Form security/validation

[unplugged_web]

I wonder if somebody could please help me. I came across a tutorial for adding a security image to a form (http://www.sitepoint.com/article/toughen-f...-security-image) and want to add it into a site I'm working on. It shows up on the site, but doesn't work.The form is:

<form method="post" action="{url_main}join.php?cmd=login" id="login-f" class="clearfix">                    <div id="join" style=" text-align: left; padding-bottom: 19px; padding-left: 10px; background-image: url({url_tmpl_main}images/login_bottom.jpg); background-repeat: no-repeat;"><br />                    <label for="username">{l_username}:</label><input name="user" type="text" id="login" tabindex="1" /><br />                    <label for="password">{l_password}: </label><input name="password" type="password" tabindex="2" /><br />                    <p><input name="remember" type="checkbox" id="remember" class="chk" value="1" type="checkbox" style="width: 14px; margin-right: 5px; margin-left: 53px;"> <label for="remember">{l_remember_me}</label>| <a href="{url_main}forget_password.php?">{l_forgot_password}</a><input type="submit" value="" class="button-login" style="width: 29px; margin-left: 60px; padding-right: 5px; border: 0px; cursor: pointer; cursor: hand;" /></p>                  </div>                </form>            </td><td width="2%">             </td><td width="45%" align="right" valign="top">                    <!-- begin_join --><?php      // check for posted form      if (isset($_POST['login'])) {         // see if the code the user typed matched the generated code         if (strtoupper($_POST['code']) == $_SESSION['code']) {             header("location: jointest.php");         } else {            echo 'You have entered the wrong code. Please try again</a>.';         }      } else {   ?>                      <form name="JoinForm" method="post" action="{url_main}join.php" onsubmit="return validateJoinForm();">                        <div  class="signup_header_big" style="padding-top: 15px; padding-right: 14px; text-align: right; background-image: url({url_tmpl_main}images/join_top.jpg); background-repeat: no-repeat;">Sign up  for free! </div>                        <div id="join" style="padding-bottom: 10px; padding-top: 5px; background-image: url({url_tmpl_main}images/join_content.jpg);">                        <div style="color: #FF0000; font-weight: bold; font-size: 11px; padding-right: 10px;">{join_message}</div><br />                        <label for="username">{l_username}:</label><input type="text" id="username" name="join_handle" value="{join_handle}" /><br />                        <label for="create-password">{l_create_password}:</label><input type="password" id="create-password" name="join_password" value="{join_password}" /><br />                        <label for="re-password">{l_reenter_password}:</label><input type="password" id="re-password" name="verify_password" value="{join_password}" /><br />                        <label for="email">{l_email}:</label><input type="text" id="email" name="email" value="{email}" /><br />                        <label for="re-email">{l_reemail}:</label><input type="text" id="re-email" name="verify_email" value="{email}" /><br />                        <label for="iam">{l_i_am}:</label>                            <select name="orientation" id="iam">                                 {orientation_options}                            </select>                        <br />                        <label for="from">{l_from}:</label>                            <select name="country" id="from">                                 <option value="-1" selected="selected">{l_country_select}</option>                                 {country_options}                            </select>                        <br />                        <label for="month">{l_born_on}:</label>                            <select name="month" id="month" onchange="updateDay('month','JoinForm','year','month','day')">                                {month_options}                            </select>                            <select name="day" id="day">                                {day_options}                            </select>                            <select name="year" id="year" onchange="updateDay('year','JoinForm','year','month','day')">                                {year_options}                            </select>                            <br />                      </div>                        <div id="security"><img src="../../../Code/security-image.php?width=180" width="180" height="60" alt="Security Image" /></div>         <label for="code">Security Image:</label><input type="text" name="code" id="code" value="" />                        </div>                        <div id="terms" style="padding-right: 10px; width: 352px; background-image: url({url_tmpl_main}images/join_content.jpg);"><input name="privacy_policy" type="checkbox" value="true" id="agree" checked> <label for="agree"> {l_i_agree} <a href="java script:winpop('{url_tmpl_main}popup/term_cond.html','960','600','yes');">{l_terms_and_conditions}</a> and <a href="java script:winpop('{url_tmpl_main}popup/priv_policy.html','960','600','yes');">{l_privacy_policy}</a> <br /></label></div><div id="terms" style="padding-right: 10px; height: 50px; width: 352px; background-image: url({url_tmpl_main}images/join_bottom.jpg); background-repeat: no-repeat;"><input type="button" value="" onclick="submitJoinForm();" class="button-join" style=" margin-right: 13px; margin-top: 5px; cursor: pointer; cursor: hand;" />                    </form>

and it has a JavaScript validator which is:

<script language="JavaScript" type="text/javascript">			  function onValidateJoinForm() {				var form = document.forms['JoinForm'];				if (!(validateRequiredField(form['join_handle'], '{l_username}'))) {				  return false;				}				if (!(validateMinLength(form['join_handle'], '{l_username}','4'))) {				  return false;				}				if (!(validateMaxLength(form['join_handle'], '{l_username}','20'))) {				  return false;				}				if (!(validateAlphaNumeric(form['join_handle'], '{l_username}'))) {				  return false;				}				if (!(validateRequiredField(form['join_handle'], '{l_username}'))) {				  return false;				}				if (!(validateMinLength(form['join_handle'], '{l_username}','4'))) {				  return false;				}				if (!(validateMaxLength(form['join_handle'], '{l_username}','20'))) {				  return false;				}				if (!(validateAlphaNumeric(form['join_handle'], '{l_username}'))) {				  return false;				}				if (!(validateRequiredField(form['join_password'], '{l_password}'))) {				  return false;				}				if (!(validateMinLength(form['join_password'], '{l_password}','6'))) {				  return false;				}				if (!(validateMaxLength(form['join_password'], '{l_password}','15'))) {				  return false;				}				if (!(validateAlphaNumeric(form['join_password'], '{l_password}'))) {				  return false;				}				if (!(validateRequiredField(form['join_password'], '{l_password}'))) {				  return false;				}				if (!(validateMinLength(form['join_password'], '{l_password}','6'))) {				  return false;				}				if (!(validateMaxLength(form['join_password'], '{l_password}','15'))) {				  return false;				}				if (!(validateAlphaNumeric(form['join_password'], '{l_password}'))) {				  return false;				}				if (!(validateNotTwoFields(form['join_password'],'{l_password}',form['join_handle'],'{l_username}'))) {				  return false;				}				if (!(validateTwoFields(form['verify_password'],'{l_verify_password}',form['join_password'],'{l_password}'))) {				  return false;				}				if (!(validateRequiredField(form['email'], '{l_email_address}'))) {				  return false;				}				if (!(validateMaxLength(form['email'], '{l_email_address}','100'))) {				  return false;				}				if (!(validateEmailField(form['email'], '{l_email_address}'))) {				  return false;				}				if (!(validateRequiredField(form['verify_email'], '{l_verify_email}'))) {				  return false;				}				if (!(validateMaxLength(form['verify_email'], '{l_verify_email}','100'))) {				  return false;				}				if (!(validateEmailField(form['verify_email'], '{l_verify_email}'))) {				  return false;				}				if (!(validateTwoFields(form['verify_email'],'{l_verify_email}',form['email'],'{l_email_address}'))) {				  return false;				}				if (!(validateRequiredSelect(form['orientation'],'{l_orientation}','00'))) {				  return false;				}				if (!(validateRequiredField(form['orientation'], '{l_orientation}', '00'))) {				  return false;				}				if (!(validateRequiredSelect(form['country'],'{l_country}','-1'))) {				  return false;				}				if (!(validateRequiredField(form['country'], '{l_country}', '-1'))) {				  return false;				}				if (!(validateRequiredField(form['month'], '{l_month}'))) {				  return false;				}				if (!(validateRequiredField(form['day'], '{l_day}'))) {				  return false;				}				if (!(validateRequiredField(form['year'], '{l_year}'))) {				  return false;				}				if (!(validateRequiredCheckbox(form['privacy_policy'],'','{l_agree_privete_policy}'))) {				  return false;				}				return true;			  }			  function validateJoinForm() {				blockSubmission = true;				 if (typeof beforeJoinFormValidation != 'undefined') {				   beforeJoinFormValidation();				}				var validated = onValidateJoinForm();				if (validated && (typeof uponSuccessfulJoinFormValidation != 'undefined')) {				  validated = uponSuccessfulJoinFormValidation();				}				else if (!validated && (typeof uponUnsuccessfulJoinFormValidation != 'undefined')) {				  uponUnsuccessfulJoinFormValidation();				}				if (!validated) {				}				return validated;			  }			  function submitJoinForm() {			   if (validateJoinForm()) document.JoinForm.submit();			   else return false;			  }			</script>

I can't see any reason why the form isn't working so would be grateful for any help. I don't know how to do this but I think that what needs to happen is the JS validator needs to check the security image somehow then send the results.Thanks

[real_illusions]

just a word of caution, i wouldn't rely entirely on javascript to validate your form contents or check for a security image.I would also use a server side scripting language (like php, which is the section you have posted this topic in ) Which the link you gave is written. It uses php and mysql for the script.

[unplugged_web]

just a word of caution, i wouldn't rely entirely on javascript to validate your form contents or check for a security image.I would also use a server side scripting language (like php, which is the section you have posted this topic in ) Which the link you gave is written. It uses php and mysql for the script.

Thanks, I'll change that, but for the time being I really want to get this to work. How do I get them both to work?

[king]

Thanks, I'll change that, but for the time being I really want to get this to work. How do I get them both to work?

Do you have session_start() at the top of your PHP page?

[unplugged_web]

Do you have session_start() at the top of your PHP page?

Yes, I've got that right at the very top, before:<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">I've also got this:

	function init()	{		global $g;		global $l;		global $gc;		$name = get_param("join_handle", "");		$pass = get_param("join_password", "");		$pass2 = get_param("verify_password", "");		$mail = get_param("email", "");		$mail2 = get_param("verify_email", "");		$this->message = "";		if (strlen($name) < 4 or strlen($name) > 20 or strpos($name, "'") !== false)		{			$this->message .= $l['join.php']['another_username'] . "<br>";		}		if ($mail != $mail2 or strlen($mail) > 100 or !preg_match("/^[a-zA-Z-_\.0-9]{1,100}@[a-zA-Z-_\.0-9]{1,100}\.[a-zA-Z-_\.0-9]{1,100}$/", $mail))		{			$this->message .= $l['join.php']['incorrect_email'] . "<br>";		}		if ($pass != $pass2 or strlen($pass) > 15 or strlen($pass) < 6 or strpos($pass, "'") !== false)		{			$this->message .= $l['join.php']['incorrect_password'] . "<br>";		}		if (DB::result("SELECT user_id FROM user WHERE name=" . to_sql($name, "Text") . ";") != "")		{			$this->message .= $l['join.php']['exists_username'] . "<br>";		}		if (DB::result("SELECT user_id FROM user WHERE mail=" . to_sql($mail, "Text") . ";") != "")		{			$this->message .= $l['join.php']['exists_email'] . "<br>";		}		$month = (int) get_param("month", 1);		$day = (int) get_param("day", 1);		$year = (int) get_param("year", 1980);		if ($month < 1 or $month > 12 or $day < 1 or $day > 31 or $year < 1906 or $year > date("Y") - $g['options']['users_age'] + 1)		{			$this->message .= $l['join.php']['incorrect_date'] . "<br>";		}		if ($this->message == "")		{			set_session("j_name", $name);			set_session("j_password", $pass);			set_session("j_mail", $mail);			set_session("j_month", $month);			set_session("j_day", $day);			set_session("j_year", $year);			set_session("j_country", get_param("country", 1));			set_session("j_orientation", get_param("orientation", 1));			if ($g['options']['fast_join'] == "N" and isset($gc) and $gc) redirect("join_space.php");			elseif ($g['options']['fast_join'] == "N") redirect("join2.php");			else			{				$this->add_user();				#echo get_session("user_id");				redirect("home.php");			}		}	}

But I don't know how to integrate

<?php	  // check for posted form	  if (isset($_POST['join_button'])) {		 // see if the code the user typed matched the generated code		 if (strtoupper($_POST['code']) == $_SESSION['code']) {			 header("location: jointest.php");		 } else {		   echo "You have entered the wrong code. Please try again."; 		 } 	  } else {    ?>

into it.

[king]

$l['join.php']['incorrect_security_code'] = 'Incorrect security code. Please try again.'; // Add something like that to your language file	function init()	{		global $g;		global $l;		global $gc;		$name = get_param("join_handle", "");		$pass = get_param("join_password", "");		$pass2 = get_param("verify_password", "");		$mail = get_param("email", "");		$mail2 = get_param("verify_email", "");		$captcha = get_param("code", "");		$this->message = "";		if (strtoupper($captcha) != $_SESSION['code']) {		$this->message .= $l['join.php']['incorrect_security_code'];		}		if (strlen($name) < 4 or strlen($name) > 20 or strpos($name, "'") !== false)		{			$this->message .= $l['join.php']['another_username'] . "<br>";		}		// ... Rest of your script

[unplugged_web]

$l['join.php']['incorrect_security_code'] = 'Incorrect security code. Please try again.'; // Add something like that to your language file	function init()	{		global $g;		global $l;		global $gc;		$name = get_param("join_handle", "");		$pass = get_param("join_password", "");		$pass2 = get_param("verify_password", "");		$mail = get_param("email", "");		$mail2 = get_param("verify_email", "");		$captcha = get_param("code", "");		$this->message = "";		if (strtoupper($captcha) != $_SESSION['code']) {		$this->message .= $l['join.php']['incorrect_security_code'];		}		if (strlen($name) < 4 or strlen($name) > 20 or strpos($name, "'") !== false)		{			$this->message .= $l['join.php']['another_username'] . "<br>";		}		// ... Rest of your script

Sorry I tried that, but it just gave me an error when I went to the page. It said:

Error: E_NOTICEURL: xxxxxxxx/jointest.phpFile: /home/default/xxxxxxxx/user/htdocs/jointest.phpLine: 128Message: Undefined index: code

Line 128 is:

if (strtoupper($captcha) != $_SESSION['code']) {

I've doubled checked the actual security image and that is:

<div id="security" style="padding: 5px 0 5px 0;"><img src="../../../Code/security-image.php?width=180" width="180" height="60" alt="Security Image" /></div>		 <label for="code">Enter the characters shown above: </label>

[justsomeguy]

Is security-image.php setting a session variable called code?

[unplugged_web]

Is security-image.php setting a session variable called code?

Yes the code for the security-image.php file is:

<?php   // include security image class   require('includes/security-image.inc.php');      // start PHP session   session_start();      // get parameters   isset($_GET['width']) ? $iWidth = (int)$_GET['width'] : $iWidth = 180;   isset($_GET['height']) ? $iHeight = (int)$_GET['height'] : $iHeight = 60;      // create new image   $oSecurityImage = new SecurityImage($iWidth, $iHeight);   if ($oSecurityImage->Create()) {	  // assign corresponding code to session variable 	  // for checking against user entered value	  $_SESSION['code'] = $oSecurityImage->GetCode();   } else {	  echo 'Image GIF library is not installed.';   }?>

I also tried changing the name of the variable, but that doesn't seem to work

[justsomeguy]

Well, the error says that the $_SESSION array doesn't contain a 'code' element. Have the form processing page just use print_r($_SESSION) to see what is in the session after the form gets submitted.

[unplugged_web]

Well, the error says that the $_SESSION array doesn't contain a 'code' element. Have the form processing page just use print_r($_SESSION) to see what is in the session after the form gets submitted.

Sorry to be so dumb, but how do I do that?

[Synook]

print_r($_SESSION);

[unplugged_web]

print_r($_SESSION);

Where abouts do I put that?

[Synook]

Oh sorry - on security-image.php.

[unplugged_web]

Oh sorry - on security-image.php.

I think I probably put it in the wrong place because all I got was the security image.I tried put it in different places in the code, but the results where still the same.

<?php   // include security image class   require('includes/security-image.inc.php');      print_r($_SESSION);   // start PHP session   session_start();      // get parameters   isset($_GET['width']) ? $iWidth = (int)$_GET['width'] : $iWidth = 180;   isset($_GET['height']) ? $iHeight = (int)$_GET['height'] : $iHeight = 60;      // create new image   $oSecurityImage = new SecurityImage($iWidth, $iHeight);   if ($oSecurityImage->Create()) {	  // assign corresponding code to session variable 	  // for checking against user entered value	  $_SESSION['security_code'] = $oSecurityImage->GetCode();   } else {	  echo 'Image GIF library is not installed.';   }?>

[king]

I think I probably put it in the wrong place because all I got was the security image.I tried put it in different places in the code, but the results where still the same.

<?php   // include security image class   require('includes/security-image.inc.php');      print_r($_SESSION);   // start PHP session   session_start();      // get parameters   isset($_GET['width']) ? $iWidth = (int)$_GET['width'] : $iWidth = 180;   isset($_GET['height']) ? $iHeight = (int)$_GET['height'] : $iHeight = 60;      // create new image   $oSecurityImage = new SecurityImage($iWidth, $iHeight);   if ($oSecurityImage->Create()) {	  // assign corresponding code to session variable 	  // for checking against user entered value	  $_SESSION['security_code'] = $oSecurityImage->GetCode();   } else {	  echo 'Image GIF library is not installed.';   }?>

Ok, remove the print_r($_SESSION) for now.Also, it is $_SESSION['code'] = $oSecurityImage->GetCode();You have: $_SESSION['security_code']So change that.

$l['join.php']['incorrect_security_code'] = 'Incorrect security code. Please try again.';	function init()	{		global $g;		global $l;		global $gc;		$name = get_param("join_handle", "");		$pass = get_param("join_password", "");		$pass2 = get_param("verify_password", "");		$mail = get_param("email", "");		$mail2 = get_param("verify_email", "");		$captcha = get_param("code", "");		$this->message = "";		if (isset($_SESSION['code']))		die('It works!!');		else		{			 echo 'It doesn\'t work';			 die(print_r($_SESSION));		}		if (strtoupper($captcha) != $_SESSION['code']) {		$this->message .= $l['join.php']['incorrect_security_code'];		}

See if it works...

[unplugged_web]

Ok, remove the print_r($_SESSION) for now.Also, it is $_SESSION['code'] = $oSecurityImage->GetCode();You have: $_SESSION['security_code']So change that.

$l['join.php']['incorrect_security_code'] = 'Incorrect security code. Please try again.';	function init()	{		global $g;		global $l;		global $gc;		$name = get_param("join_handle", "");		$pass = get_param("join_password", "");		$pass2 = get_param("verify_password", "");		$mail = get_param("email", "");		$mail2 = get_param("verify_email", "");		$captcha = get_param("code", "");		$this->message = "";		if (isset($_SESSION['code']))		die('It works!!');		else		{			 echo 'It doesn\'t work';			 die(print_r($_SESSION));		}		if (strtoupper($captcha) != $_SESSION['code']) {		$this->message .= $l['join.php']['incorrect_security_code'];		}

See if it works...

Okay I did that and the results I got were

It doesn't workArray ( [. xxxxxxxxx.com_user_id] => [.xxxxxxxxx.com_user_id_verify] => [. xxxxxxxxx.com_im_id] => 10148 ) 1

[king]

OK, create a new PHP file called test.php. Put the following script in that new file:

<?phpsession_start();if (!isset($_SESSION['test']))$_SESSION['test'] = 'Hello World';elseecho $_SESSION['test'];?>

Access the page once, then refresh it. See if it prints anything.

[unplugged_web]

OK, create a new PHP file called test.php. Put the following script in that new file:

<?phpsession_start();if (!isset($_SESSION['test']))$_SESSION['test'] = 'Hello World';elseecho $_SESSION['test'];?>

Access the page once, then refresh it. See if it prints anything.

Yep, first time the page was blank then when I refreshed it the page said Hello World

[king]

Yep, first time the page was blank then when I refreshed it the page said Hello World

Something odd is going on here.Make the following file: security-image.php look like this:

<?php   // include security image class   require('includes/security-image.inc.php');     // start PHP session   session_start();     // get parameters   isset($_GET['width']) ? $iWidth = (int)$_GET['width'] : $iWidth = 180;   isset($_GET['height']) ? $iHeight = (int)$_GET['height'] : $iHeight = 60;     // create new image   $oSecurityImage = new SecurityImage($iWidth, $iHeight);	  // assign corresponding code to session variable	  // for checking against user entered value	  $_SESSION['foo'] = 'foo';	  $_SESSION['code'] = $oSecurityImage->GetCode();?>

And you can view that image here right?

<div id="security"><img src="../../../Code/security-image.php?width=180" width="180" height="60" alt="Security Image" /></div>

Now, try this:

   function init()	{		global $g;		global $l;		global $gc;		$name = get_param("join_handle", "");		$pass = get_param("join_password", "");		$pass2 = get_param("verify_password", "");		$mail = get_param("email", "");		$mail2 = get_param("verify_email", "");		$captcha = get_param("code", "");		$this->message = "";		die(print_r($_SESSION));

And let me see the results.

[unplugged_web]

Something odd is going on here.Make the following file: security-image.php look like this:

<?php   // include security image class   require('includes/security-image.inc.php');     // start PHP session   session_start();     // get parameters   isset($_GET['width']) ? $iWidth = (int)$_GET['width'] : $iWidth = 180;   isset($_GET['height']) ? $iHeight = (int)$_GET['height'] : $iHeight = 60;     // create new image   $oSecurityImage = new SecurityImage($iWidth, $iHeight);	  // assign corresponding code to session variable	  // for checking against user entered value	  $_SESSION['foo'] = 'foo';	  $_SESSION['code'] = $oSecurityImage->GetCode();?>

And you can view that image here right?

<div id="security"><img src="../../../Code/security-image.php?width=180" width="180" height="60" alt="Security Image" /></div>

Now, try this:

   function init()	{		global $g;		global $l;		global $gc;		$name = get_param("join_handle", "");		$pass = get_param("join_password", "");		$pass2 = get_param("verify_password", "");		$mail = get_param("email", "");		$mail2 = get_param("verify_email", "");		$captcha = get_param("code", "");		$this->message = "";		die(print_r($_SESSION));

And let me see the results.

Okay I changed the security-image.php and didn't see anything when I went to that page. I think changed the function and the results were:

Array ( [test] => Hello World [foo] => foo

 => ) 1

[king]

Okay, we might be getting somewhere now.Change the following line:

$_SESSION['code'] = $oSecurityImage->GetCode();

To:

$_SESSION['code'] = $oSecurityImage->sCode;

Now, see what happens...

[unplugged_web]

I got the same results:

Array ( [test] => Hello World [foo] => foo

 => ) 1

[king]

Hmm... That's really weird... Does the image display properly? Also, what does your security-image.inc.php look like?

[unplugged_web]

I have to remove the

		die(print_r($_SESSION));		if (isset($_SESSION['code']))		die('It works!!');		else		{			 echo 'It doesn\'t work';			 die(print_r($_SESSION));		}

bit to get the page to display, but no the security image doesn't display at all. The security image is just a white box with a few scratchy lines and about five random letters.The code at the moment for the security image is:

<?php   // include security image class   require('includes/security-image.inc.php');     // start PHP session   session_start();     // get parameters   isset($_GET['width']) ? $iWidth = (int)$_GET['width'] : $iWidth = 180;   isset($_GET['height']) ? $iHeight = (int)$_GET['height'] : $iHeight = 60;     // create new image   $oSecurityImage = new SecurityImage($iWidth, $iHeight);	  // assign corresponding code to session variable	  // for checking against user entered value	  $_SESSION['foo'] = 'foo';	  $_SESSION['code'] = $oSecurityImage->sCode;?>

if I go to the security-image.php file itself then it's just blank