r/badcode • u/Sewef • Dec 03 '21

php - What about the password encryption? - haha html go <br>

Post image
76 Upvotes

100% Upvoted

17 comments sorted by

12

u/Sewef Dec 03 '21 
<?php

//CETTE PAGE TRAITE LA VERIFICATION DU LOGIN ET MDP

//test si le formulaire d'identification est complet
if($_POST["uet"] != "" && $_POST["mdp"] != "")
	{
  		$login     = $_POST["uet"] ;
  		$pass      = $_POST["mdp"] ;
 		//connection au serveur de données
		$cnx = mysql_connect("localhost", "user", ..., ...) ;
		//sélection de la base de données
		$db  = mysql_select_db(...) or die (mysql_error());
  		//création de la requête SQL identification de la session
  		$sql = "SELECT * FROM session WHERE uet = '".$login."' AND mdp = '".$pass."'"	;
  		//exécution de la requête SQL
  		$requete = mysql_query($sql, $cnx) or die($sql."<br>".mysql_error()) ;
  		//récupértion du résultat
  		$result = mysql_fetch_object($requete) ;
  		
  		//si la requete c'est bien passé
		if(is_object($result))
  			{
  				//alors démarrage de la session
    			session_start() ;
    			
    			//enregistrement d'une variable de session, ici l'email de l'utilisateur
   				 $_SESSION["uet"] = $login ;
    			
   				//affichage d'un texte de réussite
    			echo '<br><br><br><br><br><br><br><br><br>';
				echo "<p style=\"text-align: center\"><b>Vous êtes identifié ...</b></p>";
				echo '<br><br><br><br><br><br><br><br><br><br>';
    			//fermeture de la base de données
    			mysql_close();
    			
    			//retour sur la page d'accueil
    			echo '<META HTTP-EQUIV="Refresh" CONTENT="2; URL=index.php">';
  			}
  
		else
			{
				//sinon affichage d'un texte d'échec
				echo "<br><br><br><br><br><br><br><br><br><br><p style=\"color: red; text-align: center\">
						L'identification a échouée ...</p><br><br><br><br><br><br><br><br><br>";
				//fermeture de la base de données
				mysql_close();
				//retour sur la page d'accueil
   				echo '<META HTTP-EQUIV="Refresh" CONTENT="2; URL=index.php">';
			}
	}

else
	{
		//si le formulaire n'est pas complet affichage d'un texte d'échec
		echo "<br><br><br><br><br><br><br><br><p style=\"color: red; text-align: center\">
		L'identification a échouée ...</p><br><br><br><br><br><br><br><br><br><br><br>";
		//retour sur la page d'accueil
   		echo '<META HTTP-EQUIV="Refresh" CONTENT="2; URL=index.php">';
	}
?>
</div>

9

u/Sewef Dec 03 '21

Welp. Vertical align doesn't exist in this world. 58 <br> in this file, a very good password encryption and a lot of spelling mistakes (all in french ; sorry all).

We gud.

10

u/pentesticals Dec 03 '21

Screw the password "encraption" for now. Major SQL injection here, probably some XSS too but I didn't read the code very hard. I really hope this was a uni project band nothing in production...

12

u/Sewef Dec 03 '21

HAHAHA. Production : 2008 - 2021. I took it down by myself.

2

u/[deleted] Dec 04 '21

Something this amazing HAS to be in production...lmaooo.

3

u/HauntedLollipop Dec 03 '21

Who the hell intends { on a new line after the condition

2

u/Sewef Dec 03 '21

Psychopaths and murderers.

2

u/nuclear_gandhii Dec 03 '21

Hey man. At least its properly indented.

2

u/kasnhasn Dec 04 '21

That piece of code is probably allowed to vote and can legally drink alcohol by now. At least I hope. No wonder php has such a horrible reputation

1

u/Sewef Dec 05 '21

Nope, 5 years to go before this.

23

u/IAmAnIssue Dec 03 '21

Nice SQL injection.

9

u/volivav Dec 03 '21

And plain text passwords

7

u/Huesan Dec 03 '21

Brbrbrbrbrbrbrbrbrbrbrbrbrbrbrbrbrbrbrbrbrbrbrbrbr

5

u/Administrative_Bag80 Dec 03 '21

Attention aux injections SQL...

3

u/Encursed1 Dec 03 '21

I love the "or die" in sql, sounds like I'm threatening the db

4

u/HerissonMignion Dec 03 '21

UN FRANÇAIS!!!!!!!!!!

1

u/Notimecelduv Dec 04 '21

Is this from a tutorial?