asked on

Login script issues after MySQL upgraded from 5.1 to version 5.5

Experts,
Over the last 3 years, I've been using the same login script for my users to login to my website. I've never had any issues.

3 days ago, my web host upgraded MySQL from version 5.1 to version 5.5.
All of my user logins are now failing. The mysql upgrade is the only thing that recently changed. In looking at my code, I can't pinpoint what the problem is.
The login function below returns FALSE at every login attempt and the text "Login Failed" is now outputted.

function process_login() {
	global $str_login_error;
	$uname = trim($_POST["uname"]);
	$psw = trim($_POST["psw"]);
//    dbConnect('allgo5_ncaa');
	$sql = "SELECT * FROM USERS WHERE
        userid = '$uname' AND password = PASSWORD('$psw')";
	$rs = mysql_query($sql);
	//echo "<!--$sql-->";
	if ($rs && $data=mysql_fetch_array($rs)) {
		
		$_SESSION["user_login"] = "yes";
		$_SESSION["user_FirstName"] = $data["FirstName"];
		$_SESSION["user_fullname"] = $data["FirstName"] . " " . $data["LastName"];
		$_SESSION["UserID"] = $data["ID"];
		$_SESSION["uid"] = $data["userid"];
		$_SESSION["pwd"] = $psw;
		
		// Set the user values after clearing the previous values for next logging the user in if he doesn't logout
		// Reset cookie
		setcookie("user_login", "yes", time()-60*60*24*100, "/");
		setcookie("user_FirstName", $data["FirstName"], time()-60*60*24*100, "/");
		setcookie("user_fullname", $data["FirstName"] . " " . $data["LastName"], time()-60*60*24*100, "/");
		setcookie("UserID", $data["ID"], time()-60*60*24*100, "/");
		setcookie("uid", $data["userid"], time()-60*60*24*100, "/");
		setcookie("pwd", $psw, time()-60*60*24*100, "/");
		
		// Set cookie
		setcookie("user_login", "yes", time()+60*60*24*100, "/");
		setcookie("user_FirstName", $data["FirstName"], time()+60*60*24*100, "/");
		setcookie("user_fullname", $data["FirstName"] . " " . $data["LastName"], time()+60*60*24*100, "/");
		setcookie("UserID",$data["ID"], time()+60*60*24*100, "/");
		setcookie("uid", $data["userid"], time()+60*60*24*100, "/");
		setcookie("pwd", $psw, time()+60*60*24*100, "/");
		header('Location: '.$_SERVER['PHP_SELF']);	
		return TRUE;
	}
	$str_login_error = "Login failed! &nbsp; &nbsp; &nbsp; ";
	return FALSE;
}

Open in new window

I should mention that if the users still have their session open, they can fully use my site. The problem is affecting users that don't have an open session and need to log in.
All other database interactions on my website work fine except for this login issue.

phpinfo is here: http://www.officepickem.com/phpinfo.php

Please let me know if you have any ideas. I'm really stuck here.

Thanks,
-dsg

Ray Paseur

The general design pattern of a "login" script is here.
https://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/A_2391-PHP-login-logout-and-easy-access-control.html

I'll take a look and see if I can detect anything in the code above. Do you have a link to the phpinfo() before the upgrade (maybe on a shadow server)?

Ray Paseur

I am immediately suspicious of password hashing.
http://dev.mysql.com/doc/refman/5.5/en/password-hashing.html

Can you try printing out some of the information? For example, does the query actually work? You can find that out by testing the value of $rs after this statement:

$rs = mysql_query($sql);
if (!$rs) { echo $sql; trigger_error( mysql_error() ); }

Can you try something like SELECT PASSWORD('$psw') and print out the result. Compare that to the contents of the data base table.

Can you verify that there have not been any changes in magic_quotes or register_globals?