Question

I want that users can authenticate through their fb account, and i tried their demo script:

 $app_id = "*****";
 $app_secret = "*****";
 $my_url = "http://localhost/fb/fb.php";

 session_start();
 $code = $_REQUEST["code"];

 if(empty($code)) {
 $_SESSION['state'] = md5(uniqid(rand(), TRUE)); //CSRF protection
 $dialog_url = "http://www.facebook.com/dialog/oauth?client_id=" 
   . $app_id . "&redirect_uri=" . urlencode($my_url) . "&state="
   . $_SESSION['state'];

 echo("<script> top.location.href='" . $dialog_url . "'</script>");
}

 if($_REQUEST['state'] == $_SESSION['state']) {
 $token_url = "https://graph.facebook.com/oauth/access_token?"
   . "client_id=" . $app_id . "&redirect_uri=" . urlencode($my_url)
   . "&client_secret=" . $app_secret . "&code=" . $code;

 $response = @file_get_contents($token_url);
 $params = null;
 parse_str($response, $params);

 $graph_url = "https://graph.facebook.com/me?access_token=" 
   . $params['access_token'];

 $user = json_decode(file_get_contents($graph_url));
 echo("Hello " . $user->name);
 echo "$user->name";
}
else {
 echo("The state does not match. You may be a victim of CSRF.");

}

The problem is that after a successful login only the “Hello” string is displayed, but my $user->name is not showed.

Answer 1

Even though this is official FB code (I didn’t realize that at the start, sorry), I recommend you debug it to see what goes wrong.

• Activate error reporting
• Remove the @ in front of all calls – it suppresses the output of errors
• Look what address $graph_url contains and whether you can access it in your browser
• See whether the call to $graph_url works out (output the result)
• See whether the json_decode() works out (output the result)

if this is a global or Facebook issue, you may need to talk to Facebook about what is wrong with their demo code.