[Matthean]

I even went and grabbed the code that came with the book and the author's version isn't working either. Offhand not seeing anything that sticks out as being wrong. The post variables seem to be obviously not getting passed as it always displays the form.

<?php
// create short names for variables
$name	 = $POST['name'];
$password = $POST['password'];

if (empty($name) || empty($password)) {
	// Visitor needs to enter a name and password
?>
	<h1>Please Log In</h1>
	This page is secret.
	<form method="post" action="secret.php">
		<table border="1">
			<tr>
				<th>Username</th>
				<td><input type="text" name="name" /></td>
			</tr>
			<tr>
				<th>Password</th>
				<td><input type="password" name="password" /></td>
			</tr>
			<tr>
				<td colspan="2" align="center">
					<input type="submit" value="Log In" />
				</td>
			</tr>
		</table>
	</form>
<?php
	}
	else if ($name=='user'&&$password=='pass') {
		//visitor's name and passowrd combination are correct.
		echo '<h1>Here it is!</h1>';
		echo 'I bet you are glad you can see this secret page.';
	}
	else {
		//visitor's name ansd password combination are not correct
		echo '<h1>Go Away!';
		echo 'You are not authorized to view this resource.';
	}
?>

[Karl Buckland]

This:

$POST['name'];

is not valid!

You need to use:

$_POST['name'];

It's quite worrying that a book would contain such a fundamental error...

[Matthean]

Sirkent, on Jan 15 2009, 12:03 PM, said:

This:

$POST['name'];

is not valid!

You need to use:

$_POST['name'];

It's quite worrying that a book would contain such a fundamental error...

Actually, the missing underscore was my error. The book's downloaded version of the code doesn't even use the POST variables. It was just using this...

if(!isset($name)&&!isset($password))

Which again, didn't seem to work.

I do have two different editions of the same book, so I'm wondering if the CD I grabbed the code from was from the older edition.

[Karl Buckland]

Possibly - just using $name involves having PHP's register_global's setting set to 'on', which has been regarded as a dangerous thing to do for the past several years.

[haku]

And on that note, I would recommend scrapping that book. Any book that is relying on outdated, non-secure methods is probably not a good book to be learning from.

[Matthean]

haku, on Jan 17 2009, 08:35 AM, said:

And on that note, I would recommend scrapping that book. Any book that is relying on outdated, non-secure methods is probably not a good book to be learning from.

FYI, the book is "PHP and MySQL Web Development" which generally gets great reviews. I actually just looked up the old version of the book(2nd ed., 2003) I have and found out that's the CD I used for the code archive. I somewhat moved recently so I have no idea where the CD for the more current book(3rd ed.) is at. The publisher doesn't have a downloadable code archive either.

[Karl Buckland]

It was a good book when I used it - about 5 years ago. Now I wouldn't be so sure, but if you read up on the newer methods and security suggestions then I think you'll be fine.

[EncoderDecoder]

First, its $_POST.. not $POST..

[Smith01]

Your support is much appreciated.
It works now !!!