Login Email JQuery Validation

[lindasdd]

I'm playing with the Jquery Validation Plugin: http://jqueryvalidation.org/ in an attempt to validate the email_address field on the login page prior to hitting the submit button (so customers having login troubles can tell if it is their email address that is incorrect).

What the page should do: as soon as someone enters a value in the email_address field, the jquery loads a php file that contains a sql call to see if the email address exists in the database and returns a message based on the results.

I'm stuck on the sql portion. At this point I have gone as far as removing all variable from the process until I can get the basic sql to return a result.

<?php
 
/* check if email is already registered */
 
if (!empty($_POST['email']))
{
    global $db;
    $sql = "SELECT customers_id FROM zen_customers WHERE customers_email_address = 'atestemail######################' LIMIT 1";
    $result = $db->Execute($sql);
    if($result->RecordCount()>0)
    
    {
        echo "true";  //good to register
    }
    else
    {
        echo "false"; //already registered
    }
}
else
{
    echo "false"; //invalid post var
}
 
?>

[rbarbour]

Try replacing

$getUserEmail = $_POST['email'];

$sql = "SELECT customers_id FROM zen_customers WHERE customers_email_address = '" . $getUserEmail . "' LIMIT 1";

Hope this helps!

However most jQuery/AJAX uses the $_REQUEST method to obtain information from a form.

I'm playing with the Jquery Validation Plugin: http://jqueryvalidation.org/ in an attempt to validate the email_address field on the login page prior to hitting the submit button (so customers having login troubles can tell if it is their email address that is incorrect).

What the page should do: as soon as someone enters a value in the email_address field, the jquery loads a php file that contains a sql call to see if the email address exists in the database and returns a message based on the results.

I'm stuck on the sql portion. At this point I have gone as far as removing all variable from the process until I can get the basic sql to return a result.

<?php
 
/* check if email is already registered */
 
if (!empty($_POST['email']))
{
    global $db;
    $sql = "SELECT customers_id FROM zen_customers WHERE customers_email_address = 'atestemail######################' LIMIT 1";
    $result = $db->Execute($sql);
    if($result->RecordCount()>0)
    
    {
        echo "true";  //good to register
    }
    else
    {
        echo "false"; //already registered
    }
}
else
{
    echo "false"; //invalid post var
}
 
?>

[DrByte]

Try replacing

$getUserEmail = $_POST['email'];

$sql = "SELECT customers_id FROM zen_customers WHERE customers_email_address = '" . $getUserEmail . "' LIMIT 1";

Hope this helps!

However most jQuery/AJAX uses the $_REQUEST method to obtain information from a form.

Oy! That's a SQL Injection disaster waiting to blow up your entire site!
Never use $_POST or $_REQUEST or $_GET etc data directly in an SQL query without sanitizing it first!!!!!!!!!
Something like this is safer:

$sql = "SELECT customers_id FROM zen_customers WHERE customers_email_address = :email LIMIT 1";
$sql = $db->bindVars($sql, ':email', $_POST['email'], 'string');

And your script needs to first run application_top in order to get access to the database via $db.

[mc12345678]

If this is pulling data from the database as far as being an email address that is in the database as compared to properly formatted (ie. Two @ symbols or a space in the address) isn't this just weakening the security of the system?

If I enter an address that clearly does not exist in the database the, I get one response, if I enter an email address that is in the database then a different response. If that is the case, then I need only test passwords after obtaining enough information to know what email addresses are contained, or even absent of that, I can test to see what email addresses exist and then use that information to send emails to those individuals outside of the site that is using this tool...

[DrByte]

If this is pulling data from the database as far as being an email address that is in the database as compared to properly formatted (ie. Two @ symbols or a space in the address) isn't this just weakening the security of the system?

If I enter an address that clearly does not exist in the database the, I get one response, if I enter an email address that is in the database then a different response. If that is the case, then I need only test passwords after obtaining enough information to know what email addresses are contained, or even absent of that, I can test to see what email addresses exist and then use that information to send emails to those individuals outside of the site that is using this tool...

True. Such a script should not be used to tell the end-user anything more than valid/invalid. And "already exists" should be lumped in with "invalid", when attempting to sign up for an account. When doing a "please send me my password" request, no response should be provided other than "if a match is found an email will be dispatched", not "sorry we couldn't find that in our database". Disclosing too much useful information empowers hackers with information that targets their attacks, thus making your site more vulnerable to malicious activity.

[acerldd]

The potential security risk for someone with a dedicated script to keep trying emails and then passwords has been on my mind.

But, my database doesn't hold any payment information so even if you are able to log in to someone else's account you aren't able to access their payment info or even place an order under their details.

Or is there a different security risk I'm not considering?

[rbarbour]

Very true,

Sometimes my fingers are faster than my brain

Oy! That's a SQL Injection disaster waiting to blow up your entire site!
Never use $_POST or $_REQUEST or $_GET etc data directly in an SQL query without sanitizing it first!!!!!!!!!
Something like this is safer:

$sql = "SELECT customers_id FROM zen_customers WHERE customers_email_address = :email LIMIT 1";
$sql = $db->bindVars($sql, ':email', $_POST['email'], 'string');

And your script needs to first run application_top in order to get access to the database via $db.

[acerldd]

And your script needs to first run application_top in order to get access to the database via $db.

I think this was all I actually needed. Got it to work now.