Home/ Questions/Q 8972467
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-15T18:13:29+00:00

For some web development practice, I decided to make a dropbox-like site where users

  • 0

For some web development practice, I decided to make a dropbox-like site where users would login with a username and password and, assuming the combination is correct, would have access to a file uploader interface as well as a way to retrieve their files. I have something that works, but I have run into one problem. As soon as the user submits their username and password, the page is reloaded (this is fine) with the new php code, however, the URL changes slightly to where it reveals both the username and the password. Can someone tell me how to prevent this from happening?

Here is the index.php file:

<?php
  function checkCredentials()
  {
    if($_GET && $_GET["username"]=="kwaugh" && $_GET["password"]=="password")
  {
?>

    <html>
        <head>
                <title>File Storage</title>
                    <style>
                        body{font-size:.85em ;font-family:Arial;}
                    </style>
        </head>

        <body>
            <center>
                <br>Please select the file that you would like to upload:<br><br>
                    <form method="post" enctype="multipart/form-data">
                        <input type="file" name="filename"/>
                        <input type="submit" value="Upload" />
                    </form>
            </center>
        </body>
    </html>
    <?php
        if ($_FILES)
        {
            $name = $_FILES['filename']['name'];
            move_uploaded_file($_FILES['filename']['tmp_name'], $name);
            if(file_exists($name))
            {
                ?>
                <html>
                    <body>
                        <div style="color:red; font-size:2em; font-family:Arial">
                            <center>The file has been successfully uploaded <br />Click <a href="getFiles.php">here</a> to go to your uploaded files</center>
                        </div>
                    </body>
                </html>

                <?php
            }
            else
            {
                    ?>
                    <html>
                        <body>
                            <div style="color:red; font-size:2em; font-family:Arial">
                                <center>Well crap, something went wrong.  The file could not be uploaded :'( </center>
                            </div>
                        </body>
                    </html>

                    <?php
            }
    }
    die();
}
elseif($_GET && $_GET["username"]!=="kwaugh" || $_GET && $_GET["password"]!=="password")
{
    ?>
    <script>
        alert("You have entered an incorrect username/password combination");
    </script>

    <?php
}
}
checkCredentials();
?>
<html>
<head>
    <title>File Storage</title>
</head>

<body> <br /><br />
    <center>
        <img src="elephant.jpg">
        <form name="credentials">
            Please enter your username and password to upload files: <br     />
            Username: <input type="text" name="username"><br />
            Password: <input type="password" name="password"><br />
            <input type="submit" value="Submit" >
        </form>
        <br />Or click <a href="getFiles.php">here</a> to access stored files.
    </center>
</body>
</html>
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Use POST for your credentials form. By default, the method is GET which will append the parameters in the URL. Obviously, this means checking variables in the $_POST array instead of the $_GET array.

    If I can give another suggestion, I would split the application in multiple files. You shouldn’t have the login and the upload interface in the same script, otherwise you will have major problems scaling up your application.

    • As you add pages, it will be almost impossible to know which part of the script should run and using which parameters and outputting what html
    • You will need to pass a “state” to the page so that you internally know what the user is trying to do – spreading the logic over multiple php files would make it easier to do.
    • The file will grow a lot, making it harder for you to understand what’s actually getting executed, making it harder for you to debug
    • If you ever start working with other developers, it would be more “developer friendly” to break the features in separate php files to minimize conflicts when editing the files

    A lot of web applications will be split in multiple pages (often implemented in a controller) where you would have the following:

    • Welcome Page (landing page, allow to log in, allow sign in, display information about your product)
    • Authentication Page (validate log in then redirect to the Profile page, show the sign in form, validate it, create new users, etc…)
    • Profile Page (for a logged in user, display his information)

    To this you should probably add a File Management page that shows all files owned by a user, allows him to add / delete pages, etc…

    • 0