I've been working on a PHP function that: (1) authenticates a user by
connecting to the AS400, and (2) authorizes a user based on information
from the user profile. I've included the code at the end of this post.



The code works. My question has to do with accepting the user name and
password from the $_POST array.



I know the mantra is "never trust user input." However, we use long
passwords, and we encourage users to make up passwords that include
special characters. Do I need to scrub the input at all, since I'm only
using it to establish a connection and set a $_SESSION variable? Should
I scrub certain characters (and tell users they can't include those
characters in their passwords)? If so, which characters?



Thanks,

Kelly



Note: the script below assumes users are authorized to access an
application if they belong to the *SECOFR user class or they belong a
supplemental group called MYGROUP.



function validateUser()

{

//Step 1: Authenticate the user by connecting to the AS400.

$username=$_POST["user"];

$password=$_POST["password"];

$conn = i5_connect("myas400",$username,$password);

if (!$conn)

{

$result = "Invalid username or password.";

}

else

{

//Step 2. Authorize the user by checking profile information;

$rtvusrprf = (i5_command("rtvusrprf",

array("usrprf"=>"*CURRENT"),

array("usrcls"=>"usrcls","supgrpprf"=>"supgrpprf"),

$conn));

if (!$rtvusrprf)

{

$result = "Authorization error.";

}

else

{

if ($usrcls == "*SECOFR")

{

$_SESSION["user"] = $username;

$result = "Thank you for signing in.";

}

else

{

$supgrps = str_split($supgrpprf, 10);

if (in_array("MYGROUP", $supgrps))

{

$_SESSION["user"] = $username;

$result = "Thank you for signing in.";

}

else

{

$result = "Not authorized for this application.";

}

}

}

//Step 3. Close connection. Use the NOBODY profile for better
performance.

i5_close($conn);

}

return $result;

}






As an Amazon Associate we earn from qualifying purchases.

This thread ...

Follow-Ups:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.