My Login Server Account Tool

[KingMort]

Alright so basically searched online for something similar and just used that then tweaked it to my needs and it seems to work pretty good but I figured I would share it with everyone and hopefully get some development done since i'm only semi savvy with code.

Basically what this script does is the user types in an Account Name, Current Loginserver Account ID, and a New Password.

The script checks to make sure the account name isn't in use or the loginserveraccountID and then encrypts the password with sha encryption and places the entry in the appropriate table in this case tblloginserveraccounts.

Now where I get stuck is where I need to probably Cross Reference the LoginServerID's from the Login Server database with the accounts table on my server to make sure that both match before it approves it and writes the entry into the Login Servers table that way people can't just put in some random number and have it end up with some one elses account (Which i believe won't work anyway right now because i tried it and wouldn't get me even to char select)

Also what I would like to do is advance this thing some what so it's more of an Admin Panel so to speak so that people could view their login server accounts based on their email and also add and delete them. But more importantly the ability to create NEW Login server accounts which won't conflict with any of the eqemu login server account ID's so would have to start them probably at a Higher number than any of the current Eqemu LS account ID's.. (I'm up for ideas there)

Anyway this is the script for what I have now, add this to your website if you like feel free to use it and upgrade it but when you upgrade it please let me know if you could guys because I wouldn't mind having it upgraded with the stuff I talked about above.

Raid Addicts Login Server Signup Form<br>
Please <a href="http://wiki.raidaddicts.org/index.php?title=Converting_Your_Loginserver_Accoun t">CLICK HERE</a> for Instructions

<?php
// Database connection info
$host = "YourHost";
$user = "YourUsername";
$pw = "YourPassword";
$db = "LoginServer Database Name";


// Connect to database
mysql_connect($host, $user, $pw) or die(mysql_error());
mysql_select_db($db) or die(mysql_error());


//This code runs if the form has been submitted
if ((isset($_POST['submit']) && isset($_POST['submit']) && $_POST['submit'] == 'Register') ):

// Form has been submitted, proceed to check fields and register

$errormsg = '';

if ( !$_POST['AccountName'] | !$_POST['pass'] | !$_POST['pass2'] ) {
$errormsg = 'You did not complete all of the required fields';
die($errormsg);
}

// checks if the AccountName is in use

if (!get_magic_quotes_gpc()) {
$_POST['AccountName'] = addslashes($_POST['AccountName']);
}

$usercheck = $_POST['AccountName'];

$check = mysql_query("SELECT AccountName FROM tblloginserveraccounts WHERE AccountName LIKE '$usercheck'")

or die(mysql_error());

$check2 = mysql_num_rows($check);



// if the name exists it gives an error

if ($check2 != 0) {

die('Sorry, the AccountName '.$_POST['AccountName'].' is already in use.');

}


// checks if the LS ID is in use

if (!get_magic_quotes_gpc()) {

$_POST['LoginServerID'] = addslashes($_POST['LoginServerID']);

}

$loginid = $_POST['LoginServerID'];

$check = mysql_query("SELECT LoginServerID FROM tblloginserveraccounts WHERE LoginServerID LIKE '$loginid'")

or die(mysql_error());

$check2 = mysql_num_rows($check);



// if the name exists it gives an error

if ($check2 != 0) {

die('Sorry, the LoginServerID '.$_POST['LoginServerID'].' is already in use.');

}



// this makes sure both passwords entered match

if ($_POST['pass'] != $_POST['pass2']) {

die('Your passwords did not match. ');

}



// here we encrypt the password and add slashes if needed

$_POST['pass'] = sha1($_POST['pass']);


if($_POST['LoginServerID'] == ''){
$_POST['LoginServerID'] = $_POST['pass'];
}

// now we insert it into the database
/* Should match something like this

insert into tblLoginServerAccounts (LoginServerID, AccountName, AccountPassword, AccountEmail, LastLoginDate, LastIPAddress) values('loginserverid', 'loginservername', sha('password'), 'email@email.com', now(), '127.0.0.1')

*/
$insert = "INSERT INTO tblloginserveraccounts (LoginServerID, AccountName, AccountPassword, AccountEmail, LastLoginDate, LastIPAddress)
VALUES (
'{$_POST['LoginServerID']}',
'{$_POST['AccountName']}',
'{$_POST['pass']}',
'{$_POST['none@none.com']}',
NOW(),
'127.0.0.1')";

$add_member = mysql_query($insert);

if(!$add_member){
echo "<pre>";
echo mysql_error();
echo "</pre>";
die();
}


?>




<h1>Registered</h1>
<p>Thank you, you have registered - you may now login</a>.</p>
<?php

else:
?>

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
<table border="0">
<tr><td>* AccountName:</td><td>
<input type="text" name="AccountName" maxlength="60">
</td></tr>
<tr><td>LoginServerID:</td><td>
<input type="text" name="LoginServerID" maxlength="10">
</td></tr>
<tr><td>* Password:</td><td>
<input type="password" name="pass" maxlength="10">
</td></tr>
<tr><td>* Confirm Password:</td><td>
<input type="password" name="pass2" maxlength="10">
</td></tr>
<tr><th colspan=2><input type="submit" name="submit" value="Register"></th></tr></table>
<h5>* = Required</h5>
</form>



<?php
endif;






?>

[KingMort]

Do not use this tool.. SQL Injections are possible with it.

Anyone have any advice as to how to lock this up so thats not possible?

Mort

[Akkadius]

I give props for at least sharing some of this stuff. Some people may find it useful.

[image]

It is called mysql_escape_string..

[Caryatis]

I found it useful ;-)

[Tabasco]

Insert at the top.



function sanitize_input(&$request)
{
$request = mysql_real_escape_string($request);
}

array_walk_recursive($_POST, 'sanitize_input');

[KingMort]

Nice that will lock it down ?

[Tabasco]

That will take each posted string and escape special characters for insertion into the current database. I should have specified to insert at the top after the database connection is established.

You're already using quotes so unless there's a hole in that PHP function you should be fine.
You could also add some preg_replace lines to strip out any characters that aren't allowed in any given field.

[KingMort]

I wish i could just figure out how to integrate it into my forums, or my drupal site or something instead .. Doubt eqemu will want to release that code though for their USER CP (Login Server Creation) section though right ?

[image]

I wish i could just figure out how to integrate it into my forums, or my drupal site or something instead .. Doubt eqemu will want to release that code though for their USER CP (Login Server Creation) section though right ?

Except eqemu integrates into vbulletin - I don't see how this would help you.