Hey,

Hmm the issues you have are really strange. Let’s see if I can help to somehow debug it:

- What exactly means when you say that iPhone/iPad device loses it’s connection? Does your session expire or it’s something else?

- Which delay you are referring to? When you try to open the website?

- Do you experience the same issues on demo website available at https://as-php.com ?

Regards,

Milos

(1) What exactly means when you say that iPhone/iPad device loses it’s connection? Does your session expire or it’s something else? (1-A) That’s my first question actually. How can I check if my session has been expired? Symptom is that pressing some menu, the wifi logo on iphone starts to access the server showing progress circle icon. After like 20-30sec, it redirects me to the login page (2) Which delay you are referring to? When you try to open the website? (2-A) Accessing the new page through ajax, the user is supposed to connect the server and gets the new html. However, very often it takes 5~ 20sec to get the new html. It might be due to the problem of my code. But, it looks my code is very simple to make delay. I’d like to ask if it could be due to multi-session management or mobile dependent issues of AS. It would be appreciated if you guide me how to monitor server activity. I can do it using MAMP and Netbean on local but frankly no idea how to do on actual server. I’m using Godaddy hosting. (3) Do you experience the same issues on demo website available at https://as-php.com ? (3-A) No.

Hey,

Well database session handler does not come out of the box with AS, since AS uses standard file based PHP sessions.

This means that you will have to implement it by yourself the same way as you would do it in any plain PHP application. Here is an example on how it can be implemented: http://culttt.com/2013/02/04/how-to-save-php-sessions-to-a-database/

Regards,

Milos

I implemented Db session class but I have some doubt.

My new instance is $ses = new ASDBSession(); $ses->start_session(’_s’, false);

instead of ASSession::startSession();

but how can I invoke $ses->get and $ses->set inside other class instead of ASSession::get and ASSession::set?

Hey,

Well you will have to pass it through the constructor or instantiate it inside that other class. Or, another way is to bind it to the service container and use it via app() function, whatever works for you.

Regards,

Milos

Hey,

Well, redirecting to other pages that have some other parameters inside the URL may be a problem in this case.

Now, I don’t know how your system looks like and if all paypal buttons are the same or not, but the easiest solution that I can see in this case is to encode the url parameters instead of just passing them like that. This basically means that your window.open code should open the link like following:

../security/login.php?to=<?= urlencode("https://www.sandbox.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=U4") ?>

This urlencode function is built in PHP function that you can use.

I hope that it helps.

Regards,

Milos

Hello, Hello, Thanks a lot it works great.It was the solution:your loss of time saved me time!
But now I have a new problem of loggin: it is ok on local but on my server: I have exactly the same configuration.When I want to logg in and push the button loggin it change in “logging in ” but don’t go further. congiguration to explain two folders “security” (with your script) and “vente” (with a template and loggin inside with

<input type="text" id="login-username" name="username" class="input-xlarge form-control"> <br />
  etc....and 

with on top

include "../security/ASEngine/AS.php";

Doesn’t work on server but ok on local. Second test I made with a simple : a form.php in the “vente” folder with the same kind of code

../security/ASEngine/AS.php
and further all the        <script type="text/javascript" src="../security/ASLibrary/js/asengine.js"></script>
        <script type="text/javascript" src="../security/ASLibrary/js/register.js"></script>
 ....

Ok in local not on the server allways stay at “logging in”. If put the same file form.php in the “security” folder and remove all the ../security/ work on local and work on server If you have time can you explain me? Best regards dup

Hey,

You probably have some javascript error or maybe some javascript files are not included properly. You should check your browser console and see if there are any errors. Also, don’t forget to enable debug mode (http://docs.as-php.com/developer-guide.html) while you are developing so you can see all the errors properly.

Regards,

Milos

Thanks for your answer, but perhaps I’m not to the height of your script! The last things I also tried is to copy your login.php in the folder ‘vente’ and I changed all the patth in it with ../security/ befor each links and try to login with it ( so I use only your js): I obtain allways the same result: when I press the loggin button it change in “logging in” and nothing else. must we copy all your files in all folder where we want to use it and write only the original path like ASEngine/AS.php,ASLibrary/js/asengine.js You spoke in another response about to pout the minimum..for me the minimum is:

include "../security/ASEngine/AS.php";
        <div>
    Name:  <input type="text" id="login-username" name="username"class="input-xlarge form-control"> <br />

   password: <input type="password" id="login-password" name="password" class="input-xlarge form-control">

    envoi:  <button id="btn-login" class="btn btn-success"><?= trans('login'); ?></button>                                                       
</div>
        <script type="text/javascript" src="../security/assets/js/sha512.js"></script>
        <script type="text/javascript" src="../security/ASLibrary/js/asengine.js"></script>
        <script type="text/javascript" src="../security/ASLibrary/js/register.js"></script>
        <script type="text/javascript" src="../security/ASLibrary/js/login.js"></script>
        <script type="text/javascript" src="../security/ASLibrary/js/passwordreset.js"></script>

best regards dup

Hey Dup,

Whenever you have such issues you need to debug it and see what the problem is. In this case, you must open your browser developer tools and see if there are any errors inside the console (there will probably be some errors in this case).

Once you see what the errors are, you need to debug if ajax requests are being properly sent to correct file, which in this case is ASEngine/ASAjax.php. That might be the issue here, since the URL inside loging.js file is pointing to ASEngine/ASAjax.php file but since you changed the file path for login.php file and moved it away from other files, you should update those paths too.

More on how to debug AJAX requests is explained inside the docs: http://docs.as-php.com/developer-guide.html#debugging-ajax-requests

Regards,

Milos

hi thanks I’m give up to use a page outside than your directory! and about the minimum I wrote in the last message Is this ok I want to use your script inside different pages only to login not to registrer!! I’m imposing myself still some hours to try this and if it doesnt work I will try to find another product more easy to use with less files to edit without resentment I thank if you answer about my last question Best regards

Hey,

Of course that you can use the script only for login and not for register. Users can be manually added by administrator from users.php page, and this means that you can remove registration completely if you don’t want to use it.

Regards,

Milos

Hello, Thanks to learn me to use the debug mode in google chrome and found problem: problem is allways path of files!! Allways asking a lot of files from ASEngine and vendor! it’s not enough to give the path of of the script in the ASConfig.php and in the page where there is a login form like in my other post

include "../security/ASEngine/AS.php";and all ../security/

I must copy all the folder ‘ASEngine’ and ‘vendor’ inside the folder.So If I have a folder ‘A’ with inside a index.php with a simple login form, I must copy inside this folder the folders ‘ASEngine’ and ‘vendor’.So in each folder I want to use a login, I must copy your ‘ASEngine’ and ‘vendor’if not it doesn’t work (for me). A little strange why all the files are not linked/referenced from the path of the ‘AS.php’ declared in include ”../security/ASEngine/AS.php”? Best regards

Hey,

Of course that you should not copy all those files in each folder. You actually should not move those files at all and all you need to do is to update the URL to ASAjax.php file inside ASLibrary/js/login.js file so it knows to which location the login data should be sent.

Regards,

Milos

so I must have only a login.js in every folder where I use the sript? not clear sorry

Regards

Hey,

No no, you just need to include the login.js file anywhere you are using the login form and to update the URL to ASAjax.php file inside that login.js file to use absolute path instead of relative path that it is currently using.

This means that, if you have uploaded the AS files to, lets say, “security” folder, and you want to use login in folder “A”, you will need to update the path inside login.js file to look like /security/ASEngine/ASAjax.php (to be the absolute path to ASAjax.php file) so it always look the same, no matter in which folder you are using the login.js file.

Hope that this helps.

Regards,

Milos

Hello Thanks and thanks it finally works! But for me for it is a little strange because if i had extracted your rar in a folder nammed ‘loggin’ with all your files inside and leave the url path inside the login.js by default $.ajax({url: “ASEngine/ASAjax.php”, your product doen’t work right out the box. I should have to open this file and write $.ajax({url: ”/loggin/ASEngine/ASAjax.php”. Why the path of the ASAjax.php is not bound hierarchically with the ‘AS.php’ declare in the page who contains the form? Really thanks for your patience and really sorry if it was ? written in the documentation Dup

Hey Dup,

I’m glad that it is working properly now. Well if you are not changing the location of login.php file then you would not have to change the URL inside login.js since it uses relative path, no matter in which directory or subdirectory the files are.

Regards,

Milos

Hello THe problem was’nt with the place of login.php because I never changed anythings to the place of yours files I just used a simple form inside a page like

<?php 
include "../security/ASEngine/AS.php";
?>
<!doctype html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Choix</title>
        <script type="text/javascript" src="../security/assets/js/jquery.min.js"></script>
        <script type="text/javascript" src="../security/ASLibrary/js/js-bootstrap.php"></script>

</head>

<div>
   Name:  <input type="text" id="login-username" name="username"class="input-xlarge form-control"> <br />
   password: <input type="password" id="login-password" name="password" class="input-xlarge form-control">
   envoi:  <button id="btn-login" class="btn btn-success"><?= trans('login'); ?> </button>                                                       
</div>
    <script type="text/javascript" src="../security/assets/js/sha512.js"></script>
        <script type="text/javascript" src="../security/ASLibrary/js/asengine.js"></script>
        <script type="text/javascript" src="../security/ASLibrary/js/register.js"></script>
        <script type="text/javascript" src="../security/ASLibrary/js/login.js"></script>
        <script type="text/javascript" src="../security/ASLibrary/js/passwordreset.js"></script>

and don’t use the login.php at all . And without to change the path inpath inside login.js like /security/ASEngine/ASAjax.php it never worked That’s why I asked: Why the path of the ASAjax.php is not bound hierarchically with the ‘AS.php’ declare in the page who contains the form? Regards Dup

Hey,

Well you haven’t used the login.php but you included the login.js on some other page that is not inside the same directory as the rest of AS files, and that means that absolute path to the ASAjax.php file is different than how it was expected to be. It has nothing to do with AS.php file, since login.js is just a javascript file.

But anyways, I’ll try to figure something out for next release to have the path be detected by using the SCRIPT_URL value from ASConfig.php file.

Regards,

Milos

Thanks for everythings : I and you learned me a lot. But I have a last question now, because I must to have a lot of flexibility in my web site so I must use your script-login in differents ways: as modal form, as inside a webpage and as open the total login page in a new window. So is it possible or must I have different files: login.js like login1.js,login2js,... call by different other things? Not so easy to understand all the steps of your script when loading a page, than before and after click on login? So I’m a little lost.I bought a temple in Envato : https://themeforest.net/item/learnplus-education-lms-responsive-site-template/12802106?s_rank=4 with paypal, login etc…and in the description it was written php files wwith a s to files but finally there is only one(for email )That’s why I bought your script but finally not easy to have simple things. William Shakespeare said :“We are such stuff as dreams are made on, and our little life is rounded with a sleep.” Best regards

Hey,

No problem, I’m glad that my script and my answers helped to you learn something new.

When you set the absolute path to ASAjax.php file inside login.js, it will always send the data properly and doesn’t matter where you include that login.js file and whether it is a modal popup or standalone page in different directory.

Regards,

Milos

Hey,

Please let me know which issues you have by posting the comment here, and I’ll be glad to help.

Regards,

Milos

I install it, and every installation does something different. Sometimes none of the php pages load properly, sometimes it works fine, and when I attempt to protect a page nothing happens, it just turns straight into HTML, even if I make it a php page.

Hey,

That’s really weird. Can you paste here an example of how you are protecting pages? Also, if possible, please share some URLs to your website so I can see it in action?

Regards,

Milos

Alright, I got it working after a good bit of work (turns out it was a problem with my hosting), and its working great. I just have one more question, Is there any way to make it so that you require a referral code to register an account? If not, could you help me put a system in place for that?

Hey,

I’m glad you found out what was the issue! Well you will need to modify the registration form to add that field, since there is no such thing out of the box.

Basically, what you will need to do is to edit the following files and make them fit your needs:

1) login.php – This is the file where the actual HTML for the registration form is located. You need to edit this form and add any field you want there.

2) ASLibrary/js/register.js – This is the file which is responsible for sending the data to the server via AJAX. You need to extend it by adding one more field there (the one you added inside the HTML for registration form) by using the same way as it was done for all other fields inside the registration form.

3) ASEngine/ASRegister.php – This is the class responsible for registering the user inside the system and what you will need to update is the register method inside of it to either check if your referral code is valid or maybe keep it to database, whatever works for you.

Regards,

Milos

Alright. I did it, and its all working, except for the function that calls db->update. I copied it word-for-word and even looked at the instructions on ASDatabase.php

Why isnt it working: https://pastebin.com/FFPtNpA2 I have tried, everything.

Also, most of my friends who looked at your code keep telling me that the ASDatabase update function’s prepare statement is used incorrectly, and it is extremely vulnerable to SQL injection. You going to fix that anytime soon?

Hey,

It looks ok but do you get any errors from that database call? If it is not working, then you must get some error. Of course, don’t forget to enable debug mode http://docs.as-php.com/developer-guide.html so you can actually see the errors on the screen.

From what I see there is nothing to be fixed inside ASDatabase::update function related to SQL injection, but maybe I’m missing something. Can you please elaborate on why you or your friends think that that is is vulnerable?

Regards,

Milos

I do not have any errors in error_log or any other error file, and yes debug mode is enabled. If there is an error given, however, it will return undefined on a green box under the register page. If no errors, it says Success. It returns success even though it isnt working. I cannot find any other error lists.

Here’s what they said about prepared statements. The first message they ripped me a new a$$hole so I had to clear it up a bit:

” You should use prepared statements because not using it you are simply making your application very insecure, vulnerable to a lot of different things, SQL injection being one of them. It is also faster to execute, since all queries are prepared beforehand It also follows DRY, when not using a prepared statement, you need to repeat yourself all the time you want to interact with the database, but with a prepared statement, you can just reuse the old and not have to make a new one. “

Hey,

That’s really strange. Can you describe a bit more what exactly is happening when you call that update method? Are you sure that you have referral_code and referral_used fields in DB and that your $user['referral'] has correct value?

About prepared statements, ASDatabase is using them properly, so I’m not sure why exactly they told you that it is “insecure”... It’s either that I’m missing something there or that they haven’t checked and understood properly how update method is working.

Regards,

Milos

I have referral_code and referral_used in as_users, and user referral has the correct value, It has been set so there shouldnt be any problems

I am linking you this post about how to use prepared statements; https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?noredirect=1&lq=1

Hey,

If it’s possible please provide some temporary ssh/ftp access to the server so I can see what can be an issue. You can send me the info via contact form on my CodeCanyon profile page.

About the link you referenced, that’s exactly how ASDatabase::update is using prepared statements, so I guess that your friends just don’t understand how that method works. If I’m wrong, please send me an example of SQL injection where you use ASDatabase::update method with some malicious user data. I’m very interested to see such thing.

Regards,

Milos

I managed to figure it out, after going back and trying something I did before but fixed a few things and now it works, I had the where and the data statements I wanted to change flipped around.

It’s not me saying that it’s vulnerable, I don’t know what they mean, I don’t know enough PHP to do that, but is there any way for you to explain to them it’s correct?

Hey,

Well default behavior for the app is to redirect user to index.php after successful authentication. You can easily customize that inside ASConfig.php file, like it is explained inside the docs http://docs.as-php.com/configuration.html#login but, if you want to just refresh the page and make the script stay on the same page after user log in successfully, then I would recommend you to edit ASLibrary/js/login.js file and modify loginUser function to just refresh the page instead of redirect on successful login.

This basically means that you will replace

window.location = result.page;

with

location.reload();

Regards,

Milos

hello, Thanks for your answer I changed the line in the login.js but the redirection is allways index.php The loggin.php close and return to index.php Best regards Dup

Hey Dup,

I’m not sure that I understand exactly how you have it implemented… Do you display the login form inside a popup modal, like you explained earlier, or you redirect users to login.php page?

Regards,

Milos

Hi Milos, Thanks again to help me. My project is to have a part of my website to sell some music courses: every course have a own page. so in each page I want to call either your login.php and after login to return to the page of course either to have a form/login inside each page to log and stay on the page. It’s egal for me but I can’t achieve anything. I want something like here in Envato site: I log and stay in the page.

I tried to put in the page of the course include “ASEngine/AS.php”; $redirect = $_SERVER[‘SERVER_NAME’].$_SERVER[‘PHP_SELF’]; $_SESSION[“maVar”]= $redirect; then call your login.php and than inASConfig: $redirection = $_SESSION[“maVar”]; and further: define(‘SUCCESS_LOGIN_REDIRECT’, serialize(array(‘default’ => ”$redirection”))); but it doesn’t work neither Regards Dup

Hi again, I finally found a solution but not sure if it is in the rules of art! Can you plesase comment me your impressions.

In all page where we can login and in your login.php I put in script balise

document.cookie = "origine="+window.location;

and in the ASConfig.php
<code>$redirection = $_COOKIE['origine'];</code> and futher:
<pre><code>define('SUCCESS_LOGIN_REDIRECT', serialize(array('default' => "$redirection")));</code>

Best regards</pre>

Hey,

Well that’s an acceptable solution, however I would probably use session instead of cookies since cookies are accessible from a browser.

From what you have first described, I thought that you want to have the login form inside a modal popup (not as a separate page) and that’s why I told you to update the login.js to just reload the page instead of redirecting you to another page.

However, from the code you pasted above, it looks like you are actually redirecting the user to login.php and you want to redirect him back to previous page after login. In that case, you can do it by storing previous URL inside the session (similarly how you implemented it with cookies) or you can implement it like I described here: https://codecanyon.net/item/advanced-security-php-registerlogin-system/5282621/comments?page=45&filter=all#comment_17581717

But again, your cookie solution is acceptable and it’s fine if you want to leave it like that.

Regards,

Milos

Hello Milos, wooah!I looked a little in this forum: you really master! Thanks

Why don’t write a paypal or shopping cart as addon to you script and database.Something like :if pay a product, the buyer can access to certain pages. I’m sure that for 15-20$ the 90% of the person who bought this script will pay for that!;-) Never seen this kind of product Best regards Dup

Hey Dup,

Thank you for your kind words.

I will definitely implement something like that, and it is on my list of things to do, however I’m really busy at the moment and I don’t have time to do it now. But, I agree, it is good thing to have and it will be used by a lot of people.

Regards,

Milos

Hello, I tried your better solution mentioned than cookies but doesn’t works . I allways come back to index.php. like if the redirection is allways guide by the ASConfig.php I’m starting to go crazy. I thought what I wanted was simple but finally I can’t achieve what I want. I have several pages couresA.php, courseB.php… each pages has a button to open the your login.php . What I wanted is that when people click on the “login button” they return from where they come from. they allways finish to the “index.php”. Is possible to have a global variable from the page courseA.php, courseB.php like

$redirection =$_SERVER['SERVER_NAME'].$_SERVER['PHP_SELF'];

or

$_SESSION('redirection') = '$_SERVER['SERVER_NAME'].$_SERVER['PHP_SELF']';

and to recuparate it in the ASConfig.php and put in it :

define('SUCCESS_LOGIN_REDIRECT', serialize(array('default' => "$redirection")));

Or must I need another script. I just want something like this envato site Is there somebody can help without to disturb allways the same person? Best regards and thanks

Hey,

I’m not really sure why this is confusing you, but let me try to explain what you need to do again… This is one solution (probably, the easiest), but there are also a lot of different similar solutions.

Ok, so, here is one way to do it:

1) On any course page you have, as you sad, you have the login link where user can click and be redirected to login page. What you need to do is to update that link so it has the URL to the current page as a parameter. For example, you have this button somewhere on your courseA.php page:

<a href="login.php?to=http://google.com">Log In</a>

2) Now, on top of login.php file, right after you require AS.php file and check if user is logged in, you can add this

$redirectPage = isset($_GET['to']) ? $_GET['to'] : get_redirect_page();

ASSession::set('redirect', $redirectPage);

3) Inside ASLogin.php file, at the bottom of userLogin method, you will modify the redirect to look like following:

 respond(array(
    'status' => 'success',
    'page' => ASSession::get('redirect')
));

And that’s really all you need to do and after successful login you will be redirected to google (or to any url you specify).

The way you described above is incorrect since if you have

$redirection =$_SERVER['SERVER_NAME'].$_SERVER['PHP_SELF'];

and put that into session on each page, when you access the login page it will put the actual login.php page as redirect URL, which means that users will be automatically redirected from login.php to, again, login.php page, which will then just redirect them further to index.php since they are already logged in.

Hope that this helps!

Regards,

Milos

Hey,

Yes. In fact, AS is already using AJAX for user login.

Regards,

Milos

Thanks for your quick response, but I cannot understand how. I understand how to protect a page with PHP code, but how to use an Ajax call from one page to activate protected functions from the same page, I do not see how to do it from your docs.

Hey,

Not sure that I understand what exactly you want to do, but you just send and ajax request to ASAjax.php file with appropriate “action” value to get the data or do whatever you want… Sending an ajax request from from one page to the very same page is something that you should try to avoid.

Regards,

Milos