0

The following code below allows to me authenticate user against a custom table I created:

 function authentication($emailAdd, $password) {
            include_once('././wp-includes/class-phpass.php');

        global $wpdb, $formErr;

        if(1 > count($formErr->get_error_messages())){
            $hasher = new PasswordHash(8, TRUE);

            $table = $wpdb->prefix.'finusers';
            $results=$wpdb->get_row("SELECT * FROM $table WHERE email_address='$emailAdd'");
            $hashed_pwd = $results->password;
            //echo $hashed_pwd;

            if($hasher->CheckPassword($password, $hashed_pwd)){

                //redirection has to happen here

            }else{
                echo "Please check email address of password";
            }
        }
 }

My question is how can I redirect users to a specific page?

  • When is that authentication function called? And why do you use custom table? (and don't use any SQL escaping, and don't check any errors, and so on...) – Krzysiek Dróżdż Oct 11 '18 at 6:15
0

I assume that your function is called before any output is printed - otherwise redirection won't work.

The easiest way to redirect user to given URL is using:

wp_redirect( $url );
exit;

So your code might look like this:

function authentication($emailAdd, $password) {
            include_once('././wp-includes/class-phpass.php');

        global $wpdb, $formErr;

        if(1 > count($formErr->get_error_messages())){
            $hasher = new PasswordHash(8, TRUE);

            $table = $wpdb->prefix.'finusers';
            $results=$wpdb->get_row("SELECT * FROM $table WHERE email_address='$emailAdd'");
            $hashed_pwd = $results->password;
            //echo $hashed_pwd;

            if($hasher->CheckPassword($password, $hashed_pwd)){

                wp_redirect( $url );  // change to correct URL
                exit;

            }else{
                echo "Please check email address of password";
            }
        }
 }

PS. There are a lot of errors and problems with your code, though... And I really wouldn't use that on any site, I guess... At least not in current form... See my comments in code below

function authentication($emailAdd, $password) {
        // using ././ won't work. It should be ../../. And even that is risky, because the structure may be changed - you should use ABSPATH instead.
        include_once('././wp-includes/class-phpass.php');

        global $wpdb, $formErr;

        // so if there is exactly one error, everything is fine and user can be logged in? ;)
        if(1 > count($formErr->get_error_messages())){
            $hasher = new PasswordHash(8, TRUE);

            $table = $wpdb->prefix.'finusers';
            // Why no escaping? What if $emailAdd will contain special characters to perform SQL injection?
            // Another problem is that you query all rows, why no limit?
            $results=$wpdb->get_row("SELECT * FROM $table WHERE email_address='$emailAdd'");
            // And what if there are no such rows? Line below will cause error
            $hashed_pwd = $results->password;
            //echo $hashed_pwd;

            if($hasher->CheckPassword($password, $hashed_pwd)){

                wp_redirect( $url );  // change to correct URL
                exit;

            }else{
                echo "Please check email address of password";
            }
        }
 }
  • @Drozdz, the code is still in development, wouldn't be pushing it into production as yet. The code above only shows part of my project. There is function in my code that takes care of sanitizing and escaping before its passed on to the code above. I read your comments and will look into the suggestions you made. – Metal Zer0 Oct 11 '18 at 7:03
  • @MetalZer0 and still, you have a function that takes data and uses it in insecure manner. It's always a bad idea to do it in such way - after a while you won't remember about it and use it in such way, that SQL injection will happen ;) – Krzysiek Dróżdż Oct 11 '18 at 7:05
  • @Drozdz, most what I am doing comes from the wordpress codex. I broken up most of my code into functions, one that handle data validation, sanitizing and escaping or characters and authentication. – Metal Zer0 Oct 11 '18 at 7:14
  • @Drozdz, for sql injection I read about prepared statements on the wordpress codex. but what would you recommend? – Metal Zer0 Oct 11 '18 at 7:16
  • @MetalZer0 codex is only documenting functions. It doesn't teach you how to construct your functions or how to process errors in proper way. And clearly - your code ignores a lot of edge cases... But of course you may assume that you know better and there is no problem with it. As for SQL Injection - I would recommend to protect your code agains it and use prepared statements. – Krzysiek Dróżdż Oct 11 '18 at 7:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.