SRL Archive - Web Development

I'm trying to make a small remote login script, using SCAR and PHP, just to play around, but I'm having a bit of a problem.

PHP Code:

[PHP]<?php
$User = $_POST['TheUsername'];
$Pass = $_POST['ThePassword'];
$GoodUser = 'username';
$GoodPass = 'password';
if ($GoodUser = $User and $GoodPass = $Pass) {
echo 'Thank you ;)';
} else {
echo 'Invalid username or password';
}
?>[/PHP]

SCAR Script:

program New;

var
  Client: Integer;
  ClientData: String;

begin
  Client := InitializeHTTPClient(True, True);
  ClearPostData(Client);
  AddPostVariable(Client, 'TheUsername', 'username');
  AddPostVariable(Client, 'ThePassword', 'password');
  ClientData := PostHTTPPageEx(Client, 'http://68.40.80.30:7400/Login.php');
  Writeln(ClientData);
end.

The problem:

Basically, it doesn't work :)

If I comment out one of the AddPostVariable, it registers as an invalid login. As it should.

If I run the script as-is, it registers as a correct login.

If I just change one of the variable values to something else:

AddPostVariable(Client, 'TheUsername', 'username111');

It too registers as a valid login :rolleyes:

Please help? I'm still quite new to PHP, but I'm learning :)

So basically what the SCAR script does is call a page on a remote server, and logs into it? The remote page being the PHP code?

That is correct.

First off, always, ALWAYS, hash your passwords. You never know if your script might be pulled as plaintext from your webserver.

[PHP]<?php
$Password = "password";

// Hash $Password with an SHA-1 algorithm and save it as $PHash
$PHash = sha1($Password);

echo $PHash;
?>[/PHP]

^ This will return a hash of 5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8.

Now, we can modify your script to support hashing:

[PHP]
<?php
$User = $_POST['username'];
$Pass = sha1($_POST['password']);
$GoodUser = 'username';
$GoodPassHash = '0bd181063899c9239016320b50d3e896693a96df';
if ($User == $GoodUser and $Pass == $GoodPassHash) {
echo 'Thank you ;)';
} else {
echo $Pass;
echo 'Invalid username or password';
}
?>
[/PHP]

You'll notice that your issue was that you were using the PHP assignment operator "=" rather than the double equal sign comparison operator "==".

Also, SCAR seems to add garbage characters to the end of a POSTed string, so you'll either have to write a PHP function to strip them out before hashing, or base your hash off the garbage characters, as I have here. I'll leave that task to you.

ok, your PHP code should be:

[PHP]
<?php
$User = $_POST['TheUsername'];
$Pass = $_POST['ThePassword'];
$GoodUser = 'username';
$GoodPass = 'password';
if ($GoodUser == $User && $GoodPass == $Pass) {
echo 'Thank you ;)';
} else {
echo 'Invalid username or password';
}
?>
[/PHP]

You need double "=" signs and instead of "and" it's "&&"
:)

Test it now and get back to me.

Edit:
I made my own just quickly to use as an example. You can use the code and edit it, if you want, or just learn of it:

The PHP:
[PHP]
<?php
$Username = $_POST['username'];
$Password = $_POST['password'];

echo "You entered ".$Username." & ".$Password;

$CorrectUser = "testing";
$CorrectPass = "testing";

if ($Username == $CorrectUser && $Password == $CorrectPass){
echo "This is Correct!";
} else {
echo "Incorrect!";
}
?>
[/PHP]

The SCAR:

var Client: Integer;
var s, URL: String;
begin
  Client:= InitializeHTTPClient(True, True);
  URL:= 'http://kaney.freehostia.com/random/scarlogin.php';
  s:= PostHTTPPage(Client, URL, 'username=testing&password=testing');
  Writeln(s);
end.

:D

Ah, I feel so special, and so stupid at the same time :p

What exactly is a password hash?

And I replaced the ='s with =='s, and "and" with "&&" but it just returns an invalid password each time.

I tried copying what you said my PHP code should be, and using that as-is, but it's not working. I assume it has to do with my SCAR Script?

Here it is again:

program New;

var
  Client: Integer;
  ClientData: String;

begin
  Client := InitializeHTTPClient(True, True);
  ClearPostData(Client);
  AddPostVariable(Client, 'TheUsername', 'username');
  AddPostVariable(Client, 'ThePassword', 'password');
  ClientData := PostHTTPPageEx(Client, 'http://68.40.80.30:7400/Login.php');
  Writeln(ClientData);
end.

Try:

That should work…
If not, try my two scripts-
'Cause i know they definitely work. :|
Tested them.

var
  Client: Integer;
  ClientData: String;

begin
  Client := InitializeHTTPClient(True, True);
  ClientData := PostHTTPPage(Client, 'http://68.40.80.30:7400/Login.php', 'TheUsername=username&ThePassword=password');
  Writeln(ClientData);
end.

Hmm, they work, but you're not supposed to have the PostData set up like that, are you?

From: Jason2gs
Hmm, they work, but you're not supposed to have the PostData set up like that, are you?

Uh, you can.
It works doesn't it?
As long as it does its job, who cares how it is set up.

I suppose :)

I'd still like to try and find out why mine didn't work. It looks like it should.

Thanks for your help!

From: Jason2gs
I suppose :)

I'd still like to try and find out why mine didn't work. It looks like it should.

Thanks for your help!

*Feels extremely overshadowed and invisible by XxKanexX's presence.*

Mine was working properly. And I used hashing, didn't I?

Wait, it's like you said. SCAR adds a few spaces to the end of "username" and "password".

Why does SCAR do this? Can I stop it somehow?

Edit: Never mind, got it working :)

This is what I was working on. Just a small form:

program New;

var
  frmDesign : TForm;
  Label1 : TLabel;
  Label2 : TLabel;
  Edit1 : TEdit;
  Edit2 : TEdit;
  Button1 : TButton;

procedure Login(Sender: TObject);
var
  Client: Integer;
  ClientData: String;
begin
  Client := InitializeHTTPClient(True, True);
  ClearPostData(Client);
  ClientData := PostHTTPPage(Client, 'http://68.40.80.30:7400/Login.php', 'TheUsername=' + LowerCase(Edit1.Text) + '&ThePassword=' + LowerCase(Edit2.Text));
  Writeln(ClientData);
end;

procedure InitForm;
begin
  frmDesign := CreateForm;
  frmDesign.Left := 250;
  frmDesign.Top := 114;
  frmDesign.Width := 236;
  frmDesign.Height := 178;
  frmDesign.Caption := 'Login Test';
  frmDesign.Color := clBtnFace;
  frmDesign.Font.Color := clWindowText;
  frmDesign.Font.Height := -11;
  frmDesign.Font.Name := 'MS Sans Serif';
  frmDesign.Font.Style := [];
  frmDesign.Visible := False;
  frmDesign.PixelsPerInch := 96;
  Label1 := TLabel.Create(frmDesign);
  Label1.Parent := frmDesign;
  Label1.Left := 5;
  Label1.Top := 25;
  Label1.Width := 93;
  Label1.Height := 20;
  Label1.Caption := 'Username :';
  Label1.Font.Color := clWindowText;
  Label1.Font.Height := -16;
  Label1.Font.Name := 'MS Sans Serif';
  Label1.Font.Style := [fsBold];
  Label1.ParentFont := False;
  Label2 := TLabel.Create(frmDesign);
  Label2.Parent := frmDesign;
  Label2.Left := 5;
  Label2.Top := 60;
  Label2.Width := 88;
  Label2.Height := 20;
  Label2.Caption := 'Password :';
  Label2.Font.Color := clWindowText;
  Label2.Font.Height := -16;
  Label2.Font.Name := 'MS Sans Serif';
  Label2.Font.Style := [fsBold];
  Label2.ParentFont := False;
  Edit1 := TEdit.Create(frmDesign);
  Edit1.Parent := frmDesign;
  Edit1.Left := 100;
  Edit1.Top := 25;
  Edit1.Width := 121;
  Edit1.Height := 21;
  Edit1.TabOrder := 8;
  Edit1.Text := '123Username321';
  Edit2 := TEdit.Create(frmDesign);
  Edit2.Parent := frmDesign;
  Edit2.Left := 100;
  Edit2.Top := 60;
  Edit2.Width := 121;
  Edit2.Height := 21;
  //Edit2.PasswordChar := '*';
  Edit2.TabOrder := 9;
  Edit2.Text := '123Password321';
  Button1 := TButton.Create(frmDesign);
  Button1.OnClick := @Login;
  Button1.Parent := frmDesign;
  Button1.Left := 75;
  Button1.Top := 99;
  Button1.Width := 75;
  Button1.Height := 25;
  Button1.Caption := 'Login!';
  Button1.TabOrder := 10;
end;

procedure SafeInitForm;
var
  v: TVariantArray;
begin
  SetArrayLength(v, 0);
  ThreadSafeCall('InitForm', v);
end;

procedure ShowFormModal;
begin
  frmDesign.ShowModal;
end;

procedure SafeShowFormModal;
var
  v: TVariantArray;
begin
  SetArrayLength(v, 0);
  ThreadSafeCall('ShowFormModal', v);
end;

begin
  SafeInitForm;
  SafeShowFormModal;
end.

See? My standards are getting better :p

Hey good job. Glad you got it to work! :)

Do tell what you plan on doing with this. Maybe a new open source auth package? ;)

By the way, remember to free your form by using this code at the end of your script.

  FreeForm(frmDesign); // Frees the form from memory.

Ah yes, forgot FreeForm :)

I do have something in mind, but it's not a solid enough idea to mention it to anybody yet :)

Then… it must be a GAME! :) Right?

Tell me!!@@!!!! lol.