Results 1 to 5 of 5
  1. #1
    Where is Metla these days Chilling_Silence's Avatar
    Join Date
    Dec 2004
    Location
    Auckland
    Posts
    17,146

    Question "Drop-in" PHP / MySQL Username / Password auth system?

    Hi all,

    I'm writing a website for myself, and right now I've written a username / pass system (I generate the users a "safe" pass and email it to them), except the problem I have is storing them in a way that's easily retrievable. Right now I don't have any form of database setup, so if a user forgets their password they have to email me to get it re-sent. I'd like a way for it to be re-sent online if possible.

    Similar to how there are drop-in CAPTCHA scripts, does anybody know if there's something out there like that which I can easily integrate? I basically just want a way of storing the Username / Pass / Email Address & Name (And possibly date registered) of the person in a database, then a way of sucking it back out again so I can send an email to their address with the username & password that they've forgotten.

    Thanks


    Chill.
    I mostly do Bitcoin & DigiByte things these days, feel free to say hi on Twitter: https://twitter.com/dgb_chilling

    Before you ask a question here, or before you get upset by a response, see here:
    http://www.catb.org/~esr/faqs/smart-...ons.html#intro

  2. #2
    Straight up Cynic
    Join Date
    Aug 2007
    Location
    Point England, Auckland
    Posts
    102

    Default Re: "Drop-in" PHP / MySQL Username / Password auth system?

    I wrote from scratch a password system, and a self reset system.

    Basically email address is login name. Password is stored in database in encrypted format. I use MD5 with a seed.

    If user forgets password then they enter email address and then a reset token is sent to the email address and the current password is reset. The reset token is stored in a table along with the internal user id (The Reset token is a string tacked on to the end of a url e.g. http://www.yourdomain.com/landingpag...settoken=token).

    The landing page then checks the token exists and then forces the user to enter a new password and verifies it.

    It may not be the most secure but it will do for my site.

    So that's basically it. There are plenty of classes and code samples out there if you don't want to formulate your own. Google can help you here.

  3. #3
    Where is Metla these days Chilling_Silence's Avatar
    Join Date
    Dec 2004
    Location
    Auckland
    Posts
    17,146

    Default Re: "Drop-in" PHP / MySQL Username / Password auth system?

    Only thing is my coding skills are pretty poor. I've got it tying in with poptop so first the submission script checks to make sure their username is "safe". Then it generates them a "safe" password that's not too long or has funky chars or anything that might break the config file that poptop uses for vpn auth.
    Ideally what I'm after is just a way of saving their username / pass / email, and then a single "query" that I can run to search for a persons address and then provide me with the password of that email address if the email is in the database, so I can then have it automatically email it back off.

    Again, not the most secure, but it'd work

    ..but yeah my main issue is I can't really code to save myself, I'm amazed I even managed to get it this far, but SQL is a bit beyond me at this point in time :-/
    I mostly do Bitcoin & DigiByte things these days, feel free to say hi on Twitter: https://twitter.com/dgb_chilling

    Before you ask a question here, or before you get upset by a response, see here:
    http://www.catb.org/~esr/faqs/smart-...ons.html#intro

  4. #4
    Straight up Cynic
    Join Date
    Aug 2007
    Location
    Point England, Auckland
    Posts
    102

    Default Re: "Drop-in" PHP / MySQL Username / Password auth system?

    I learnt at lot of my skills by looking at other code and just doing.

    One of thie things I have come to agree with is that it is better not to store the password in such a way that you can email them back to the user if they forget it.
    If you do then you have an issue if your database gets compromised in some way as all users details will be accessible. Remember users often use the same password for email, internet banking and so on.

    To me it appears that the generally accepted way of storing password is to encrypt them (MD5, SHA, etc) in the database and the the login process compares the users input with the stored encrypted password.

    psuedo PHP code would be something like

    $inputpassword = encryption method($_POST["password"]);
    $storedpassword = query database for password field where useremail = $_POST["email"];
    if (count(results in $storedpassword) == 1 && $inputpassword == $storedpassword) {
    //Username exists only once and input and stored passwords match
    //successful authentication process
    } elseif (count(results in $storedpassword) < 1) {
    //No such email address error process
    } elseif ($inputpassword != $storedpassword) {
    //Invalid password process
    }

    This is very a simplistic example and also assumes that only one instance of an email address is permitted and is used as the primary login id.

    I detailed the password reset process earlier.

  5. #5
    Where is Metla these days Chilling_Silence's Avatar
    Join Date
    Dec 2004
    Location
    Auckland
    Posts
    17,146

    Default Re: "Drop-in" PHP / MySQL Username / Password auth system?

    Ah but the login isn't to the website, it's through poptop (pptp vpn daemon).
    I'm not worried about users having each others passwords really, if it came down to it, as the system blocks international users and it's quite well locked down anyways in terms of ports allowed through it, traffic, originating IP's etc

    Unfortunately I don't see any other real way of doing it aside from storing them in the database, unless I do something like run each through a base64 converter or something that's reversible when I need to email out the password to the forgetful user?
    I mostly do Bitcoin & DigiByte things these days, feel free to say hi on Twitter: https://twitter.com/dgb_chilling

    Before you ask a question here, or before you get upset by a response, see here:
    http://www.catb.org/~esr/faqs/smart-...ons.html#intro

Similar Threads

  1. computer "housework"scheduler -wrong password
    By effie c in forum PressF1
    Replies: 9
    Last Post: 11-05-2008, 08:35 AM
  2. Replies: 5
    Last Post: 09-01-2008, 06:19 AM
  3. MYSQL "CREATE FUNCTION"
    By somebody in forum PressF1
    Replies: 9
    Last Post: 18-08-2007, 03:56 PM
  4. Replies: 10
    Last Post: 07-12-2006, 09:17 PM
  5. Solving a "Password Overload" problem
    By thing2b in forum PressF1
    Replies: 7
    Last Post: 01-11-2005, 04:51 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •