Cookies are now driving me crazy....



I have some code which I'll paste at the end of the e-mail that is throwing an error and I can't seem to find where the error is... Here is the error: "[Wed Nov 28 15:03:19 2007] [error] PHP Parse error: syntax error, unexpected '{' in /Volumes/RAIDer/webserver/Documents/ OLDB/customer/test/detectuser.php on line 27"

Now... I realize that it's not expecting a '{' on line 27... But I checked the brackets, and from what I can tell, they all look balanced...Any help is appreciated!



<?php
include('defaults.php');
include('dbconnect.php');
//see if detectuser.php has been required, not URL’d.
if ($legal_require_php!=1234) exit;
// setup global variable $global_user_id, set it to 0, which means no user as auto_increment IDs in MySQL begin with 1
$global_user_id= 0;
// now, check if user’s computer has the cookie set
if (isset($_COOKIE['cookiename'])) {
$cookieval= $_COOKIE['cookiename'];
//now parse the ID:LOGCODE value in cooke via explode() function
$cookieparsed= explode (":", $cookieval);
// $cookie_uid will hold user’s id
// $cookie_code will hold user’s last reported logcode
$cookie_uid= $cookieparsed[0];
$cookie_code= $cookieparsed[1];
// ensure that ID from cookie is a numeric value
if (is_numeric($cookie_uid)) {
//now, find the user via his ID
$res= mysql_query("SELECT logcode FROM MainLogin WHERE id=$cookie_uid");
// no die() this time, we will redirect if error occurs
if ($res) {
// now see if user’s id exists in database
if (mysql_num_rows($res,0) {
$logcode_in_base= mysql_result($res, 0);
// now compare LOGCODES in cookie against the one in database
if ($logcode_in_base == $cookie_code) {
// if valid, generate new logcode and update database
$newcode= md5(func_generate_string());
$res= mysql_query("UPDATE MainLogin SET logcode='$newcode' WHERE id=$cookie_uid");
// setup new cookie (replace the old one)
$newval= "$cookie_uid:$newcode";
setcookie("cookiename", $newval, time() + 300, "/oldb/", ".raoset.com");
// finally, setup global var to reflect user’s id
$global_user_id= $cookie_uid;
} else {
// redirect if logcodes are not equal
echo "Logcodes are not equal";
}
} else {
// redirect if user ID does not exist in database
echo "User not in database";
}
} else {
// redirect in case of database error
echo "database error";
}
} else {
// redirect if user ID in cookie not numeric
echo "Cookie not numeric";
}
}
?>
--

Jason Pruim
Raoset Inc.
Technology Manager
MQC Specialist
3251 132nd ave
Holland, MI, 49424
www.raoset.com
japruim@xxxxxxxxxx
.



Relevant Pages

  • Re: [PHP] Cookies are now driving me crazy....
    ... check if user's computer has the cookie set ... we will redirect if error occurs ... // now compare LOGCODES in cookie against the one in database ...
    (php.general)
  • [UNIX] Wordpress Cookie Authentication Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Wordpress Cookie Authentication Vulnerability ... With read-only access to the Wordpress database, ...
    (Securiteam)
  • Re: Best authentication methods for CGI <- PERL -> DBI
    ... Right now one method which seems to be really unsecured, is to take them, check them against the PW/ID stored in the database and permit/deny against that. ... The client javascript code takes the password and MD5 sums it, and sends that as the password along with the cleartext username. ... One cookie is the record id of the user in the database, ... A solution to not use https would be public key encryption. ...
    (perl.dbi.users)
  • Re: Best authentication methods for CGI <- PERL -> DBI
    ... Right now one method which seems to be really unsecured, is to take them, check them against the PW/ID stored in the database and permit/deny against that. ... The client javascript code takes the password and MD5 sums it, and sends that as the password along with the cleartext username. ... One cookie is the record id of the user in the database, ... A solution to not use https would be public key encryption. ...
    (perl.dbi.users)
  • Re: [PHP] peer review (was php framework vs just php?)
    ... the database. ... Additional arguements may be supplied to indicate columns to ... echo "<input ... single quotes in the Type column of the ...
    (php.general)