PHP login password salting not allowing new users to login

Question

Have an issue with my login script - users register or I can add on my admin panel but when they go to login they are advised their username/email or password is incorrect - I know neither is but there is a salt password hash in place.

<?php

// login_process.php

// LOGIN RESPONSES 
//
// 1    Login successful
// 0    ...
// -1   Database error
// -2   Data fields empty
// -3   Username/email address not registered
// -4   Password incorrect
// -5   
//

include_once("check_login_status.php");
// If user is already logged in, just update page
if($user_ok == true){
    header("location: index.php");
    exit();
}

// AJAX CALLS THIS LOGIN CODE TO EXECUTE
if(isset($_POST["e"])){
    // CONNECT TO DATABASE
    include_once("db_conx.php");
    // GATHER THE POSTED DATA INTO LOCAL VARIABLES AND SANITIZE
    $e = mysqli_real_escape_string($mysqli, $_POST["e"]);
    $p = $_POST["p"];
    // GET USER IP ADDRESS
    $ip = preg_replace('#[^0-9.]#', '', getenv('REMOTE_ADDR'));
    // FORM DARA ERROR HANDLING
    if($e == "" || $p == ""){
        echo -2;
        exit();
    } else {
        // END FORM DATA ERROR HANDLING
        $sql = "SELECT mem_id, mem_username, mem_pwd, mem_salt, mem_active, mem_level FROM smd_members WHERE (mem_email='$e' OR mem_username='$e') AND mem_active=1 LIMIT 1";
        $query = mysqli_query($mysqli, $sql);
        if(mysqli_errno($mysqli)){
            echo -1;
            exit();
        }
        if(mysqli_num_rows($query) == 0){
            echo -3;
            exit();
        }
        $row = mysqli_fetch_row($query);
        $db_id = $row[0];
        $db_username = $row[1];
        $db_pass_str = $row[2];
        $db_pass_salt = $row[3];
        $db_active = $row[4];
        $db_level = $row[5];    

        $salt_complete = '$2y$14$'.$db_pass_salt;       

        // encrypt password with salt
        $crypt = crypt($p, $salt_complete);

        if($db_active == 0){
            header("location: ../reactivate.php?u=".$db_id);
        }


        if($crypt != $db_pass_str){
            echo -4;
            exit();
        } else {
            // CREATE THEIR SESSIONS AND COOKIES
            $_SESSION['userid'] = $db_id;
            $_SESSION['username'] = $db_username;
            $_SESSION['password'] = $db_pass_str;
            $_SESSION['level'] = $db_level;
            setcookie("id", $db_id, strtotime('+30 days'), "/", "", "", TRUE);
            setcookie("user", $db_username, strtotime('+30 days'), "/", "", "", TRUE);
            setcookie("pass", $db_pass_str, strtotime('+30 days'), "/", "", "", TRUE);
            setcookie("level", $db_level, strtotime('+30 days'), "/", "", "", TRUE);
            // UPDATE THEIR "IP" AND "LASTLOGIN" FIELDS
            $sql = "UPDATE smd_members SET mem_lastip='$ip', mem_lastlogin=now() WHERE mem_username='$db_username' LIMIT 1";
            $query = mysqli_query($mysqli, $sql);
            echo 1;
            exit();
        }
    }
    exit();
}
?>

is `$db_pass_str` already cryped? And before it is crypted when registering do you prepend `'$2y$14$'` ? — Akshay Kalose, Mar 17 '14 at 00:05
No - all I do is register the user and provide them with a password as normal. — user3328557, Mar 17 '14 at 00:09
Then - `if($crypt != $db_pass_str)` make sure you crypt the pass_str. Although I'm not sure why it isn't already crypted. — Akshay Kalose, Mar 17 '14 at 00:10
I am a little confused where this is failing - would you care to take a look? — user3328557, Mar 17 '14 at 00:11
Which question was your no to? Also, do you provide them a random password or they register their password? — Akshay Kalose, Mar 17 '14 at 00:12
I have just added the files to a test sub domain http://play.iamdanbarrett.com/login.php — user3328557, Mar 17 '14 at 00:24
Hmm. echo out the values for `$crypt` and `$db_pass_str`. Have you tried debugging this? — Akshay Kalose, Mar 17 '14 at 00:26
I have and there is nothign obviously telling me what the issue is — user3328557, Mar 17 '14 at 00:26
Don't build your own login system if you have no idea what you are doing. This makes absolutly no sense. — Sliq, Mar 17 '14 at 00:29
@Panique why should I not? I have made this amount of progress I am just having soe issues with it not allowing the user to login...I feel that comment was a little unfair no? — user3328557, Mar 17 '14 at 00:30
Compare salts and passwords i guess is all you can do. Just try echo'ing everything to debug. — Akshay Kalose, Mar 17 '14 at 00:31
@user3328557 btw, you salt generating method is very unsecure. Try using `openssl_random_pseudo_bytes()` it is cryptographically secure. — Akshay Kalose, Mar 17 '14 at 00:32
@Akshay2598 - Ok that certainly isnt something I was aware of? May you advise why it is so unsecure? — user3328557, Mar 17 '14 at 00:33
@user3328557 if you are using >PHP 5.5 there are new function `password_hash()` and `password_verify()` which are secure and easy. i am using them in my project. :) — Akshay Kalose, Mar 17 '14 at 00:34
@Akshay2598 - Oh wow excellent - I am so stuck all I want to do is allow my users to login so I can continue with my project :( — user3328557, Mar 17 '14 at 00:35
@user3328557 Yup, try using these new built in functions. :) — Akshay Kalose, Mar 17 '14 at 00:36
@Akshay2598 do you have a messaging system away from here we could chat? — user3328557, Mar 17 '14 at 00:38
@user3328557 Use the documentation, it helps. Good luck, I'm busy usually. ;). — Akshay Kalose, Mar 17 '14 at 00:40
@user3328557 Because you reinvent the wheel for the 10.000th time. And yours is seriously broken. This makes no sense. — Sliq, Mar 17 '14 at 09:39
This code is vulnerable to SQL injections. I would really recommend using PDO with prepared statements for your queries. See http://stackoverflow.com/a/11418291/487075 for examples — CountMurphy, Apr 09 '14 at 18:33

score 0 · Answer 1 · answered Mar 17 '14 at 00:18

<?php

// signup_process.php

if(!isset($_POST["e"])){
    // user has got here incorrectly
    // redirect back to index.php (TODO...)
    echo -10;
    exit();
}

include_once("db_conx.php");
// get all varibles and make them db safe
$f = mysqli_real_escape_string($mysqli, $_POST["f"]);
$l = mysqli_real_escape_string($mysqli, $_POST["l"]);
$e = mysqli_real_escape_string($mysqli, $_POST["e"]);
$p = $_POST["p"];
$u = mysqli_real_escape_string($mysqli, $_POST["u"]);
$a = $_POST["a"];
$id; // temp holder for later


// first check username or email is not used
$query = "SELECT mem_id FROM smd_members WHERE mem_username = '$u' OR mem_email = '$e'";
$result = mysqli_query($mysqli, $query);
if(mysqli_errno($mysqli)){
    // error with db
    error_log("E: ".$_SERVER['REQUEST_TIME']." ".__FILE__." ".__LINE__." Database error - ".mysqli_error($mysqli)."\n",0);
    echo 0;
    exit();
}
elseif(mysqli_num_rows($result)){
    // username or email address already used
    echo -1;
    exit();
}

// crypt password with random salt using Blowfish
// create salt
$salt = "";
$salt_chars = array_merge(range('A','Z'), range('a','z'), range(0,9));
for($i = 0; $i < 22; $i++){
    $salt .= $salt_chars[array_rand($salt_chars)];
}
$salt_complete = '$2y$14$'.$salt;

// encrypt password with salt
$crypt = crypt($p, $salt_complete);

// get user ip
$ip = $_SERVER['REMOTE_ADDR'];

$query = "INSERT INTO smd_members (mem_username, mem_firstname, mem_lastname, mem_email, mem_pwd, mem_salt, mem_signedup, mem_lastlogin, mem_signupip, mem_lastip, mem_avatarid, mem_active, mem_level) VALUES ('$u', '$f', '$l', '$e', '$crypt', '$salt', NOW(), NOW(), '$ip', '$ip', 0, 1, ".intval($a).")";

mysqli_query($mysqli, $query);
if(mysqli_errno($mysqli)){
    // error with db
    error_log("E: ".$_SERVER['REQUEST_TIME']." ".__FILE__." ".__LINE__." Database error - ".mysqli_error($mysqli)."\n",0);
    echo 0;
    exit();
}
else{
    $id = mysqli_insert_id($mysqli);
}

// now create login session and cookie. COOKIES!!!

// if all good, send ok message
echo $id;
exit();
?>

PHP login password salting not allowing new users to login

1 Answers1