Re: Creating a Logon Form

[email protected] wrote:
> Hey All,

Hello,

> I'm new to doing CGI with Perl and so am a little lost here.
> 
> I'm working on a web-accessible database system for a (rather large)
> group of area churches and went through the rigmarole of assessing
> various programming and scripting languages to see which is the best
> tool for the job and I landed on Perl::CGI.
> 
> I started working on this project and have created scripts that
> generate a registration page that emails the registration information
> to me for processing.  This is intentional, by the way, as I don't
> want it to be a self-register site for certain security reasons.
> These scripts work fine, so I started working on a logon form to allow
> users who are already registered to logon.  So, on my main page, I
> have a right-hand pane that looks similar to this (in the HTML code):
> 
> <div id='rightcontent'>
>      <p><a href='http://myserver.domain.org/cgi-bin/
> boms.cgi'>Register</a></p>
>      <br />
>      <h3>Logon</h3>
>      <form method='POST' action='http://myserver.domain.org/cgi-bin/
> logon.cgi'>
>           Username:<br />
>           <input type='textfield' name='uname' /><br />
>           Password:<br />
>           <input type='password' name='pwd' /><br />
>           <input type='submit' name='logon' value='Logon' />
>      </form>
> </div>
> ...etc...
> 
> This form displays pretty well, though I need to work on the width of
> the fields, but that's not my issue.  My issue is when I fill in the
> data in the fields and submit it to my "logon.cgi" script, the
> password value gets an arbitrary string of numbers attached to the end
> and I am not having any luck figuring out where those numbers come
> from, nor how to get rid of them back to the clear text of the
> password.  For example:
> 
> I enter the string 'hiyall2008' in the password field and get the
> following values in my logon script...
>      Click 1:  hiyall2008153639492
>      Click 2:  hiyall2008135813700
>      Click 3:  hiyall2008152312388
>      et cetera...
> 
> As you can see, there is a different arbitrary string of numbers at
> the end of the clear text of the password entered.  If it was the same
> each time the password was entered, I would just make it a part of the
> password and encrypt the whole thing into my database.  However, each
> time it is different.  It appears to be only 9 numbers each time, so I
> decided to try and strip those 9 numbers off the password with the
> 'substr()' method.  So, I created the following sub procedure to do
> that:
> 
> sub strip_string
> {
>         my $ret = "";
>         for (my $i = 0; $i < length($_[0]) - 9; $i++) {
> 	        $ret .= substr(length($_[0]) - $i, 1);

Say that you pass the string "hiyall2008153639492" to strip_string and 
the length of that string is 19 characters.  At the start of the loop $i 
is 0 and length($_[0]) - $i is 19 so your expression says:

         $ret .= substr("19", 1);
Or:

         $ret .= "9";

At the next iteration through the loop $i is 1 so you have:

         $ret .= substr("18", 1);


> 	        #print $ret;
> 	}
> 
> 	return $ret;

Since the length of "hiyall2008153639492" is 19 and the loop starts at 0 
and ends at 9 then the length of $ret will be 10.


> }
> 
> Now, when I use this method to "strip" the arbitrary numbers from the
> end of the entered password, I get the following:
> 
> I enter the same password as before, "hiyall2008", and get the
> following:
>      Click 1:  0134588996
>      Click 2:  0157203012
>      Click 3:  0138639940
> 
> Now, not only do I have arbitrary strings of numbers, I have 10
> numbers instead of 9!  I know that it is something that I'm not doing
> correctly, but I cannot figure out what I'm doing wrong.

If you just want to "strip" 9 characters from the end of your string then:

$ perl -le'
$_ = "hiyall2008153639492";
print;
substr( $_, -9 ) = "";
print;
'
hiyall2008153639492
hiyall2008



John
-- 
Those people who think they know everything are a great
annoyance to those of us who do.        -- Isaac Asimov