize access.
The login code that the instructor asks to develop is not carried out first the sign-up panel to register the user’s password and email, it already puts the data directly in a separate line of the table of the database without going through the registration as a test. In the course is developed only the panel and the login script, I do not know if that is why you are prohibiting access with error 403, because when I test separately the script I caught ready with the registration and login it works without any error.
I have also tried to create a new user in phpmyadmin with all privileges and nothing. Follow the script code:
Error image:
I believe this is the error login action class on line 20, but I am using Visual Studio Code does not show any error on line 20 and in any project file. I don’t know if with the plugin PHP tools in the visual studio community would show any error. Follow the class below:
<?php
/**
* Class login
* handles the user's login and logout process
*/
class Login
{
/**
* @var object The database connection
*/
private $db_connection = null;
/**
* @var array Collection of error messages
*/
public $errors = array();
/**
* @var array Collection of success / neutral messages
*/
public $messages = array();
/**
* the function "__construct()" automatically starts whenever an object of this class is created,
* you know, when you do "$login = new Login();"
*/
public function __construct()
{
// create/read session, absolutely necessary
session_start();
// check the possible login actions:
// if user tried to log out (happen when user clicks logout button)
if (isset($_GET["logout"])) {
$this->doLogout();
}
// login via post data (if user just submitted a login form)
elseif (isset($_POST["login"])) {
$this->dologinWithPostData();
}
}
/**
* log in with post data
*/
private function dologinWithPostData()
{
// check login form contents
if (empty($_POST['nome'])) {
$this->errors[] = "Username field was empty.";
} elseif (empty($_POST['senha'])) {
$this->errors[] = "Password field was empty.";
} elseif (!empty($_POST['nome']) && !empty($_POST['senha'])) {
// create a database connection, using the constants from config/db.php (which we loaded in index.php)
$this->db_connection = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
// change character set to utf8 and check it
if (!$this->db_connection->set_charset("utf8")) {
$this->errors[] = $this->db_connection->error;
}
// if no connection errors (= working database connection)
if (!$this->db_connection->connect_errno) {
// escape the POST stuff
$user_name = $this->db_connection->real_escape_string($_POST['nome']);
// database query, getting all the info of the selected user (allows login via email address in the
// username field)
$sql = "SELECT nome, email, senha
FROM freitas_clientes
WHERE nome = '" . $user_name . "' OR email = '" . $user_name . "';";
$result_of_login_check = $this->db_connection->query($sql);
// if this user exists
if ($result_of_login_check->num_rows == 1) {
// get result row (as an object)
$result_row = $result_of_login_check->fetch_object();
// using PHP 5.5's password_verify() function to check if the provided password fits
// the hash of that user's password
if (password_verify($_POST['senha'], $result_row->user_password_hash)) {
// write user data into PHP SESSION (a file on your server)
$_SESSION['nome'] = $result_row->user_name;
$_SESSION['email'] = $result_row->user_email;
$_SESSION['user_login_status'] = 1;
} else {
$this->errors[] = "Wrong password. Try again.";
}
} else {
$this->errors[] = "This user does not exist.";
}
} else {
$this->errors[] = "Database connection problem.";
}
}
}
/**
* perform the logout
*/
public function doLogout()
{
// delete the session of the user
$_SESSION = array();
session_destroy();
// return a little feeedback message
$this->messages[] = "You have been logged out.";
}
/**
* simply return the current state of the user's login
* @return boolean user's login status
*/
public function isUserLoggedIn()
{
if (isset($_SESSION['user_login_status']) AND $_SESSION['user_login_status'] == 1) {
return true;
}
// default return
return false;
}
}index.php file:
<?php
/**
* A simple, clean and secure PHP Login Script / MINIMAL VERSION
*
* Uses PHP SESSIONS, modern password-hashing and salting and gives the basic functions a proper login system needs.
*
* @author Panique
* @link https://github.com/panique/php-login-minimal/
* @license http://opensource.org/licenses/MIT MIT License
*/
// checking for minimum PHP version
if (version_compare(PHP_VERSION, '5.3.7', '<')) {
exit("Sorry, Simple PHP Login does not run on a PHP version smaller than 5.3.7 !");
} else if (version_compare(PHP_VERSION, '5.5.0', '<')) {
// if you are using PHP 5.3 or PHP 5.4 you have to include the password_api_compatibility_library.php
// (this library adds the PHP 5.5 password hashing functions to older versions of PHP)
require_once("libraries/password_compatibility_library.php");
}
// include the configs / constants for the database connection
require_once("config/db.php");
// load the login class
require_once("classes/Login.php");
// create a login object. when this object is created, it will do all login/logout stuff automatically
// so this single line handles the entire login process. in consequence, you can simply ...
$login = new Login();
// ... ask if we are logged in here:
if ($login->isUserLoggedIn() == true) {
// the user is logged in. you can do whatever you want here.
// for demonstration purposes, we simply show the "you are logged in" view.
include("views/logged_in.php");
} else {
// the user is not logged in. you can do whatever you want here.
// for demonstration purposes, we simply show the "you are not logged in" view.
include("views/not_logged_in.php");
}Login view
<?php
// show potential errors / feedback (from registration object)
if (isset($registration)) {
if ($registration->errors) {
foreach ($registration->errors as $error) {
echo $error;
}
}
if ($registration->messages) {
foreach ($registration->messages as $message) {
echo $message;
}
}
}
?>
<!-- register form -->
<form method="post" action="register.php" name="registerform">
<!-- the user name input field uses a HTML5 pattern check -->
<label for="login_input_username">Username (only letters and numbers, 2 to 64 characters)</label>
<input id="login_input_username" class="login_input" type="text" pattern="[a-zA-Z0-9]{2,64}" name="user_name" required />
<!-- the email input field uses a HTML5 email type check -->
<label for="login_input_email">User's email</label>
<input id="login_input_email" class="login_input" type="email" name="user_email" required />
<label for="login_input_password_new">Password (min. 6 characters)</label>
<input id="login_input_password_new" class="login_input" type="password" name="user_password_new" pattern=".{6,}" required autocomplete="off" />
<label for="login_input_password_repeat">Repeat password</label>
<input id="login_input_password_repeat" class="login_input" type="password" name="user_password_repeat" pattern=".{6,}" required autocomplete="off" />
<input type="submit" name="register" value="Register" />
</form>
<!-- backlink -->
<a href="index.php">Back to Login Page</a>Connection and reading class with mysql
<?php
/**
* Class login
* handles the user's login and logout process
*/
class Login
{
/**
* @var object The database connection
*/
private $db_connection = null;
/**
* @var array Collection of error messages
*/
public $errors = array();
/**
* @var array Collection of success / neutral messages
*/
public $messages = array();
/**
* the function "__construct()" automatically starts whenever an object of this class is created,
* you know, when you do "$login = new Login();"
*/
public function __construct()
{
// create/read session, absolutely necessary
session_start();
// check the possible login actions:
// if user tried to log out (happen when user clicks logout button)
if (isset($_GET["logout"])) {
$this->doLogout();
}
// login via post data (if user just submitted a login form)
elseif (isset($_POST["login"])) {
$this->dologinWithPostData();
}
}
/**
* log in with post data
*/
private function dologinWithPostData()
{
// check login form contents
if (empty($_POST['nome'])) {
$this->errors[] = "Username field was empty.";
} elseif (empty($_POST['senha'])) {
$this->errors[] = "Password field was empty.";
} elseif (!empty($_POST['nome']) && !empty($_POST['senha'])) {
// create a database connection, using the constants from config/db.php (which we loaded in index.php)
$this->db_connection = new mysqli(DB_HOST, DB_USER, DB_PASS, DB_NAME);
// change character set to utf8 and check it
if (!$this->db_connection->set_charset("utf8")) {
$this->errors[] = $this->db_connection->error;
}
// if no connection errors (= working database connection)
if (!$this->db_connection->connect_errno) {
// escape the POST stuff
$user_name = $this->db_connection->real_escape_string($_POST['nome']);
// database query, getting all the info of the selected user (allows login via email address in the
// username field)
$sql = "SELECT nome, email, senha
FROM freitas_clientes
WHERE nome = '" . $user_name . "' OR email = '" . $user_name . "';";
$result_of_login_check = $this->db_connection->query($sql);
// if this user exists
if ($result_of_login_check->num_rows == 1) {
// get result row (as an object)
$result_row = $result_of_login_check->fetch_object();
// using PHP 5.5's password_verify() function to check if the provided password fits
// the hash of that user's password
if (password_verify($_POST['senha'], $result_row->user_password_hash)) {
// write user data into PHP SESSION (a file on your server)
$_SESSION['nome'] = $result_row->user_name;
$_SESSION['email'] = $result_row->user_email;
$_SESSION['user_login_status'] = 1;
} else {
$this->errors[] = "Wrong password. Try again.";
}
} else {
$this->errors[] = "This user does not exist.";
}
} else {
$this->errors[] = "Database connection problem.";
}
}
}
/**
* perform the logout
*/
public function doLogout()
{
// delete the session of the user
$_SESSION = array();
session_destroy();
// return a little feeedback message
$this->messages[] = "You have been logged out.";
}
/**
* simply return the current state of the user's login
* @return boolean user's login status
*/
public function isUserLoggedIn()
{
if (isset($_SESSION['user_login_status']) AND $_SESSION['user_login_status'] == 1) {
return true;
}
// default return
return false;
}
}Connection file
<?php
/**
* Configuration for: Database Connection
*
* For more information about constants please @see http://php.net/manual/en/function.define.php
* If you want to know why we use "define" instead of "const" @see http://stackoverflow.com/q/2447791/1114320
*
* DB_HOST: database host, usually it's "127.0.0.1" or "localhost", some servers also need port info
* DB_NAME: name of the database. please note: database and database table are not the same thing
* DB_USER: user for your database. the user needs to have rights for SELECT, UPDATE, DELETE and INSERT.
* DB_PASS: the password of the above user
*/
define("DB_HOST", "localhost");
define("DB_NAME", "imobi");
define("DB_USER", "root");
define("DB_PASS", "");I thank anyone who can help me.
There is a problem in your view
not_logged_in.phpand the key to fixing this is in the rest of the URL of the 403 error page. I see that there is an undefined variable calledloginFormActionthat you are using innot_logged_in.php, but receives no value.– StillBuggin
What @Stillbuggin said is correct. However, this 403 error is usually configured in the HTACCESS file. The URL is probably not passing the credentials imposed by the file. If you delete HTACCESS temporarily, this error will probably disappear
– Andrei Coelho