weird password problem

[sharky]

Hello,

I copied all code for the reguser page and it seems to work just find, but one thing is driving me mad.

When I register with username: test and pass: test1, then the following passwords can be used to login:

t est
te st
test1

When I use another password with only letters, I must add a space behind or in the middle of the password to login!

How can I solve this??

[Chris]

Can you post the code?

[sharky]

<?php
include 'connect.php';
?>

<?php
$player=$_POST['player'];
$password=$_POST['password'];
$pass2=$_POST['pass2'];
$player=strip_tags($player);
$email=$_POST['email'];
$email=strip_tags($email);

if ($email == "")
{
echo "You didn't enter a email address!<br>";
echo " <A href='register.php'>Go back</a>";
exit;
}
if ($password==$pass2)
{

$isplayer="SELECT * from players where name='$player'";
$isplayer2=mysql_query($isplayer) or die("Could not query players table");
$isplayer3=mysql_fetch_array($isplayer2);
if(!$_POST['password'] || !$_POST['pass2'])
{
print "You did not enter a password";
echo " <A href='register.php'>Go back</a><br>";
exit;
}
else if($isplayer3 || strlen($player)>15 || strlen($player)<1)
{
print "There is already a player of that name or the name you specified is over 16 letters or less than 1 letter<br>";
echo " <A href='register.php'>Go back</a>";
exit;
}
else
{
$isaddress="SELECT * from players where email='$email'";
$isaddress2=mysql_query($isaddress) or die("not able to query for password");
$isaddress3=mysql_fetch_array($isaddress2);
if($isaddress3)
{
print "There is already a player with that e-mail address<br>";
echo " <A href='register.php'>Go back</a>";
exit;
}
else
{
$password=md5($password);

$SQL = "INSERT into players(name, password, email) VALUES ('$player','$password','$email')";
mysql_query($SQL) or die("could not register");

print "Thank you for registering.";

}
}
}

else
{
print "Your password didn't match or you did not enter a password<br>";
echo " <A href='register.php'>Go back</a>";
exit;
}
echo "<br><A href='login.php'>Login Page</a>";
?>

[Chris]

From what I can see I'm guessing this is the register script and I don't see anything wrong with it. The culprit is most likely something like a trim() function on your log in script.

[Sebastian]

i dont have much time now but ive noticed it earlier.
i dont remember what was exactly but i think it was in authenticate.php....
here is mine

Code: Select all

<?php
include_once 'connect.php';
session_start();
?>
<link href="style.css" rel="stylesheet" type="text/css" />

<div id ="srodek">
<?php
if (isset($_POST['submit']))
{
  $player=$_POST['player'];
  $password=$_POST['password'];
  $player=strip_tags($player);
  $password=strip_tags($password);
  $password=md5($password);

  $query = "select name,password from players where name='$player' and password='$password'";
  $result = mysql_query($query) or die("Could not query players");
  $result2 = mysql_fetch_array($result);
  if ($result2)
  { 
    $_SESSION['player']=$player;
    
    echo "<big>Logged in successfully<br>";
    echo "<A href='index.php'>Continue</a></big>";
  }
  else
  {
   echo "<big>Nieprawidlowy login lub haslo<A href='index.php'>Powrót</a></big>";
  }
}
?>

if it is still not working try to check my lder posts
sorry couldnt be more helpful, dont have much time

Ps.

Code: Select all

 $query = "select name,password from players where name='$player' and '$password'";

here is urmistake

[sharky]

Ps.

Code: Select all

 $query = "select name,password from players where name='$player' and '$password'";

here is urmistake

You are right. I changed it to the code you are using and it works perfectly. I looked over it a million times.

Thank you for you help!