Authentication login page does not work using PHP and Oracle on Apache / Windows 2008

[UPDATE: Resolved: Thanks to everyone. See the code here: http://pastebin.com/1fJmXeG2] I am very grateful for any help I can solve on this issue. We have a login page for our site running on an old Linux server using Apache 1 and PHP 4. We want to transfer it to the new Windows 2008 server (64-bit) ... so I installed Apache 2.25 and PHP 5.4 on the new server. I also enabled OCI8 to connect to the Oracle 11g database. I moved the files for the login page to the new server and they do not work. What happens, the page does not run the script, but simply redirects index.php instead of redirecting to the php index with the corresponding response. Of course, there was an obsolete language that I updated in the PHP script, but it still does not work. I'm a complete newbie, so I'm not sure if this is a script problem or a problem with PHP settings. I know that I can connect to the database since I made a test page. Please help me if you ... I'm really desperate. Below is the code for my login page:

<?php session_start(); // Begin or continue session by registering variables $_SESSION['USER_ID'] = 'USER_ID'; $_SESSION['PASSWORD'] = 'PASSWORD'; $_SESSION['FIRST'] = 'FIRST'; $_SESSION['LAST'] = 'LAST'; $_SESSION['ACCESS_KEY'] = 'ACCESS_KEY'; $_SESSION['conn'] = 'conn'; $_SESSION['BEENHERE'] = 'BEENHERE'; $_SESSION['CUSTOMER_NAME'] = 'CUSTOMER_NAME'; $_SESSION['WAREHOUSING'] = 'WAREHOUSING'; $_SESSION['TRANSPORTATION'] = 'TRANSPORTATION'; $_SESSION['MYACCOUNT'] = 'MYACCOUNT'; // Set Environment Variables $SYS_DBUSER = "*****"; $SYS_DBPASSWORD = "*****"; $SYS_DB = "*****"; // Begin Authorization Routine if ( (!isset($USER_ID)) && (!isset($PASSWORD)) ) { echo '<html>'; echo '<head>'; echo '<title> Customer Access - Login</title>'; echo '<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">'; echo '</head>'; echo '<body bgcolor="#FFFFFF" text="#000000">'; echo '<div align="center">'; echo '<p><img src="../images/logocir3.gif" width="120" height="123"> </p>'; echo '<p><b><font size="5" color="#0000FF" face="Arial, Helvetica, sans-serif">The '; echo 'The Company</font></b></p>'; echo '<p><font size="4" color="#0000FF" face="Arial, Helvetica, sans-serif"><b><i>Customer Access</i></b></font></p>'; echo '<form name="form1" method="post" action="index.php">'; echo '<p> <font size="3" face="Arial, Helvetica, sans-serif">Username:</font> '; echo '<input type="text" name="USER_ID" maxlength="15">'; echo '</p>'; echo '<p><font size="3" face="Arial, Helvetica, sans-serif">Password: </font> '; echo '<input type="PASSWORD" name="PASSWORD" maxlength="15">'; echo '</p>'; echo '<p><input type="submit" name="Submit" value="Login"></p>'; echo '</form>'; echo '<p>&nbsp;</p>'; echo '</div>'; echo '</body>'; echo '</html>'; exit; } elseif ( ($BEENHERE == 1) && (isset($FIRST)) && (isset($PASSWORD)) && (isset($ACCESS_KEY)) && (isset($USER_ID)) && (isset($LAST)) && (isset($conn)) && (isset($CUSTOMER_NAME)) ) { return (TRUE); } else { // Connect to database unset($conn); $conn = oci_connect($SYS_DBUSER,$SYS_DBPASSWORD,$SYS_DB); // Generate sql statement $loginsql = oci_parse($conn,"SELECT FIRST_NAME,LAST_NAME,CUSTOMER_NAME,ACCESS_KEY,TRANSPORTATION,WAREHOUSING,MYACCOUNT FROM WEB_USERS WHERE USER_ID = SUBSTR(UPPER('$USER_ID'),1,15) AND PASSWORD = SUBSTR(UPPER('$PASSWORD'),1,30) AND ENABLED = 'Y'"); // Execute statement oci_execute($loginsql,OCI_NO_AUTO_COMMIT); // Retrieve number of rows for authentication $nrows = oci_fetch_all($loginsql,$results); // Database Authenticate if ( $nrows != 1 ) { // Display if login fails unset($USER_ID); unset($PASSWORD); unset($FIRST); unset($LAST); unset($ACCESS_KEY); unset($conn); unset($BEENHERE); unset($CUSTOMER_NAME); unset($WAREHOUSING); unset($TRANSPORTATION); unset($MYACCOUNT); echo "<H1>Login Failure - Please Check Your Password AND/OR Username</H1><BR>"; echo "<A HREF=\"$PHP_SELF\"><H3>Try Again</H3></A>"; // Close used resources oci_free_statement($loginsql); oci_close($conn); exit; } else { // Assign login information to global variables unset($FIRST); unset($LAST); unset($ACCESS_KEY); unset($BEENHERE); unset($CUSTOMER_NAME); unset($WAREHOUSING); unset($TRANSPORTATION); unset($MYACCOUNT); $FIRST = $results['FIRST_NAME'][0]; $LAST = $results['LAST_NAME'][0]; $CUSTOMER_NAME = $results['CUSTOMER_NAME'][0]; $ACCESS_KEY = $results['ACCESS_KEY'][0]; $TRANSPORTATION = $results['TRANSPORTATION'][0]; $WAREHOUSING = $results['WAREHOUSING'][0]; $MYACCOUNT = $results['MYACCOUNT'][0]; $BEENHERE = 1; // Close used resources oci_free_statement($loginsql); oci_close($conn); } } ?> 

Here are my php settings in the png file: http://i.imgur.com/7c8BzZG.png?1

+4
source share
3 answers

I do not know about the rest, but you need to add session_start (); at the top of the php page. This should be the first on every page on which you conduct your sessions. I usually put it next to the tag:

 <?php session_start(); ... 
+2
source

Since PHP4, request variables are only available through the $ _GET arrays (for GET requests) and $ _POST arrays (for POST requests). You have a rewrite starting with a turn

 if ( (!isset($USER_ID)) && (!isset($PASSWORD)) ) 

in

 if ( (!isset($_POST)) ) 

or

 if ( (!array_key_exists('USERID', $_POST)) && (!array_key_exists('PASSWORD', $_POST)) ) 

More details: http://php.net/manual/en/function.array-key-exists.php

http://www.php.net/manual/en/reserved.variables.php

+2
source

There are many things fixed in your code:

  • As joemurphy said, to check if the form is submitted:

     if (!isset($_POST)) {....} 
  • Do not use many echo statements to display HTML. Close your PHP tag ( ?> ) And simply output the HTML code as usual. Then, when you're done with HTML, add the opening PHP tag ( <php ) and continue with your PHP code.

  • Check the values ​​in $_SESSION with

     if (isset($_SESSION['USER_ID'])){...} 

    If you need a specific value:

     if (isset($_SESSION['USER_ID']) && $_SESSION['USER_ID'] == 1){...} 
  • You do not need to set dummy values ​​to initialize them in a session or disable them before setting them up. Set them only when you have the appropriate values ​​for them, then clear them when you log out. Therefore, delete the "Start or continue a session by registering variables" section.

+1
source

Source: https://habr.com/ru/post/1496200/


All Articles