Path: csiph.com!v102.xanadu-bbs.net!xanadu-bbs.net!feeder.erje.net!eu.feeder.erje.net!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: Matthew Carter <m@ahungry.com>
Newsgroups: comp.lang.php
Subject: Re: Php login/registration page
Date: Fri, 03 Oct 2014 00:24:01 -0400
Organization: Ahungry (http://ahungry.com)
Lines: 75
Message-ID: <87ppe9vl0e.fsf@ahungry.com>
References: <844d52dc-57de-48bc-8d61-ef12d7696389@googlegroups.com> <m0fjdl$64d$1@dont-email.me> <ECKWv.296304$Q61.224596@fx13.iad> <m0gr5h$b0m$1@dont-email.me> <XnsA3BB1AEBFA590R2D2@127.0.0.1> <m0l577$4et$2@dont-email.me>
Mime-Version: 1.0
Content-Type: text/plain
Injection-Info: mx05.eternal-september.org; posting-host="7c986cd4736462de309a749b207746fe"; logging-data="16183"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX19qPXItnO1HFEe3iarB6ypN"
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux)
Cancel-Lock: sha1:FCSjq9pBuD0YD/0qQbZXXUmIvl0= sha1:T+ziDJg5yIlAjdr/JRWskLRZmvA=
Xref: csiph.com comp.lang.php:14280

While everything said so far is true, I think its all a bit
overkill for what was likely intended as a simple exercise in teaching
novice users the very basics of a registration/sign in processes (which
is something a new programmer can relate to and understand a lot more
than security considerations).

I'd think the intention of a non-database registration page would be a
page where the user fills out a form and the data posted writes to a
flat file (which is then subsequently read from for confirming a user is
registered, to access a single member only page).

Something like the following (insecure registration code follows - do
not really use this code):

<?php
function register()
{
  if(empty($_POST['id']) || empty($_POST['pass']))
    {
      throw new Exception('Both id and pass are required fields.');
    }

  $file = '/tmp/user-data';

  if(!file_exists($file))
    {
      file_put_contents($file, '');
    }

  $users = unserialize(file_get_contents($file));

  if(isset($users[$_POST['id']]))
    {
      throw new Exception(
        'That user name is already taken, please choose another!');
    }

  $users[$_POST['id']] = $_POST['pass'];
  file_put_contents($file, serialize($users));

  printf("Thank you for registering %s", $_POST['id']);
}

$err = '';

if(!empty($_POST))
  {
    try
      {
        register();
      }
    catch(Exception $e)
      {
        $err = $e->getMessage();
      }
  }
?>
<!DOCTYPE html>
<html>
  <head>
    <title>Registration</title>
  </head>
  <body>
    <span style="color:red;"><?php echo $err;?></span>
    <form name='reg' method='post' action=''>
      User: <input type='text' value='' name='id'>
      Pass: <input type='password' value='' name='pass'>
      <input type='submit'>
    </form>
  </body>
</html>

-- 
Matthew Carter (m@ahungry.com)
http://ahungry.com