Question

Heey Guys

It is such that I only like to do this to my side not only is sha1. but is a little safer to log in and many other things.

Now try I make an example.

function generateSalt($length) {
      $alphabet = './ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
      $alphabet_length = strlen($alphabet);
      $salt = '';
      for ($i = 0; $i < $length; $i++) {
          $salt .= $alphabet[rand(0, $alphabet_length - 1)];
      }
      return $salt;
  }

  /*
  * Opret bruger på siden og kan har mulighed for alle ting!..
  */

 function bruger_opret_siden(){
         if ($stmt = $this->mysqli->prepare('SELECT NULL FROM `bruger` WHERE `brugernavn` = ?'))
         {
             $stmt->bind_param('s', $brugernavn);
             $brugernavn = $_POST["brugernavn"];
             $stmt->execute();
             $stmt->store_result();
             $count = $stmt->num_rows;
             $stmt->close();
             if($count > 0)
             {
                 $user_found = 1;
             }
         }
         if(!isset($user_found))
         {
             if($_POST["pass"] != $_POST["gentag"])
             {
                 $errors = 1;
                 echo "<li id=\"check_not\">Angive ens password på siden..</li>";
             }
             if(empty($_POST["pass"]) && empty($_POST["gentag"]))
             {
                 $errors = 1;
                 echo "<li id=\"check_not\">Angive et password på siden..</li>";
             }
             if(empty($_POST["navn"]))
             {
                 $errors = 1;
                 echo "<li id=\"check_not\">Angive et Fornavn</li>";
             }
             if(empty($_POST["efternavn"]))
             {
                 $errors = 1;
                 echo "<li id=\"check_not\">Angive et Efternavn</li>";
             }
             if(empty($_POST["land_by"]))
             {
                 $errors = 1;
                 echo "<li id=\"check_not\">Angive en by</li>";
             }
             if(empty($_POST["hojde"]))
             {
                 $errors = 1;
                 echo "<li id=\"check_not\">Angive en Højde</li>";
             }
             if(empty($_POST["email"]))
             {
                 $errors = 1;
                 echo "<li id=\"check_not\">Angive en Email</li>";
             }
             if(empty($_POST["brugernavn"]))
             {
                 $errors = 1;
                 echo "<li id=\"check_not\">Angive en Højde</li>";
             }

             if(!isset($errors))
             {
                 $pb = null;

                 include 'function/class.upload.php';
                 $handle = new Upload($_FILES["file"]);

                 if($handle->uploaded)
                 {
                     //lidt mere store billeder
                     $handle->image_resize = true;
                     $handle->image_ratio_y = true;
                     $handle->image_x = 220;
                     $handle->Process("profil-img/store");

                     //til profil billede lign..
                     $handle->image_resize = true;
                     $handle->image_ratio_crop = true;
                     $handle->image_y = 115;
                     $handle->image_x = 100;
                     $handle->Process("profil-img");

                     //til profil billede lign..
                     $handle->image_resize = true;
                     $handle->image_ratio_crop = true;
                     $handle->image_y = 75;
                     $handle->image_x = 75;
                     $handle->Process("profil-img/lille");
                     $pb = $handle->file_dst_name;            

                 }

              $password = $_POST["pass"];
              $algorithm = '$6$'; //<--- Dette betyder SHA 512
              $salt = $this->generateSalt(16); //<--- SHA 512 bruger et 16 tegn langt salt

              $hash = crypt($password, $algorithm . $salt);

             if ($stmt = $this->mysqli->prepare('INSERT INTO `bruger` 
             (`rank`, `email`, `brugernavn`, `password`, `profilbillede`, `profilbillede_godkendt`, `navn`, `efternavn`, `alder_d`, `alder_m`, `alder_aar`, `status`, `kon`, `seksualitet`, `land_by`, `hojde`) 
             VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)'))
             {

                 $stmt->bind_param('issssisssssiiisi', $rank, $email, $brugernavn, $password, $profilbillede, $pb_godkendt, $navn, $efternavn, $alder_d, $alder_m, $alder_aar, $kon, $seksualitet, $partnerstatus, $land_by, $hojde);
                 $rank = '1';
                 $pb_godkendt = '1';
                 $email = $_POST["email"];
                 $brugernavn = $_POST["brugernavn"];//C
                 $password = $hash;//C
                 $profilbillede = $pb;//C
                 $navn = $_POST["navn"];
                 $efternavn = $_POST["efternavn"];
                 $alder_d = $_POST["alder_d"];
                 $alder_m = $_POST["alder_m"];
                 $alder_aar = $_POST["alder_aar"];
                 $kon = $_POST["kon"];
                 $seksualitet = $_POST["seksualitet"];
                 $partnerstatus = $_POST["partnerstatus"];
                 $land_by = $_POST["land_by"];
                 $hojde = $_POST["hojde"];

                 $stmt->execute();
                 $stmt->close();

                 echo "godkendt";

                 }
                 else
                 {
                     /* Der er opstået en fejl */
                     echo 'Der opstod en fejl i erklæringen til ligge i databasen: ' . $mysqli->error;
                 }
             }
         }
         else
         {
             echo "<li id=\"check_not\">Dette brugernavn er optaget!!</li>";
         }
 }

Here’s how it looks on the register page:

 if(isset($_POST["godkendt_bruger"]))
             {
                 $pass = $mebe->generateSalt();
                 $users = $mebe->bruger_opret_siden();
             }
'<?php
     /*
      * Giver admin adgang til se indhold på siden.
      */
     if(isset($_SESSION["rank"]) && $_SESSION["rank"] > 0) {
         $bruger = $mebe->brugerindhold_side();
     }


     /*
      * Hvis ingen af dem så få de bare adgang sådan her..
      */
     else{
     ?>
 <form name="login" method="post" action="#">
     <h1>Log ind</h1>
     <p>Brugernavn</p><input type="text" name="brugernavn"/>
     <p>Password</p><input type="password" name="pass"/>
     <br />
     <input type="submit" name="Log_ind" value="Log ind" id="login">
     <?php
     if(isset($_POST["Log_ind"]))
     {
     $pass = $mebe->generateSalt(12);
     $login = $mebe->godkendt_bruger_login();
     }
     ?>
     <ul>
         <li><a href="">Forgot password and username</a></li>
         <li><a href="/opret-bruger/">Users</a></li>
     </ul>
 </form>
 <?php
     }
 ?>

This says it in when I need to log into the page:

Notice: Undefined variable: hash in /home/jesperbo/public_html/mebe/function/function.php on line 216

function godkendt_bruger_login(){
          $password = $_POST["pass"];
          $algorithm = '$6$'; //<--- Dette betyder SHA 512
          $salt = $this->generateSalt(16); //<--- SHA 512 bruger et 16 tegn langt salt
         if($stmt = $this->mysqli->prepare('SELECT `id`, `brugernavn`, `rank`, `profilbillede`, `profilbillede_godkendt` FROM `bruger` WHERE `brugernavn` = ? AND `password` = ?'))
         {
         $stmt->bind_param('ss', $brugernavn, $password);
         $brugernavn = $_POST["brugernavn"];
         $password = $hash;
         $stmt->execute();
         $stmt->store_result();
         $stmt->bind_result($id, $brugernavn, $rank, $profilbillede, $profilbillede_godkendt);
         $stmt->fetch();
         $count = $stmt->num_rows;
         $stmt->close();

         if($count > 0)
         {
             $_SESSION["logged_in"] = true;
             $_SESSION["id"] = $id;
             $_SESSION["profilbillede"] = $profilbillede;
             $_SESSION["brugernavn"] = $brugernavn;
             $_SESSION["rank"] = $rank;
             $_SESSION["profilbillede_godkendt"] = $profilbillede_godkendt;

             if($_SESSION["logged_in"] == true)
             {
                 echo "godkendt";
             }
             else
             {
                 echo "<p>Desværre prøve igen brugernavn eller adgangskode passe ikke med vores</p>";
             }
         }
         else
         {
             echo "<p>Skrive brugernavn og Password</p>";
         }
     }
     }

That is to say here;

$password = $hash;

Create part works fine as it makes a long password. but that the problem is that when I log into the page.

Hope you can help me

Answer 1

Here:

function godkendt_bruger_login(){
          $password = $_POST["pass"];
          $algorithm = '$6$'; //<--- Dette betyder SHA 512
          $salt = $this->generateSalt(16); //<--- SHA 512 bruger et 16 tegn langt salt
         if($stmt = $this->mysqli->prepare('SELECT `id`, `brugernavn`, `rank`, `profilbillede`, `profilbillede_godkendt` FROM `bruger` WHERE `brugernavn` = ? AND `password` = ?'))
         {
         $stmt->bind_param('ss', $brugernavn, $password);
         $brugernavn = $_POST["brugernavn"];
         /* ---> */ $password = $hash;
         $stmt->execute();

you are trying to initialize $password to $hash while there’s no $hash defined in the scope of the function.

As your error correctly say:

Notice: Undefined variable: hash in
/home/jesperbo/public_html/mebe/function/function.php on line 216

It is just making you notice that $hash doesn’t exists and it will be converted, inside the =-expression to NULL and so is $password; which is obviously a behavior you do not want.