If you submit a blank form, it prints test. If you type in the wrong details, it prints the CGI login form with junk printed to screen that reads "Set-Cookie: filemanager=d; path=/ Expires: Fri, 15 Oct 2004 20:13:35 GMT Date: Fri, 15 Oct 2004 20:13:35 GMT Content-Type: text/html; charset=ISO-8859-1 test"

If you want to test the script, www.spydersubmission.com (upper left corner). After clearing the cookies and restarting IE, it always prints "test" when the form is blank. So in reality, no part of this form is working but I know it's ALMOST functional again.

I have read Ovid's CGI tutorials and I know CGI::Carp can be a bad thing, but now it's just used to help me with debugging. When the script is live, that'll be removed.

I didn't use your other script because it was too different from this current login template I've been using for a while now and a template like this would would be easier, for me, to implement in other scripts easily.

Can you see what else might be causing the problem with 1) not setting a cookie if login is right, 2) not erroring out when the form is blank, 3) what that junk is that prints when the password is wrong?

On a side note on the security about my error messages. Someone told me that before but I don't think it makes any difference if they know a certain username exists or not. For Hotmail, you could pick virtually anything you can think of for a screen name and know it works and attempt to break it even if they don't tell you "error: the username doesn't exist". Not saying security isn't an issue or important.

Thanks.

#!/usr/bin/perl -t

use warnings;
use strict;

use CGI qw/:standard/;
use CGI::Carp qw(fatalsToBrowser);

#######
# collect data from form
#######
my $username = param("username");
my $password = param("password");


#########
# Cookie junk
#########
my $cookiename = "filemanager";
my $tasty = cookie($cookiename);


use DB_File;

my %users;
my $users = "users.db";                 # location of database
 
tie %users, "DB_File", "$users", O_CREAT|O_RDWR, 0644 or die "Cannot o
+pen file 'default.db': $!\n";

my ($savedpassword, $name, $email, $website, $start) = split(/::/, $us
+ers{$username});



######################################################################
+#########################################
# COOKIE CHECKING
######################################################################
+#########################################
# First check if we saved a cookie last time
if($tasty)
{
print header(-expires=>'now'),
start_html("You are logged in!");




&processing;

print end_html;
exit;
}
######################################################################
+##################################
# Password checking
######################################################################
+##################################
unless ($password eq $savedpassword)
    {
    print header(-expires=>'now'), start_html("You need to Login");

print <<"FORM";
     <table border="2" width="181" bgcolor="#AAAAAA">
     <form action="" method="post">
       <tr>
       <td bgcolor="#CC0000" valign="bottom"><font color="#FFFFFF" fac
+e="Arial, Helvetica, sans-serif">Client Login </font></td>
       </tr>
       <tr>
       <td valign="top">
          <table width="181" border="0" align="center">
          <form action="/cgi-bin/member/login.cgi" method="post">
       <tr>
           <td width="59">username</td>
           <td width="122" valign="top"><input name="username" type="t
+ext" size="15"></td>
       </tr>
       <tr>
           <td>password</td>
           <td valign="top"><input name="password" type="password" siz
+e="15"></td>
       </tr>
       <tr>
           <td>&nbsp;</td>
           <td valign="top"><div align="right">
           <input type="submit" name="Submit" value="Log In">
            </div></td>
       </tr>
    </form>
        </table>
FORM


    if (param())
    {
      if (exists $users{$username})
      {

         if ($password ne $savedpassword) 
         {
            print "<b>Wrong password!</b>";
            exit;
         }
      } }
      else
      {
          print "username does not exist";
          exit;
      }
    }


######################################################################
+##################################
# Cookie setting
######################################################################
+##################################
my $cookie = cookie(
    -NAME=> $cookiename,
    -VALUE=> $password,
    );
    print header(-COOKIE => $cookie, -expires=>'now');
    print start_html("Going through here");


&processing;



sub processing
{ 
 print "test";
}  ########### END PROCESSING SUB HERE




exit;
[download]