Click here to Skip to main content
15,890,512 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
So I asked this question on StackOverflow and the people on there didn't seem to like my question very much so I will try to go into a little more detail on here.

So my current problem is coming from a PHP API that I am building to handle User authentication. At the current moment in time I am aware that it is insecure in many different ways (SQL injections for example) But that is something that I will fix with time. This is my first time writing something like this and wanted to just prove to myself that it actually works then slowly start building from there.

Whenever I execute my request from a Javascript client and send it to my PHP API I will get this as a response



<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>200 OK</title>
</head><body>
<h1>OK</h1>
<p>The server encountered an internal error or
misconfiguration and was unable to complete
your request.</p>
<p>Please contact the server administrator at 
 [no address given] to inform them of the time this error occurred,
 and the actions you performed just before this error.</p>
<p>More information about this error may be available
in the server error log.</p>
<hr>
<address>Apache/2.4.29 (Ubuntu) Server at rest.localhost Port 80</address>
</body></html>




What is odd to me is that no errors show up in my error logs for anything.

I have checked all the logs in /var/log/apache and /var/log/mysql

None show any bit of information about errors. My MySQL access log file used to show that I had a user login but not do anything then log out. Now there is no login from the user that is supposed to be logging in.

My PHP API currently looks like so:

-rest/
  -inc/
    -conn.php
    -config.php
    -user.php
  -user_handle.php


user_handle.php

<?php 

    error_reporting(-1);

    include_once("inc/config.php");
    include_once("inc/user.php");
    include_once("inc/conn.php");

    $user = new User();

    header("Content-Type:application/json; charset=UTF-8;");

    $json_str = file_get_contents('php://input');
    return $json_str;
    $obj = json_decode($json_str);

    if($obj->type === "reg") {
        $email = $obj->email;
        $password = $obj->password;
        $ip = $obj->ip;

        $sub_user = $user->register($email, $password, $ip);
        return $sub_user;
    }  else {
        return "Error";
    }

?>


config.php

<?php 

    // MySQL Connection 

    class Dbset {

        protected $serverName;
        protected $userName;
        protected $passCode;
        protected $dbName;

        function dbset() {
            $this->serverName = 'localhost';
            $this->userName = 'mimbl';
            $this->passCode = 'password';
            $this->dbName = 'mimbl';
        }
    }

    // End of MySQL Connection 

    
?>


conn.php

<?php 

    include_once('config.php');

    class MySQL extends Dbset{

        var $myconn;

        function connect() {
            $dbConfig = new Dbset();

            $con = mysqli_connect("".$dbConfig->serverName."", "".$dbConfig->userName."", "".$dbConfig->passCode."", "".$dbConfig->dbName."");
            if (!$con) {
                die('Could not connect to database!');
            } else {
                $this->myconn = $con;
                echo 'Connection established!';}
            return $this->myconn;
        }
        function close() {
            mysqli_close($myconn);
            echo 'Connection closed!';
        }

    }
?>


user.php

<?php 

    include "conn.php";

    

    class User {
           
        
        public $password;
        public $email;
        public $ip;


        // User Registration
        function register($email, $password, $ip) {
            $dbC = new MySQL();

            $dbC->connect();

            $query = "INSERT INTO users (`email`, `pass`, `ip`) VALUES ('".$email.", '".$password."', '".$ip."')";
            
            $result = $dbC->myconn->query($query);

            if ($result === TRUE) {
                return "Success";
            } else {
                return "Error";
            }
        }

    }


?>


If you are curious about the StackOverflow question as well you can find that Here

Any suggestions and help would be appreciated

What I have tried:

Enabling more in depth error logging on Apache, PHP, and MySQL
Posted
Comments
Richard Deeming 14-Apr-20 13:49pm    
Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

PHP: SQL Injection - Manual[^]
Richard Deeming 14-Apr-20 13:50pm    
You're also storing passwords in plain text. Don't do that.
Secure Password Authentication Explained Simply[^]
Salted Password Hashing - Doing it Right[^]

PHP even has built-in functions to help you do the right thing:
PHP: password_hash[^]
PHP: password_verify[^]
Richard Deeming 14-Apr-20 13:51pm    
And I hope you're not intending to use that IP address for validation in the future? Because most people don't have a "fixed" IP address; it will change fairly regularly.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900