I have a website which I have users input their username/pass to login and stores this information in a file. Here is my current code:
function getPassword( $user )
{
$passwords= array
(
'Admin' => '123456',
'Moderator' => 'abcde'
);
eval(file_get_contents('./login.info')); //<--- THIS is where usernames/passwords are stored
$password = $passwords[ $user ];
if ( NULL == $password )
return NULL;
return array( $user, $password );
}
This is the code I have for users creating new accounts:
<?php
if((isset($_POST['username']))and(isset($_POST['password']))){
$file = "login.info";
$fh = fopen($file, 'a');
//prevent sql injection
function check_field($fh)
{
if(!preg_match("/[^a-zA-Z0-9\.\-\_\@\.\+\~]/",$fh))
return TRUE;
else
return FALSE;
}
if(!check_field($_POST[username]))
{
header("Location:illegalchars.html");
break;
}
if(!check_field($_POST[password]))
{
header("Location:illegalchars.html");
break;
}
fwrite($fh, '$passwords["'.$_POST['username'].'"]="'.$_POST['password'].'";');
fclose($fh);
header("Location:success.html");
break;
}
?>
I know my code isn't pretty.. and has major issues.
One of which is: If someone creates an account with username x, anyone can still create x with a new password to gain control.
The easy solution I had was to move the eval(file_get_contents('./login.info')); on top of the admin accounts and make new accounts append on THE TOP of the list of new user/passes. However, I can't figure out why putting eval on top of the array doesn't work. Also, how I can get the code to append on the top of the list.
Any help is greatly appreciated.
==EDIT== I know there is MUCH criticism on this code, but could someone please just answer the question? I'm not trying to improve security/performance at the moment (this is for a proof-of-concept game, eventually, this whole thing will have to be rewritten anyways). I just want a functional script, please answer the question? :]
