I am using the following code to validate a user:

$valid_user = '0';
$ref_file = "$path{'data'}/users.txt";
open (DAT, "$ref_file");
flock(DAT,2);
while (<DAT> ) {
chomp;
(@temp_user) = split /::/;
$salt = substr($INPUT{'password'}, 0, 2);
$encrypted = crypt($INPUT{'password'},$salt);
if ($INPUT{'userid'} eq "$temp_user[0]" && $encrypted eq "$temp_user[1]") {
$valid_user = '1'; last;
}
}
close(DAT);

When I use the above code, as long as I have the password correct, I can append anything after the password and it will still be accepted. Is there something wrong with my logic above? For example: if my password is "johndoe", I can enter any of the following as a password and it will be accepted: "johndoe", "johndoe7", "johndoej;ajd;kjdfk", well, you get the idea.

Any insight will be greatly appreciated. Otherwise, I will just have to test against length of the input I guess :(

Thanks

I would use something like;


Andy (mod)
andy@ultranerds.co.uk

---

IMPORTANT: I've now moved to ultranerds.co.uk, and the .com will no longer work!
Want to give me something back for my help? Please see my Amazon Wish List
GLinks ULTRA Package (plugins total "value" $3,325 & rising, for just $350)| GLinks ULTRA Package PRO (plugins total "value" $5,625 & rising, for just $500)
Support Forum | Links SQL Plugins | DMOZ Dumps | UltraNerds | ULTRAGLobals Plugin | Pre-Made Template Sets | FREE GLinks Plugins!
Compare our different Plugin packages *new* Free CSS Templates

close(DAT) automatically releases the lock so you don't need flock(DAT, 8)