mysql - how to check if password contains username in php -


this code. trying add 1 more step if entered password contains entered username returns error pass cannot contain username. talking 'contains', , not wholy password. in case elseif($password == "$user_username") $error .= $lang['46'];}

also thank full if can tell me vulnerablties in script

$user_username = cleanit($_request['username']);     stemplate::assign('user_username',$user_username);     $password = cleanit($_request['password']);     stemplate::assign('password',$password);     if($user_username == "")     {         $error .= $lang['41'];  //error: please enter username     }     elseif(strlen($user_username) < 4) //your username should have 4 chars      {         $error .= $lang['42'];       }     elseif(!preg_match("/^[a-za-z0-9]*$/i",$user_username)) //name contains letters , numbers     {         $error .= $lang['43'];     }     elseif(!verify_email_username($user_username)) //username taken     {         $error .= $lang['44'];     }     elseif($password == "") //no password entered     {         $error .= $lang['45'];       }       if($error == "")     {         $sid = intval($_session['userid']);         $pw = md5($password);         $query="update members set username='".mysql_real_escape_string($user_username)."', password='".mysql_real_escape_string($pw)."', pwd='".mysql_real_escape_string($password)."' userid='".mysql_real_escape_string($sid)."'";         $result=$conn->execute($query);         $_session['username']=$user_username;         header("location:$config[baseurl]/welcome");exit;     }

just append condition: 

elseif(stristr($password, $username) !== false) // password contains username {     $error .= $lang['46'];   }

Comments

Post a Comment

Popular posts from this blog

jquery - Invalid Assignment Left-Hand Side -

i trying assign class tag via jquery, resulting in error through firebug says "invalid assignment left-hand side" on fourth line below. <cfoutput> $('.pngfix a').each(function(index) { var hreflink = $(this).attr("href"); if (hreflink.tolowercase() = '../audio.cfm') { $(this).addclass('audioimg'); } }); </cfoutput> looking around online, looks syntax problem, don't seem see it... any tips? thanks if (hreflink.tolowercase() = '../audio.cfm') that attempts assign value, rather check equality. change = operator == .
Read more

java - Play! framework 2.0: How to display multiple image? -

i need display gallery of photos. here template: @(photos: list[photo]) @title = { <bold>gallery</bold> } @main(title,"photo"){ <ul class="thumbnails"> @for(photo <- photos) { <li class="span3"> <a href="#" class="thumbnail"> <img src="@photo.path" alt=""> </a> </li> } </ul> } and here controller method: public static result getphotos() { return ok(views.html.photo.gallery.render(photo.get())); } and here photo bean : @entity public class photo extends model { @id public long id; @required public string label; public string path; public photo(string path, string label) { this.path = path; this.label = label; } private static finder<long, photo> find = new finder<long, photo>( long.class, photo.class); public static list<phot...
Read more

gmail - Is there any documentation for read-only access to the Google Contacts API? -

i want read-only access user's google contacts. there stackoverflow member wanted this, , received following answer : yes, there is, use https://www.googleapis.com/auth/contacts.readonly scope , "view contacts". this exchange reference read-only access google contacts can find using google. simply using access token obtained attempt read usual google contacts api (i.e. https://www.google.com/m8/feeds ) fails insufficient permissions. similarly, using google contacts api on new target fails 404 errors (for example https://www.googleapis.com/auth/contacts.readonly/default/full ). is there documentation anywhere on how use api, or permissible way access google contacts api full read-write access?
Read more