The Database Forum

**Lashtal** · 08-06-2008, 03:45 PM

I just uploaded a script and it requires a Username and a Password to access the script.

When I installed the script it did not contain a username or a password already in place.

I guess I am supposed to define the Username and Password into two distinct categories to complete setup on the script, but I don't know how to define Username or Password for a specific table, using MySQL statements.

Perhaps you could help?

**Learning Newbie** · 08-06-2008, 07:43 PM

It depends how the script is coded - you could use a lot of different password protection implementations, and we have no way of knowing which is in place.

**Lashtal** · 08-07-2008, 03:14 AM

I mean particularly...

if I was accessing my database via PHPmyAdmin.

If I am not using an Installer to set up a script (which usually drops the SQL information into the database at it's installation automatically); I am typically copying the SQL information from the document itself and pasting it into the database via the "Run SQL query/queries" setting.

This script however did not include a password or a username to access the administrative section of said script.

I was wondering if there was a query I could run in PHPmyAdmin to populate the admin_username table and the admin_password table with a cusom password/username of my choice utilizing mySQL queries to create/drop such information into said tables.

**chrishirst** · 08-07-2008, 04:31 AM

BTW don't say DROP with regards to SQL questions about creating objects

You CREATE USER then GRANT the user privileges to the table.

**JeremyMiller** · 08-07-2008, 08:29 AM

I think, Lashtal, that you didn't get John's point. Passwords aren't always just stuck in the same table in every database nor in the same manner. Some people will put it in a user table, others an admin table, others a customer table... Then, when they store the password, some will do it plain-text, others with SQL's PASSWORD function, others with MD5 or SHA1, others with MD5 or SHA1 with a seed value, ...

So, without knowing more details of how the script is actually working, we can't help you further.

Here's a tip, though: Start with the login script and find where it's trying to log in a user. When you find that code, post it here (but remove any stuff unique to your system for your own safety) and then we can help.

**Learning Newbie** · 08-07-2008, 03:04 PM

Quote:

Originally Posted by JeremyMiller

I think, Lashtal, that you didn't get John's point. Passwords aren't always just stuck in the same table in every database nor in the same manner. Some people will put it in a user table, others an admin table, others a customer table... Then, when they store the password, some will do it plain-text, others with SQL's PASSWORD function, others with MD5 or SHA1, others with MD5 or SHA1 with a seed value, ...

I like to look at implications of something, and whether they're acceptable or not, if I have to guess about that something. If all usernames and passwords for all systems were always stored in the same set of tables, it would be very easy for anybody to hack into any system they have some level of access to. For security purposes, people tend not to reuse this kind of stuff.

Chris pointed out the first thing that jumped to my mind. The database itself may be configured to not grant access to whatever user account you're logging into it with. The way to fix that would be, well, exactly what Chris said. It could be that the code itself that you're installing has its own authentication method (that's my hunch) which might involve tables, or it might be a hard coded value (which would be harder to figure out with some SQL queries ). Or something entirely different.

With PHPmyAdmin, or some other client (even one running on your Windows desktop) you can write queries to INSERT data (VALUES, more properly) into those admin tables. That might or might not fix your issue.

**Lashtal** · 08-07-2008, 04:52 PM

login script is here...

Code:

<?php
// >> Make files usable
define('IN_SITE', true);
require('../includes/sql.php');
require('../includes/settings.php');
if ($_SESSION['loggedin'] == 1) {
 do_redirect('./');
}
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<title>Administrative Login</title>
<style type="text/css">
body {
 font-family: Verdana, Arial, Helvetica, sans-serif;
 font-size: 12px;
 margin-top: 50px;
 background-color: #444;
}
h3 {
 margin: 0px 0 5px 0;
 font-size: 15px;
}
input.box {
 border: 1px #BBB solid;
 padding: 2px;
}
input.submit {
 font-size: 14px;
 padding: 2px 10px;
}
label {
 cursor: pointer;
}
.outer-bord {
 border: 10px #222 solid;
 background-color: #FFF;
}
.inner-bord {
 background-color: #F6F6F6;
 border: 1px #DDD solid;
 padding:4px;
}
</style>
</head>
<body>
<table align="center" cellpadding="0" cellspacing="10" width="400" class="outer-bord">
  <tr>
    <td><table cellpadding="0" cellspacing="6" width="400" class="inner-bord">
        <tr>
          <td colspan="3" align="center"><h3>Administrative Login</h3></td>
        </tr>
        <form id="adminlogin" name="loginform" method="post" action="process.php">
          <tr>
            <td><img src="images/icons/user.png" width="16" height="16"></td>
            <td><label for="admin_user">Username</label>
            </td>
            <td><input type="text" name="admin_user" id="admin_user" size="42" class="box">
            </td>
          </tr>
          <tr>
            <td><img src="images/icons/key.png" width="16" height="16"></td>
            <td><label for="admin_pass">Password</label>
            </td>
            <td><input type="password" name="admin_pass" id="admin_pass" size="42" class="box">
            </td>
          </tr>
          <?php
   if($_GET['msg'] == 'Login Failed') {
    ?>
          <tr>
            <td colspan="2"></td>
            <td><font color="#900"><strong>
              <?= $_GET['msg'] ?>
              </strong></font></td>
          </tr>
          <?php
   }
    ?>
          <tr>
            <td colspan="2"></td>
            <td><input name="" type="submit" value="Sign In" class="submit"></td>
          </tr>
        </form>
      </table></td>
  </tr>
</table>
</body>
</html>

_______________________________________________

Think the problem I had was HERE however (the SQL query is as follows):

Code:

-- 
-- Table structure for table `advert_ads`
-- 
CREATE TABLE `advert_ads` (
  `ad_id` smallint(5) NOT NULL auto_increment,
  `ad_status` tinyint(1) NOT NULL,
  `ad_area1` smallint(5) NOT NULL default '0',
  `ad_area2` smallint(5) NOT NULL default '0',
  `ad_area3` smallint(5) NOT NULL default '0',
  `ad_name` varchar(255) NOT NULL default '',
  `ad_goto` text NOT NULL,
  `ad_type` tinyint(1) NOT NULL default '1',
  `ad_img` varchar(255) NOT NULL default '',
  `ad_alt` varchar(255) NOT NULL default '',
  `ad_w` smallint(5) NOT NULL default '0',
  `ad_h` smallint(5) NOT NULL default '0',
  `ad_custom` text NOT NULL,
  `ad_views` mediumint(8) NOT NULL default '0',
  `ad_clicks` mediumint(8) NOT NULL default '0',
  PRIMARY KEY  (`ad_id`)
) TYPE=MyISAM;
-- --------------------------------------------------------
-- 
-- Table structure for table `advert_areas`
-- 
CREATE TABLE `advert_areas` (
  `area_id` smallint(5) NOT NULL auto_increment,
  `area_name` varchar(255) NOT NULL default '',
  PRIMARY KEY  (`area_id`)
) TYPE=MyISAM ;
-- --------------------------------------------------------
-- 
-- Table structure for table `categories`
-- 
CREATE TABLE `categories` (
  `cat_id` smallint(5) NOT NULL auto_increment,
  `cat_name` varchar(255) NOT NULL default '',
  `cat_clean` varchar(255) NOT NULL,
  `cat_desc` varchar(255) NOT NULL default '',
  `cat_status` tinyint(1) NOT NULL default '1',
  `cat_type` enum('Games','Media','Other') NOT NULL default 'Games',
  `cat_img` tinyint(1) NOT NULL default '1',
  `cat_code` tinyint(1) NOT NULL default '1',
  `cat_innav` tinyint(1) NOT NULL default '1',
  PRIMARY KEY  (`cat_id`)
) TYPE=MyISAM ;
-- --------------------------------------------------------
-- 
-- Table structure for table `config`
-- 
CREATE TABLE `config` (
  `config_id` tinyint(3) NOT NULL default '0',
  `config_lastreset` int(10) NOT NULL,
  `config_admin_user` varchar(25) NOT NULL default '',
 `config_admin_pass` varchar(32) NOT NULL default '',
  `config_siteurl` varchar(255) NOT NULL default '',
  `config_sitename` varchar(255) NOT NULL default '',
  `config_tagline` varchar(255) NOT NULL default '',
  `config_email` varchar(255) NOT NULL default '',
  `config_rewrite` tinyint(1) NOT NULL default '0',
  `config_gzip` tinyint(1) NOT NULL default '0',
  `config_tellafriend` tinyint(1) NOT NULL default '0',
  `config_template` varchar(255) NOT NULL,
  `config_contact` tinyint(1) NOT NULL default '0',
  `config_links` tinyint(1) NOT NULL default '0',
  `config_limit_home` tinyint(3) NOT NULL default '0',
  `config_limit` tinyint(3) NOT NULL default '0',
  `config_max_width` smallint(5) NOT NULL default '0',
  `config_max_height` smallint(5) NOT NULL default '0',
  `config_img_width` smallint(5) NOT NULL,
  `config_img_height` smallint(5) NOT NULL,
  `config_delayedadd` tinyint(1) NOT NULL,
  `config_delayednum` smallint(5) NOT NULL,
  `config_meta` tinyint(1) NOT NULL,
  PRIMARY KEY  (`config_id`)
) TYPE=MyISAM;
-- --------------------------------------------------------
-- 
-- Table structure for table `games`
-- 
CREATE TABLE `games` (
  `g_id` mediumint(8) NOT NULL auto_increment,
  `g_status` tinyint(1) NOT NULL default '1',
  `g_name` varchar(255) NOT NULL default '',
  `g_clean` varchar(255) NOT NULL,
  `g_category` smallint(5) NOT NULL default '1',
  `g_type` tinyint(1) NOT NULL default '1',
  `g_date` int(10) NOT NULL default '0',
  `g_desc` varchar(255) NOT NULL default '',
  `g_instructions` varchar(255) NOT NULL default '',
  `g_author` varchar(255) NOT NULL default '',
  `g_auth_site` varchar(255) NOT NULL default '',
  `g_flags` varchar(255) NOT NULL default '',
  `g_keywords` text NOT NULL,
  `g_filename` varchar(255) NOT NULL default '',
  `g_iconname` varchar(255) NOT NULL default '',
  `g_filelocation` tinyint(1) NOT NULL default '1',
  `g_iconlocation` tinyint(1) NOT NULL default '1',
  `g_width` smallint(5) NOT NULL default '0',
  `g_height` smallint(5) NOT NULL default '0',
  `g_custom` text NOT NULL,
  `g_totalplays` mediumint(8) NOT NULL default '0',
  `g_playedtoday` smallint(5) NOT NULL default '0',
  `g_lastplay` int(10) NOT NULL default '0',
  `g_totalvotes` smallint(5) NOT NULL default '0',
  `g_totalvotesum` smallint(5) NOT NULL default '0',
  PRIMARY KEY  (`g_id`)
) TYPE=MyISAM ;
-- --------------------------------------------------------
-- 
-- Table structure for table `links`
-- 
CREATE TABLE `links` (
  `link_id` mediumint(8) NOT NULL auto_increment,
  `link_status` tinyint(1) NOT NULL default '0',
  `link_special` tinyint(1) NOT NULL default '0',
  `link_name` varchar(255) NOT NULL default '',
  `link_desc` varchar(255) NOT NULL default '',
  `link_url` varchar(255) NOT NULL default '',
  `link_email` varchar(255) NOT NULL default '',
  `link_total_in` int(5) NOT NULL default '0',
  `link_total_out` int(5) NOT NULL default '0',
  `link_submit_ip` varchar(50) NOT NULL default '',
  PRIMARY KEY  (`link_id`)
) TYPE=MyISAM  PACK_KEYS=1;
-- --------------------------------------------------------
-- 
-- Table structure for table `online`
-- 
CREATE TABLE `online` (
  `online_ip` varchar(255) NOT NULL default '',
  `online_time` int(10) NOT NULL default '0',
  UNIQUE KEY `online_ip` (`online_ip`)
) TYPE=MyISAM;
-- --------------------------------------------------------
-- 
-- Table structure for table `sitenews`
-- 
CREATE TABLE `sitenews` (
  `news_id` smallint(5) NOT NULL default '0',
  `news_title` varchar(255) NOT NULL,
  `news_author` varchar(255) NOT NULL default '',
  `news_date` int(10) NOT NULL default '0',
  `news_text` text NOT NULL,
  PRIMARY KEY  (`news_id`)
) TYPE=MyISAM;

__________________________________________________ _

Quote:

With PHPmyAdmin, or some other client (even one running on your Windows desktop) you can write queries to INSERT data (VALUES, more properly) into those admin tables. That might or might not fix your issue.

- Learning Newbie

Think this is what I was looking for.

Would you happen to know the exact syntax for such a query?

**Learning Newbie** · 08-07-2008, 05:09 PM

Quote:

Originally Posted by Lashtal

Think this is what I was looking for.

Would you happen to know the exact syntax for such a query?

Ahhh, ok, you actually did your homework, and we gave you a lecture for asking the more detailed question. Sorry about that. Most people don't do the homework up front, most of us aren't really used to it!

So, yeah, I know the exact syntax for such a query, and I'll share it with you. But ("and it's a big but" -Colbert) I only know the SQL syntax, the code to affect change in the database. I don't know how the login script will respond to that. We're going to put a new row (aka record) in your config table, and we're going to force some particular data into 2 of the columns (aka fields). But there are a whole bunch of other columns in that table, and I don't know how the script uses config_meta. The code I'll share is going to ignore all of the columns except the user name and password, since I really don't know. It's pretty easy to expand the code to fill those columns, too, and this is sort of a "caveat emptor" warning.

Code:

INSERT INTO config ( config_admin_user, config_admin_pass )
VALUES ( 'Lashtal User', 'Lashtal Password' )

You'll have to provide a value for config_lastreset, too. You might try the date and time when you do this, or a week ago? All of the columns are constrained NOT NULL, and this is the only one that doesn't provide a default value for when a null is encountered, which means the query will fail if you don't provide a value. I doubt the script cares very much, but it might, and I don't know what it might look for? I would guess you also want to fetch the highest config_id and set yours to be one more, but again I could be wrong? It might be that if they had wanted that functionality they would have set it as an identity column, but I really don't know.

But, you can see how it lists out the target columns you want to fill, and the values (in the same order!) you want to put in them. So if it doesn't work, you can always delete that row, and try a new set of values.

**JeremyMiller** · 08-07-2008, 06:03 PM

The code you gave has a 32 character password, so it's probably md5, but it might have a seed. PHPMyAdmin has an md5 function if you want to give that a shot.

What I would do, however, is search for "config_admin_pass=" or "config_admin_pass =" in all files. Why? One of those is likely to be an insert/update and will give you a hint as to what the system is doing when it creates a password. If you do that and find that code segment, then we could likely give you the answer you're hunting for.

**Lashtal** · 08-08-2008, 04:32 AM

Quote:

Originally Posted by Learning Newbie

Code:

INSERT INTO config ( config_admin_user, config_admin_pass )
VALUES ( 'Lashtal User', 'Lashtal Password' )

That would be it!

Works, but I found out the script I was installing really sucked- lol

It was a script for games, but it was poorly constructed and didn't even include any games! lol

So I just decided to download some Flash .SWFs instead from here: http://www.dldb.org/free-flash-games/

If you've got something cooler, let me know!

**Lashtal** · 07:49 AM

Oh yeah... and thanks for your big help

See, I typically don't touch anything in MySQL manually- simply because all the scripts I run either do it for me at the installations of the scripts i'm running, OR they include a Config file that I upload to my server, and a SQL file with syntax that creates creates tables and populates the database.

So that's why I would be so reliant on the Syntax necessary to alter my database with the aide of MySQL queries.

"dropping sql CODE", not objects or tables!

**Learning Newbie** · 08-08-2008, 08:52 PM

Quote:

Originally Posted by Lashtal

See, I typically don't touch anything in MySQL manually-

If it makes you feel better, I don't, either.

But I make my living in Microsoft's SQL Server, and they're really pretty close to the same thing.