0

I have a form with only a username that will allow for access to two pages depending an users authority level in an MS SQL database.

If their authority level is 10 then they will log into the 'normal' page, however anything more and they will be logged into an admin page with more functionality. This all works fine, however It's letting anything typed into the username to log in.

I'm struggling to prevent it logging in any username that isn't in the database. This is what I have so far...

$conn = odbc_connect(database connection stuff here);
$login = $_POST['login'];
$sqlquery = "SELECT u.authorityLevel, u.employeeNo, e.knownAs FROM common.dbo.users as u JOIN 
common.dbo.employees AS e on e.employeeNo = u.employeeNo WHERE u.employeeNo = '".$login."'";
$result = odbc_exec($conn, $sqlquery);
$user = odbc_fetch_array($result);
$userExists = odbc_num_rows($sqlquery);

if((isset($_SESSION['login']['logged_in']) && $_SESSION['login'] 
['logged_in'])==true){

if(isset($_POST)){
  if ((int)$user['authorityLevel'] > 10) {
    header("location: indexAdmin.php");
    $row = $user;
    $_SESSION['sessionUserName'] = $row['knownAs'];
} elseif ((int)$user['authorityLevel'] = 10) {
    header("location: confirmedJobs.php");
    $row = $user;
    $_SESSION['sessionUserName'] = $row['knownAs'];
} else ((int)$user['authorityLevel'] < 10){
    header("location: loginPage.php");
  }
 }
}
3
  • 1
    You didn't check if a record exists, $userExists = odbc_num_rows($sqlquery); you're just declaring the variable for it. Commented Mar 3, 2020 at 14:34
  • Why is there a login page if the only "security" feature is assuming no one can find out the name of an authority level > 10 account? Actually, it's enough looking over an admin's shoulder at the right moment to get full access. In addition to that, please read up on how to use "prepared statements in ODBC". Otherwise, a user named lulz'; DROP TABLE common.dbo.users; -- might come by at some point.
    – Damocles
    Commented Mar 3, 2020 at 14:42
  • 1
    That code is open to SQL injection - please check how to handle $login properly in your query
    – Nico Haase
    Commented Mar 3, 2020 at 15:21

2 Answers 2

1

You're only declaring this variable:

$userExists = odbc_num_rows($sqlquery);

but not using it.

This is the syntax to check if a record exists:

 if($userExists >0) {...}

Edit: (I overlooked something).

This line is using the wrong variable for it:

$userExists = odbc_num_rows($sqlquery);

In conjunction with:

$result = odbc_exec($conn, $sqlquery);

Therefore it should read as:

$userExists = odbc_num_rows($result);

odbc_num_rows() is used against the executed query, not the raw query.

You are also open to an SQL injection, use a prepared statement:

5
  • I added '$userExists >0' next to the ISSET($_POST) but it won't accept any username now
    – mat1986
    Commented Mar 3, 2020 at 15:00
  • 1
    @mat1986 You need to add the if($userExists >0) {...} under $userExists = odbc_num_rows($sqlquery);. The {...} is the code you want to execute inside that conditional statement. If something else is failing you, then you would have to check for errors via php's error reporting or the query itself. Commented Mar 3, 2020 at 15:01
  • Gave it a try but the issue remains the same, won't accept any username. Checked the console and error log and nothing came back. Thank you for you time though, I'll keep trying.
    – mat1986
    Commented Mar 3, 2020 at 15:12
  • @mat1986 Welcome. I overlooked something. Please reload my answer and look under Edit:. You used the wrong variable. Commented Mar 3, 2020 at 15:19
  • Ah you got it. Knew it was something inconspicuous. Thank you so much :)
    – mat1986
    Commented Mar 3, 2020 at 15:20
0

anything you fill in will make isset($_POST) return true. Once you're in that if-then block, any choice leads to a page.

How about :

if(isset($_POST) && $userExists)
{
   ...
}
1
  • Thanks for getting back. Gave it a try but it's not giving access to any username now, even one I've confirmed exists in the database
    – mat1986
    Commented Mar 3, 2020 at 14:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.