Redirect python script to another python script for validation of login credentials

Question

I have a login python script in which i want to take the username and password and pass it to another python script which validates the username and password with the values in the database. If the user exists, it will create a cookie with the username value set in the cookie and redirect to the next page, otherwise, it will bring it back to the previous page.

this is my index.py code:

#!/usr/bin/python
import cgi;
import cgitb;
import sqlite3;
import os;
import Cookie;
import sys;



cgitb.enable()
form= cgi.FieldStorage()
username= None
userID = None
userPW= None

#Open connection
conn= sqlite3.connect("manager.db")
cur= conn.cursor()





def createdb():
    ###Create table login
    conn.execute(""" CREATE TABLE login (userid INTEGER PRIMARY KEY ,
    username TEXT, passwrd TEXT)""")
    ##
    ###Create table excursion
    conn.execute(""" CREATE TABLE excursion (excurid INTEGER PRIMARY KEY,
    location TEXT, excurDate TEXT, excurTime TEXT, user INTEGER, FOREIGN KEY(user) REFERENCES login(userid))""")
    ##
    #Create table sighting
    conn.execute(""" CREATE TABLE sighting (sightid INTEGER PRIMARY KEY,
    species TEXT, observation TEXT, loginuser INTEGER, userexcursion INTEGER, FOREIGN KEY(loginuser, userexcursion) REFERENCES excursion (user, excurid))""")
    ##
    #Insert username and password in login table
    conn.execute("""INSERT INTO login (userid,username,passwrd) VALUES(NULL,'Diego','diego')""")
    conn.commit()

    #Insert dummy data in excursion table
    conn.execute("""INSERT INTO excursion (excurid,location,excurDate,excurTime,user) VALUES(NULL,'Macquarie','04/01/2012','6:00pm',1)""")
    conn.execute("""INSERT INTO excursion (excurid,location,excurDate,excurTime,user) VALUES(NULL,'Carlton','04/05/2012','7:00am',1)""")
    conn.commit()

    #Insert dummy data in sighting table
    conn.execute("""INSERT INTO sighting (sightid,species,observation,loginuser,userexcursion) VALUES(NULL,'Duck','long beak',1,1)""")
    conn.execute("""INSERT INTO sighting (sightid,species,observation,loginuser,userexcursion) VALUES(NULL,'Parrots','beautiful and colorful',1,2)""")
    conn.commit()
    conn.close()       



if not os.path.exists("manager.db"):
    createdb();

#define start of page
pagehead1= """
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
    "http://www.w3.org/TR/html4/loose.dtd">
    <html>
    <head>
        <title> Home </title>
        <link rel='stylesheet' type='text/css' href='/index.css/'/>
    </head>

    <body>
"""

pagehead2="""

        <form method=POST action="http://localhost:8000/cgi-bin/validate.py">
            <div id="container">
                <div id="header">
                    <h1> Field Note Manager </h1>
                    <p class= "description"> Observe...Record...Save! </p>
                </div>

                <div id="wrapper">
                    <div id="content">
                        <p> Username: <input type="text" name="usernameLogin"/> </p>
                        <br/>
                        <p> Password: <input type="password" name="passwordLogin"/> </p>
                        <br/>
                        <p id="login"> <input type="submit" name="loginBtn" value="Login"/> </p>
                    </div>
                </div>

                <div id="footer">
                    <p> Copyright 42578647, 2012 </p>
                </div>
            </div>
    """

pagefoot= """ </form>
                  </body>
                  </html> """

print "Content_type: text/html\n\n"
print pagehead1
print pagehead2
print pagefoot

and this is my code for the validation of the username with the database:

#! usr/local/bin/python
import cgi;
import cgitb;
import Cookie;
import os;
import sqlite3;

#open connection
conn= sqlite3.connect("manager.db")
cur= conn.cursor()

username= None
form= cgi.FieldStorage()

UserPW= [form.getvalue('usernameLogin'), form.getvalue('passwordLogin')]
isValidate = validate(UserPW);

if isValidate == 1:
    print "Content_type: text/html\n\n"
    print """
    <html>
        <head> Redirecting </head>
        <body>
            <form method= POST action="http://localhost:8000/cgi-bin/page1.py">
            <p> Validated! <input type="submit" value="Enter"/> </p>
            </form>
        </body>
    </html> """
elif isValidate == 0:
    print "Content_type: text/html\n\n"
    print """
    <html>
        <head> Redirecting </head>
        <body>
            <form method=POST action= "http://localhost:8000/cgi-bin/index.py">
                <p> Username or Password incorrect! <input type="submit" value="Go back"/> </p>
            </form>
        </body>
    </html>
    """



def validate(UserPW):
    sql= "SELECT * FROM login"
    userPWDatabase=cur.execute(sql)
    cur.fetchall()
    for record in userPWDatabase:
        if record == UserPW:
            #Create cookie
            C= Cookie.SimpleCookie()
            #take the value of the index.py form variable username
            username= form.getvalue('usernameLogin')
            #set the cookie with the usernameLogin key
            C['usernameLogin']= username
            print C
            return 1
        else:
            return 0

I don't know where is the problem

Alexis · Accepted Answer · 2012-04-24 10:44:49Z

1

Could you please give more details than "I don't know where is the problem": what exactly happens, what log messages you get if there are some.

Have you tried to move the "validate" function definition before it's called? I think this can be part of your problem.

Update: after some investigations and few fixes, I got it working:

As said previously, the "validate" function definition should be set before it's called
Your sql query is not correct, as "SELECT * FROM login" will return 3 fields ( id, username and passwrd), so you should change it to "SELECT username,passwrd FROM login"
The record returned by sqlite is a tuple, and you're trying to compate it to a list, so there's a TYPE mismatch. One solution if to change to : "if list(record) == UserPW:"

Also, under ubuntu looking at /var/log/apache2/error.log helps a lot.

Which finally led to:

#!/usr/bin/env python

import cgi;
import cgitb;
import Cookie;
import os;
import sqlite3;

#open connection
conn= sqlite3.connect("manager.db")
cur= conn.cursor()

username= None
form= cgi.FieldStorage()


def validate(UserPW):
      sql= "SELECT username,passwrd FROM login;"
      cur.execute(sql)
      userPWDatabase=cur.fetchall()
      for record in userPWDatabase:
          if list(record) == UserPW:
              #Create cookie
              C= Cookie.SimpleCookie()
              #take the value of the index.py form variable username
              username= form.getvalue('usernameLogin')
              #set the cookie with the usernameLogin key
              C['usernameLogin']= username
              print C
              return 1
          else:
              return 0              



UserPW= [form.getvalue('usernameLogin'), form.getvalue('passwordLogin')]
isValidate = validate(UserPW);

if isValidate == 1:
      print "Content-type: text/html\n\n"
      print """
      <html>
          <head> Redirecting </head>
          <body>
              <form method= POST action="http://localhost:8000/cgi-bin/page1.py">
              <p> Validated! <input type="submit" value="Enter"/> </p>
              </form>
          </body>
      </html> """
elif isValidate == 0:
      print "Content-type: text/html\n\n"
      print """
      <html>
          <head> Redirecting </head>
          <body>
              <form method=POST action= "http://localhost:8000/cgi-bin/index.py">
                  <p> Username or Password incorrect! <input type="submit" value="Go back"/> </p>
              </form>
          </body>
      </html>
      """

edited Apr 24, 2012 at 10:44

answered Apr 24, 2012 at 9:01

Alexis

7159 silver badges35 bronze badges

Sign up to request clarification or add additional context in comments.

8 Comments

user1353190 Over a year ago

yes i just moved the validate function rite now. The problem is that i just get a blank page. it doesnt move to the next page, so that means its not validating it. Because in the code, i have coded "isValidate =0 and isValidate=1" and these r the two values returned by the function validate. Since it does not execute any of the pieces of code within the conditions, that means it is not executing the validate function at all.. but i dont understand why is that so..

Alexis Over a year ago

It would be extremely helpful if you had some log output. Did you find anything like this?

user1353190 Over a year ago

i made some changes to the code. it seems it was not executing the database correctly:

user1353190 Over a year ago

code if userPWDatabase != "": #Create Cookie C= Cookie.SimpleCookie() #take the value of usernameLogin into the variable username username= form.getvalue('usernameLogin') #set the cookie with the usernameLogin key C['usernameLogin'] = username print C code

Alexis Over a year ago

I just realize there might be more mistakes, as I got it running but with only one record in the database, I suspect it would fail if there are more users because the for-loop has return statements which ever the record is, so even if you have 10 users it will only look at the first result. My best suggestion would be to modify the sql statement to filter by username : "SELECT username,passwrd FROM login WHERE username=%s"%UserPW[0] , and check if results length == 1 or not.

|

user1353190 · Accepted Answer · 2012-04-25 09:22:14Z

I changed the code validate.py to this:

  #! usr/local/bin/python
import cgi;
import cgitb;
import Cookie;
import os;
import sqlite3;

cgitb.enable()
username= None
form= cgi.FieldStorage()

#open connection
conn= sqlite3.connect("manager.db")
cur= conn.cursor()

pagehead= """
    <html>
        <head> Redirecting </head>
        <body>

            """
pagefoot="""<form method= POST action="http://localhost:8000/cgi-bin/page1.py">
            <p> Validated! <input type="submit" value="Enter"/> </p>
            </form>
        </body>
    </html> """
errorpagefoot= """
<form action="http://localhost:8000/cgi-bin/index.py">
<p> Error! <input type="submit" value="Go Back"/> </p>
</form>
</body>
</html>"""


print "Content_type: text/html\n\n"
print pagehead
userName= form.getvalue('usernameLogin')
userPW= form.getvalue('passwordLogin')
userPWDatabase = conn.execute("SELECT username,passwrd FROM login WHERE username=? and passwrd=?",[userName,userPW])
cur.fetchone()
for result in userPWDatabase:
    userDb= result[0]
    pwDb= result[1]
    if userDb == userName and pwDb == userPW:
        #Create Cookie
        C= Cookie.SimpleCookie()
        #take the value of usernameLogin into the variable username
        username= form.getvalue('usernameLogin')
        #Set-Cookie header with the usernameLogin key
        C['usernameLogin'] = username
        print C
        print pagefoot    
    elif userDb != userName and pwDb != userPW:
        print errorpagefoot

it's working now but it doesnt redirect to the previous page anymore, incase of incorrect username or password

Alexis · Accepted Answer · 2012-04-25 12:02:28Z

Ok, after reading your new code it seems you still have several bugs, but the main error I think is the way you try to check the login/password: first you select it from the database byt filtering on the username and password, which can only return 1 or 0 result as the login is a primary in your db, and then you try to loop on the results and check if the username and password are both correct, or both incorrect, which consequently does not cover the case when username is correct but not the password ( and inverse ). So I suggest you change the last part of your code for this:

print "Content-type: text/html\n\n"
print pagehead
userName= form.getvalue('usernameLogin')
userPW= form.getvalue('passwordLogin')
cur.execute("SELECT username,passwrd FROM login WHERE username=?",[userName])
userPWDatabase = cur.fetchone()
if userPWDatabase is not None:
        userDb= userPWDatabase[0]
        pwDb= userPWDatabase[1]
        #Create Cookie
        C= Cookie.SimpleCookie()
        #take the value of usernameLogin into the variable username
        username= form.getvalue('usernameLogin')
        #Set-Cookie header with the usernameLogin key
        C['usernameLogin'] = username
        print C
        print pagefoot    
else:
        print errorpagefoot

Note that you could also keep your SQL query with filter on username and password, but then you don't need to check anything else: if there's no result, one of the two field is incorrect, and there's one it's necessarily good.

In addition, I don't know what's your aim ( either to learn cgi-bin/python or setup a real application ), but you might be interested to have a look at Django ( www.djangoproject.com )

user1353190 · Accepted Answer · 2012-04-25 12:16:17Z

i just read that the Set-Cookie header stuff is suppose to be before the line:

print "Content_type: text/html\n\n"

so, i fixed my code again and it's working fine now. it goes back to previous script in case of wrong username / password and it proceeds to next script after validation Here is the final code:

#! usr/local/bin/python
import cgi;
import cgitb;
import Cookie;
import os;
import sqlite3;

cgitb.enable()
username= None
form= cgi.FieldStorage()

#open connection
conn= sqlite3.connect("manager.db")
cur= conn.cursor()

pagehead= """
    <html>
        <head> Redirecting </head>
        <body>

            """
pagefoot="""<form method= POST action="http://localhost:8000/cgi-bin/page1.py">
            <p> Validated! <input type="submit" value="Enter"/> </p>
            </form>
        </body>
    </html> """
errorpagefoot= """
<form action="http://localhost:8000/cgi-bin/index.py">
<p> Error! <input type="submit" value="Go Back"/> </p>
</form>
</body>
</html>"""


userName= form.getvalue('usernameLogin')
userPW= form.getvalue('passwordLogin')
userPWDatabase = conn.execute("SELECT username,passwrd FROM login WHERE username=? and passwrd=?",[userName,userPW])
cur.fetchone()
for result in userPWDatabase:
    userDb= result[0]
    pwDb= result[1]
    if userDb == userName and pwDb == userPW:
        #Create Cookie
        C= Cookie.SimpleCookie()
        #take the value of usernameLogin into the variable username
        username= form.getvalue('usernameLogin')
        #Set-Cookie header with the usernameLogin key
        C['usernameLogin'] = username
        print C
    elif userDb != userName and pwDb != userPW:
        print errorpagefoot

print "Content_type: text/html\n\n"
print pagehead
if username:
    print pagefoot
else:
    print errorpagefoot

@Alexis

Thanks for your time and help Alexis :)

Collectives™ on Stack Overflow

Redirect python script to another python script for validation of login credentials

4 Answers 4

8 Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

8 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related