PHP password problems

Question

I have a file on my server called "pform.php", this is what it looks like:

<form action="password.php" method="get">
<input type="text" name="password13"/>
<input type="submit" value="Submit!"/>
</form>

I have it transfer to another file called "password.php", this is what it looks like:

<?php

$text=$_GET["password13"];
$right="You entered the right password!";
$wrong="You entered the wrong password!";

if($password13=="test")
{
    echo $right;
}
else
{
    echo $wrong;
}
?>

When I enter the right password, it returns false.

What can I change it so it returns true when I insert the right password?

You never declare $password13, you need to use $text, as that's set to $_GET["password13"]. — gen_Eric
– gen_Eric, Commented Dec 1, 2011 at 17:04
possible duplicate of php password, compare, return true or false — gen_Eric
– gen_Eric, Commented Dec 1, 2011 at 17:07

Michael Berkowski · Accepted Answer · 2011-12-01 17:03:30Z

3

You need to access it via $text, since that is the variable you have defined:

$text=$_GET["password13"];

// use $text, not $password13
if($text=="test")
{
    echo $right;
}
else
{
    echo $wrong;
}

answered Dec 1, 2011 at 17:03

Michael Berkowski

271k47 gold badges450 silver badges395 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

user1074324 Over a year ago

As noted below, don't use _GET for sensitive information like passwords, I would suggest taking a look at @Jakub's post as this is bad practice as an acceptable answer.

Savas Vedova · Accepted Answer · 2011-12-01 17:04:55Z

3

if ($text == "test") 
   echo $right;
else
   echo $wrong;

Change your code to this. Your $password13 variable is not defined

answered Dec 1, 2011 at 17:04

Savas Vedova

5,7023 gold badges30 silver badges45 bronze badges

Comments

Peter Perháč · Accepted Answer · 2011-12-01 17:04:02Z

1

check for $test, as $password13 does not exist :-)

answered Dec 1, 2011 at 17:04

Peter Perháč

20.8k23 gold badges129 silver badges153 bronze badges

Comments

Jakub · Accepted Answer · 2011-12-01 17:11:00Z

1

I would change your form so that it submit at least as POST, and mask the password by making the input 'password'

<form action="password.php" method="post">
<input type="password" name="password13"/>
<input type="submit" value="Submit!"/>
</form>

Then reference the variable like so:

<?php

$text=$_POST["password13"];
$right="You entered the right password!";
$wrong="You entered the wrong password!";
...

remember to reference $text when you compare your password value.

answered Dec 1, 2011 at 17:11

Jakub

20.5k8 gold badges67 silver badges93 bronze badges

Comments

user1074324 · Accepted Answer · 2011-12-01 17:49:47Z

1

Never use $_GET parameters for sensitive data like passwords and such, they are stored inside browser cache, server logs, and are a huge security risk.

Use $_POST like Jakub has written for you above.

answered Dec 1, 2011 at 17:49

user1074324

Collectives™ on Stack Overflow

PHP password problems

5 Answers 5

1 Comment

Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

1 Comment

Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related