Create an application that will give valuable advice to future students from someone (you!) who is close to graduation. However, only end-users who have their credentials validated against the database (which uses encrypted passwords) are allowed entry.
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
advice_ddl.sql
CREATE DATABASE advice;
USE advice;
CREATE TABLE users
(
id int primary key auto_increment,
username varchar(255),
password varchar(255)
);
-- insert a row into the users table:
-- username = foo
-- password = bar
INSERT INTO users (username, password) VALUES ('foo',
'$2y$10$IWDcVmWIHlx5nI5A.18gNOUDoJZgdfWJwFMamea9JaUK9M.iTx8g.');
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
authenticate.php
<?php
// 1. validate the form input (set $_SESSION['error'] if there
is a problem)
// (make sure that neither form input is blank and use the
w3schools Form
// Validation funtion to "scrub" all form data)
// 2. create a database connection (using the standard root
user)
// 3. select the password from the users table (where the username
came from
// the form)
// 4. use password_verify to see if the form password matches the
hashed
// password from db: password_verify($pwdFromFrom, $dbPwd) returns
a boolean
// 5. forward user to index.php
// 6. allow execution to continue and close db connection
?>
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
advice.php
<?php
// Make sure that only users who have been authenticated via the
database
// can access this page.
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title></title>
</head>
<body>
<!-- display your advice to future UNA students here
-->
</body>
</html>
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
index.php
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title></title>
</head>
<body>
<?php
// 1. display the error message in the session (if any)
// 2. display either the user's name and a link to your advice page
// or the form below
?>
<form action="authenticate.php" method="post">
Username: <input type="text" name="user"><br>
Password: <input type="password" name="pwd"><br>
<input type="submit">
</form>
</body>
</html>
<!DOCTYPE html>
<html>
<head>
<title>Authentication</title>
</head>
<body>
<form method="post" action="">
<?php
$servername = "localhost";
$username = "foo";
$password = "bar";
$dbname = "advice";
// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
die("Connection failed: " . $conn->connect_error);
}
$sql = "SELECT password FROM users";
$result = $conn->query($sql);
if ($result->num_rows > 0) {
// output data of each row
while($row = $result->fetch_assoc()) {
echo "<br> password: ". $row["password"]. "<br>";
}
} else {
echo "0 results";
}
$conn->close();//Database connection close
?>
</form>
</body>
</html>
Get Answers For Free
Most questions answered within 1 hours.