connection request
54 views
Skip to first unread message
graig...@gmail.com
May 29, 2016, 1:11:14 PM5/29/16
to CodenameOne Discussions
IDE: Eclipse
Windows OS:8.1
Simulator Android/iOS
Device Android/iOS
I am trying to validate user credential from my app login page within codename1 by accessing a web sever php code that validates the user login credential against a database on the web server.
i have little idea about the connection form my codename1 app to the php web server script can anyone provide a little clarity please. i need to help with understanding the
Connection request and connecting to the php script that performs the validation and return the result to m app.
here is a copy of my php script
<?php
session_start();
if($_POST)
{
$username=$_POST['Name'];
$password=$_POST['pass'];
//Pull file into program to retrieve username,password,database name and server name
$file1=file(path to text file);
//use to stor values from topsecret file into varibles
$dbserver=trim($file1[0]);
$uid=trim($file1[1] );
$pw=trim($file1[2]);
$dbname=trim($file1[3]);
//connect to database with varibles
$link=mysqli_connect($dbserver, $uid, $pw, $dbname)
or die('could not connect:'. mysqli_error($link));
//sql query to display data that matches price range and product
$query = 'Select * from users where username LIKE"%' . $username . '"
and password LIKE "%'. $password .'%"';
$query = mysqli_query($link, $query) or die('query failed'. mysqli_error($link));
$num=(mysqli_num_rows($query));
//if user values doesnt matches any value in the database javascript is executed and infrom user that no product fits thier values
if($num <1){
echo '<script language="javascript">';
echo 'alert("Login Credentials invalid")';
echo '</script>';
echo '<script type="text/javascript">
window.location = "http://zenit.senecac.on.ca:port#/lab5/login.php"
</script>';
}
if($num >0)
{
$_SESSION['user']=$username;
header("Location: http://zenit.senecac.on.ca:17362/cgi-bin/lab5/protectedstuff.php");
}
}
?>
<html>
<title>Login Page</title>
</head>
<body>
<h1>Login Information</h1>
<form method="POST" action"facebook.com">
<tr>
<td> Username:</td>
<td><input name="Name" type="text" value=""></td> <td> <?php echo $erone; ?></td>
</tr>
<br><br>
<tr>
<td>Password:</td>
<td><input name="pass" type="password" value=""></td><td> <?php echo $ertwo; ?></td>
</tr>
<tr><td><br></td></tr>
<tr>
<td></td>
<td><input name="submit" type="submit"></td>
</tr>
</form>
</body>
</html>
Shai Almog
May 30, 2016, 12:25:24 AM5/30/16
to CodenameOne Discussions, graig...@gmail.com
I'm afraid I don't know PHP so I can't really tell what you are trying to accomplish. I suggest defining what you need from the server?
Cookie? Token?
Something else?
Cookie? Token?
Something else?
Steve Hannah
May 31, 2016, 4:38:23 PM5/31/16
to codenameone...@googlegroups.com, graig...@gmail.com
That login script isn't ideal as a web service login script. On top of that it has some problems in general. Some of these general problems include:
1. Your SQL query to check for a match is open to an SQL injection attack.
2. This same query will match any username that ends with the provided username, and contains the provided password. Therefore I can login using a blank username and password, and the login will work.
3. You should call exit after sending your redirect header.
Generally for a web service login script, I prefer to output some XML or JSON that can be parsed easily. That said, you could still make this work by just looking for patterns in the HTTP response to determine whether the login worked. Your session is managed PHP, and it will return a phpsessid cookie. If you include this cookie in all future requests, then it would retain the session for its lifetime.
Steve
--
You received this message because you are subscribed to the Google Groups "CodenameOne Discussions" group.
To unsubscribe from this group and stop receiving emails from it, send an email to codenameone-discu...@googlegroups.com.
Visit this group at https://groups.google.com/group/codenameone-discussions.
To view this discussion on the web visit https://groups.google.com/d/msgid/codenameone-discussions/f609db51-8e87-41b5-b37e-965b4877099d%40googlegroups.com.
Reply all
Reply to author
Forward
0 new messages