Can't log in with PHP form, but no error shown; fields cleared

Question

I'm starting to wonder if the Oreily publishing house has severely lowered its standards or something. I'm not even going to go into the first two PHP books I got from them, but this third one seems pretty messed up too.

In any case, here is the issue. In the project from the book I'm working on, the book says to create a user database and then create a program based on that database that allows a user to log in. Here is the code that supposedly accomplishes this:

Create user database:

    <?php //setupusers.php
    require_once 'login.php';
    $db_server = mysql_connect($db_hostname, $db_username, $db_password);
    if (!$db_server) die("Unable to connect to MySQL: " . mysql_error());
    mysql_select_db($db_database)
        or die("Unable to select database: " . mysql_error());

    $query = "CREATE TABLE users (
                forename VARCHAR(32) NOT NULL,
                surname  VARCHAR(32) NOT NULL,
                username VARCHAR(32) NOT NULL UNIQUE,
                password VARCHAR(32) NOT NULL
            )";

    $result = mysql_query($query);
    if (!$result) die ("Database access failed: " . mysql_error());

    $salt1 = "qm&h*";
    $salt2 = "pg!@";

    $forename = 'Bill';
    $surname  = 'Smith';
    $username = 'bsmith';
    $password = 'mysecret';
    $token    = md5("$salt1$password$salt2");
    add_user($forename, $surname, $username, $token);

    $forename = 'Pauline';
    $surname  = 'Jones';
    $username = 'pjones';
    $password = 'acrobat';
    $token    = md5("$salt1$password$salt2");
    add_user($forename, $surname, $username, $token);

    function add_user($fn, $sn, $un, $pw)
    {
        $query = "INSERT INTO users VALUES('$fn', '$sn', '$un', '$pw')";
        $result = mysql_query($query);
        if (!$result) die ("Database access failed: " . mysql_error());
    }
    ?>

allow users to log in

<?php // authenticate.php
require_once 'login.php';
$db_server = mysql_connect($db_hostname, $db_username, $db_password);
if (!$db_server) die("Unable to connect to MySQL: " . mysql_error());
mysql_select_db($db_database)
    or die("Unable to select database: " . mysql_error());

if (isset($_SERVER['PHP_AUTH_USER']) &&
    isset($_SERVER['PHP_AUTH_PW']))
{
    $un_temp = mysql_entities_fix_string($_SERVER['PHP_AUTH_USER']);
    $pw_temp = mysql_entities_fix_string($_SERVER['PHP_AUTH_PW']);

    $query = "SELECT * FROM users WHERE username='$un_temp'";
    $result = mysql_query($query);
    if (!$result) die("Database access failed: " . mysql_error());
    elseif (mysql_num_rows($result))
    {
        $row = mysql_fetch_row($result);
        $salt1 = "qm&h*";
        $salt2 = "pg!@";
        $token = md5("$salt1$pw_temp$salt2");

        if ($token == $row[3]) echo "$row[0] $row[1] : 
            Hi $row[0], you are now logged in as '$row[2]'";
        else die("Invalid username/password combination");
    }
    else die("Invalid username/password combination");
}
else
{
    header('WWW-Authenticate: Basic realm="Restricted Section"');
    header('HTTP/1.0 401 Unauthorized');
    die ("Please enter your username and password");
}

function mysql_entities_fix_string($string)
{
    return htmlentities(mysql_fix_string($string));
}   

function mysql_fix_string($string)
{
    if (get_magic_quotes_gpc()) $string = stripslashes($string);
    return mysql_real_escape_string($string);
}
?>

The trouble is, I never get an error message and am never allowed to log in. I can enter a username and password into a popup window that the program generates, but nothing ever happens as a result of entering anything, correct or incorrect. When I hit "ok" the username and password fields are just cleared.

I suspect it has something to do with this line:

$query = "SELECT * FROM users WHERE username='$un_temp'";

But I don't know.

Just for reference, here is an sql file containing the code from users.

-- MySQL dump 10.13  Distrib 5.1.50, for Win32 (ia32)
--
-- Host: localhost    Database: publications
-- ------------------------------------------------------
-- Server version   5.1.50-community

/*!40101 SET @OLD_CHARACTER_SET_CLIENT=@@CHARACTER_SET_CLIENT */;
/*!40101 SET @OLD_CHARACTER_SET_RESULTS=@@CHARACTER_SET_RESULTS */;
/*!40101 SET @OLD_COLLATION_CONNECTION=@@COLLATION_CONNECTION */;
/*!40101 SET NAMES utf8 */;
/*!40103 SET @OLD_TIME_ZONE=@@TIME_ZONE */;
/*!40103 SET TIME_ZONE='+00:00' */;
/*!40014 SET @OLD_UNIQUE_CHECKS=@@UNIQUE_CHECKS, UNIQUE_CHECKS=0 */;
/*!40014 SET @OLD_FOREIGN_KEY_CHECKS=@@FOREIGN_KEY_CHECKS, FOREIGN_KEY_CHECKS=0 */;
/*!40101 SET @OLD_SQL_MODE=@@SQL_MODE, SQL_MODE='NO_AUTO_VALUE_ON_ZERO' */;
/*!40111 SET @OLD_SQL_NOTES=@@SQL_NOTES, SQL_NOTES=0 */;

--
-- Table structure for table `users`
--

DROP TABLE IF EXISTS `users`;
/*!40101 SET @saved_cs_client     = @@character_set_client */;
/*!40101 SET character_set_client = utf8 */;
CREATE TABLE `users` (
  `forename` varchar(32) NOT NULL,
  `surname` varchar(32) NOT NULL,
  `username` varchar(32) NOT NULL,
  `password` varchar(32) NOT NULL,
  UNIQUE KEY `username` (`username`)
) ENGINE=InnoDB DEFAULT CHARSET=latin1;
/*!40101 SET character_set_client = @saved_cs_client */;

--
-- Dumping data for table `users`
--

LOCK TABLES `users` WRITE;
/*!40000 ALTER TABLE `users` DISABLE KEYS */;
INSERT INTO `users` VALUES ('Bill','Smith','bsmith','be9d31ad4315b2ad9900a8526cd3edb1'),('Pauline','Jones','pjones','b1334d37914cf7561a006f656e27600c');
/*!40000 ALTER TABLE `users` ENABLE KEYS */;
UNLOCK TABLES;
/*!40103 SET TIME_ZONE=@OLD_TIME_ZONE */;

/*!40101 SET SQL_MODE=@OLD_SQL_MODE */;
/*!40014 SET FOREIGN_KEY_CHECKS=@OLD_FOREIGN_KEY_CHECKS */;
/*!40014 SET UNIQUE_CHECKS=@OLD_UNIQUE_CHECKS */;
/*!40101 SET CHARACTER_SET_CLIENT=@OLD_CHARACTER_SET_CLIENT */;
/*!40101 SET CHARACTER_SET_RESULTS=@OLD_CHARACTER_SET_RESULTS */;
/*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */;
/*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */;

-- Dump completed on 2012-12-31 11:38:10

YES, I KNOW SOME OF THE CODE HERE MAY BE "OLD".

Please hear me out. If you would like to suggest a book or tutorial for PHP that doesn't use "old" code, please do. I'm at my wits end trying to learn this programming language.

However if you just don't know how to trouble shoot something is "old" code in it, don't waste my time by telling me it's "old" as an "answer". There is no function in any language that forces a program not to work because a certain line of code is "old" or "underused". That only matters if the line of code is in fact no longer recognized. I'll have to learn better eventually I suppose, but right now I'm trying to learn php IN THE FIRST PLACE!

Answer 1

The book in question (Learning PHP, MySQL, JavaScript, and CSS) makes it clear that Basic Authentication is not enabled on all web servers. There's a good reason for that; it's impossibly insecure unless your web site uses https (a trivial packet sniffer can recover the plain text user name and password from any web request in the session).

If it's not available on your web server, things will just silently fail. That's one of the challenging (=== pain in the neck) aspects of doing web development.

Web security is hard enough to get right that you may want to consider building your system on top of a competent content management system (CMS) instead of creating your own authentication / authorization package. Here's a helpful article by one of the WordPress developers that should clue you into some of the subtleties of the subject.

http://markjaquith.wordpress.com/2006/06/02/wordpress-203-nonces/

I guess it's a good thing for your future users the example didn't work for you. Even if the code works, it has an insecure salt algorithm as well as the Basic Auth problem.

Answer 2

Instead of just blindly copying/pasting the example code and expecting it to work try the following:

1. Write a few lines.
2. Test it.
3. Fix anything that's gone wrong.
4. Test it.
5. Lather, rinse, repeat until done.

This is both the best way to use example code from other people, and the best way to write your own original code.

Some things you should be checking in your code:

• Before you send a query to mySQL you should echo the query to be sure that it has been formed correctly by your program logic.
• After you run the query you should look at if the result set has returned the expected values or, in the case of an insert, that the expected values have been inserted properly.

The reason you're getting so much guff from people is that you don't appear to have done this testing yourself, which is what we all spend the majority of our time doing with our own code. For me it's usually 15% writing, 75% testing, 10% cursing/drinking.

Answer 3

@David I feel the frustration. I tried this example without creating the database beforehand (e.g., referencing an existing one on localhost) and the salt algorithm was a hard fail. For me, the error concerned

    $token = md5($salt1$pw$salt2); 

that is, where $pw was dubbed an 'unexpected occurrence'. Not true, but idk I'm almost thinking they did it on purposes to force us to learn PDO.