CSCI 903 Assignment 4

This is a multipart assignment in which you will develop a secure login mechanism for your web site.

1. • Set up the project directory.

     Create a new directory for this assignment. Perfect Student called it “Assignment_04,” but you may use a more descriptive name, like “Login,” if you like. Create a subdirectory named css for the stylesheet(s) for the project, and create an index page that will contain the login form for the project.

     You will need to decide whether the PHP code for processing the form data will be in a separate file or embedded in the index page. Either approach is all right, and you do not have to make that decision just yet.

   • Put a form element on the page

     that submits its form data to a separate page called display_form_data.php in the project directory. Use the POST method. Include a text input element for the user’s name and a password input element for the user’s password. Include a fieldset with legend, labels for the two inputs, and a submit button that says “Login.” Use the tabindex attribute on the input and button elements so that the tab key takes users first to the password, then to the username, and then to the submit button.

     This is an academic exercise: the tab sequence is strange, and there are questions about using legends and fieldsets, which can be mimicked using CSS. The idea is to give you some experience with these features so you can decide what role they will (or will not) play in your later career.

   • Create the display_form_data.php page.

     Set it up as a regular XHTML5 page like all the others in this course. If the array of form data is available, display a suitable page title and a table containing all the form data submitted, using the foreach loop given in class on April 16 to generate the table rows. If the $_POST array is not available, display a page title saying there is no form data instead.

   • Add a file named README.md to the project directory.

     Enter a description of the project there so that it shows up when the user visits your site’s home page.

   • Use a stylesheet to make your index page look “good.”

     Put it in the css subdirectory for the assignment.

   • Test your code

     with different patterns of input, including empty values. Try accessing the page without submitting a form.

   • Be sure both validators continue to give your site a clean bill of health.

   • Send me an email

     with “CSCI 903 Assignment 4A” as the subject, and be sure to include you account name in the message body. The assignment is due by midnight of the due date (April 18).

2. • “Sanitize” all form data.

     Write a function named sanitize() that will prevent SQL injection attacks by converting apostrophe characters (') to “curly” quotes (‘ or ’), by converting double dashes (--) into em dashes (—), and converting semicolons (;) into a numeric HTML character entities (&#x3B; or &#59;). You can use str_replace() to handle double dashes and semicolons, but you will need to use preg_replace() to handle the quote characters, as shown in class.

     For example, the first statement below replaces all double quote characters that are at the beginning of a string (^) or preceded by whitespace (\s) with left curly quotes. The parentheses around ^|\s captures that part of the matched string so that it can be re=inserted before the “ by using $1 in the replacement string. The second statement simply replaces any remaining double quotes with right curly quotes. Just change the double quotes to single quotes for this part of the assignment.

     $returnVal = preg_replace('/(^|\s)"/', '$1“', $returnVal); $returnVal = str_replace('"', '”', $returnVal);

     To paraphrase an old joke:

     “6 munce ago I kudnt even spel reglur xpreshin and now i я one”

     Prevent cross-site scripting attacks by converting all ampersand (&), less-than (<), and greater-than (>) characters to XML character entities (&, <, and >, respectively).

     While you’re at it, convert double apostrophes (") to curly quotes as well (“ or ”).

     Use your sanitize() function to convert all form data into “safe” strings which, except for the conversion to curly quotes and substitution of em dashes for double dashes, look just like what the user typed into the form.

   • Test your form thoroughly

     and carefully. Don’t forget Little Bobby Tables!

   • Be sure both validators continue to give your site a clean bill of health.

   • Send me an email

     with “CSCI 903 Assignment 4B” as the subject, and be sure to include you account name in the message body. The assignment is due by midnight of the due date (April 25).
3. Do not add this step to your web site until you have received your grade for the previous step of the project.

   • Encode passwords using crypt()

     using the SHA-512 algorithm with the date and time of the encryption (YYYY-MM-DD HH:MM) as the salt. Verify that the encrypted password is being computed by displaying it in place of the plain password in your display_form_data.php page. You can’t completely test this code for correctness until you set up a database to save user names and passwords.

   • Test your code.

     The password field should show a string that starts with '$6$2013-05-01 13:57$...' but with the actual date and time in the sixteen characters following the second dollar sign, and the encrypted password in place of the '...' following the third dollar sign. Only in the following step will you be able to test whether the encrypted password “works” or not.

   • Be sure both validators continue to give your site a clean bill of health.

   • Send me an email

     with “CSCI 903 Assignment 4C” as the subject, and be sure to include you account name in the message body. The assignment is due by midnight of the due date (May 2).
4. Do not add this step to your web site until you have received your grade for the previous step of the project.

   • Set up your database and use it to save user names and passwords

     . Look at the documentation for SQLite3 at http://www.sqlite.org/ and the documentation for the PHP SQLite3 interface in the PHP Manual.

     I have written a mini-tutorial on using SQLite3 with PHP to help you get started.

     I have set up an empty SQLite3 database that your code can read and write in your home directory: it’s called cs903.db. Since your project directory is two levels below your home directory, use ../../cs903.db to open it.

   • Modify display_form_data.php

     to check whether the user is in the database or not. If not, insert the username and encrypted password, and display a message saying the user was successfully registered before displaying the table with the form data.

     If the user is already in the database, check that the password the user supplied is correct. If it is, display a message greeting the user by name before displaying the table with the form data. If not, display a statement saying that the login failed before displaying the form data.

   • Send me an email

     with “CSCI 903 Assignment 4D” as the subject, and be sure to include you account name in the message body. The assignment is due by midnight of the due date (May 7).
5. Do not add this step to your web site until you have received your grade for the previous step of the project.

   This is a somewhat open-ended part of the assignment, with a required portion plus some ideas for extra features you may add to your project for extra credit—if you have time.

   • Use session variables to manage error conditions (Required).

     If the user does not log in correctly (missing username or missing/wrong password), redirect them to the index page for the assignment, and display an error message above the login form there.

     If you have not done so already, this step will require you to put the code for checking the form data at the top of the display form data page, before the HTTP headers get sent, because the headers() function cannot be called once any part of the response message has been output. [Actually, PHP provides a mechanism called “output buffering” that could be used, but it’s not worth the trouble in this case.]

     Code to save an error message in a session variable and redirect the user to the index page:

     $_SESSION['error_msg'] = "This is a meaningful error message"; header('Location: index.php'); exit;

     As discussed in class, you will have to call the session_start() function at the start of both the index page and the display form data page in order to establish communication between them.

     And you will need to modify the index page to display the error message if there is one. Once an error message has been displayed, it should be deleted: unset($_SESSION['error_msg']), for example.

   • Require new users to enter the initial password twice (Required).

     This step is required, but the next one is optional. Nonetheless, you should set this step up in anticipation of the optional step.

     Instead of just one password field, provide three: one for the current password (to be used by current users), and two for a new password and a repeated new password. New users have to enter the same password in both the new and repeat-new boxes in order to register successfully. Existing users have to enter their current password correctly in order to log in successfully.

   • Allow users to change their password (Optional).

     Registered users enter their current password and a new password (repeated) to change their password. This will require use of an UPDATE SQL statement with a WHERE clause to limit the update to just the one user.

   • Provide a “manage profile” page (Optional).

     Add columns to your users table for additional information, such as email addresses, real name, home address, phone number, favorite color, whether to receive spam, etc.

     Provide a form on the display form data page that users can use to manage their profile information.

   • Provide a “manage users” page (Optional).

     Create a list of privileged users (administrators). This can be as simple as an extra boolean column in the users table. Be sure user “vickery” with password “secret” is included in this list.

     Provide administrators with a table showing all the users and the information about them. Allow administrators to delete users and/or to edit any user’s profile.

   • Send me an email

     with “CSCI 903 Assignment 4E” as the subject, and be sure to include you account name in the message body. The assignment is due by midnight of the due date (May 21).

     To receive credit for any optional parts of the assignment that you complete, you must include a message in your email telling me what to look for.

     Note: May 21 is the absolute cutoff date for all assignments in this course. Absolutely no credit will be given for work submitted after that date.