All About Ruby

Building a user authorization system in PHP - Part II

allaboutruby — Sat, 26 Aug 2006 20:18:34 +0000

Hashing passwords

In the last walkthrough you should have created a script that allows user to enter information in the HTML form and then stores this information in the database. The most obvious security hole is that we store password in the database in plain text. If somebody will be able to get the contents of your database, all user passwords will be in plain view to see.

This part of tutorial helps you learn how to make the passwords more secure. The common practice for storing passwords is storing a hash of a password, which is a scrambled copy of it. There is no easy way to decrypt the password, so this set up is much more secure. You will then compare the hash stored in MySQL with the hash of the user-input password. If both hashes are identical, then the password is correct.

There are 2 basic algorythms: SHA1 and MD5. Because a specific password always corresponds to a specific hash value, the attacker does not need to brute-force the hash to get the underlying password. If you build a database of all possible passwords, you can get the plain-text password by doing a hash lookup in the database. Here is an example: MD5 lookup. As there are no reliable SHA1 lookup services at the moment, it is safer to use this algorythm with some kind of modification (called salt). Here’s the line you need to add to your register.php:

$password = sha1(sha1($password).”mysecretcode”);

Building a user authorization system in PHP - part I

allaboutruby — Sat, 26 Aug 2006 19:54:18 +0000

Recently I needed to start my new PHP project and required a basic (but secure) user authorization / registration script. To my surprise I was not able to find one script that would allow me to register users in MySQL database, require user activation via email, show a turing (aka captcha) at the login form and have no obvious security holes.

16 hours later, I now have my own script and understand better why there is no universal script available on the Net (the task turns out non-trivial and requires a lot of security tweaking).

In this post I will start discussing how a user authorization script should be developed. You will be interested in this script if you:

1. Create projects in PHP
2. Require some basic user registration and login
3. Do not want your site to be easily hackable

Ok, here goes…

Any basic user auth script will consist of the following:

1. Registration HTML form
2. Registration validation
3. Creating a user record in MySQL
4. Login HTML form
5. Login validation
6. Session creation and management
7. Session destruction on logout

Apart from these it is also always nice to have the following:

1. Use a captcha to prevent automatic registrations
2. Store a list of crack attempts and ban users
3. Encrypt password
4. Send activation emails
5. Prevent MySQL “insertion bug” attacks
6. Prevent session hijacking

1. Creating an HTML registration form

So, let’s start with the easy part: the HTML form. Here it is. Copy & save it to a file called form.php (there is no php at the moment, only pure HTML but you might need it later).

Registration form





Username:  


 Email:  


 Password:  


 Verify password:

Here are some comments: This is how the HTML FORM is set up:

Method should always be POST, which is a tiny bit more secure. The script name in action attribute is “register.php”, we will call this script once the user hits “Submit” button.

After that follows the standard input forms for your registration form. Spend some time thinking what information you will require on your site users.

The only things to note here is that the name attribute should be unique (you will need it later) and every field should have a maxlength, so that user will not be allowed to enter a 250-letter long username.

Finally, this code actually displays a button and submits the form to our script “register.php” if you click on it or hit “Enter”:

2. Creating a MySQL table to hold users

Ok, now you need somewhere to store all this info. You should already have a MySQL database ready (you should know username, database name, database password and database address). The usual set-up for hosting providers is to give you a username = database name = your login at hosters and database address is most of the time “localhost”.

You should also have some way to administer the MySQL. Usually it’s phpMyadmin. Go there, select the database and click SQL. Paste the following code in the dialog and execute it (but before doing that, better read what it means below!)

CREATE TABLE `users` (
`id` int(11) NOT NULL auto_increment,
`username` varchar(15) NOT NULL default ”,
`password` varchar(100) NOT NULL default ”,
`ip` varchar(20) NOT NULL default ”,
`email` varchar(50) NOT NULL default ”,
`status` int(3) NOT NULL default ‘0′,
`added` timestamp NOT NULL default ‘0000-00-00 00:00:00′,
PRIMARY KEY (`id`) )
ENGINE=MyISAM DEFAULT CHARSET= latin1 AUTO_INCREMENT;

SQL actually has a very simple syntax. We are creating a table “users” which has 7 fields. id is the id of the record, every record should have one, and it should be unique. You let MySQL select the id for you by specifying “auto_increment”. There are 3 most useful data types (at least for the registration form) in MySQL: INT, VARCHAR and TIMESTAMP.

You use INT to store integers, you use VARCHAR to store strings and you use TIMESTAMP to store date and time. We should also specify length for INT and VAR in round brackets. If you need to add more fields to the table, it can easily be done using phpMyadmin (see its documentation).

Once the table is created, it is time to create our register.php script, that will receive the values from the application form.

3. Creating the register.php script

First, define those variables, filling in the appropriate info:

$db_host=”localhost”;
$db=”yourinfohere”;
$db_user=”yourinfohere”;
$db_passwd=”yourpasswordhere”;

Then, create the procedure to connect to the database:

function db_connect() {
Global $db, $db_base, $db_user, $db_passwd;
$connect=@mysql_connect($db_host,$db_user,$db_passwd);
if(!$connect) return $connect;
$connect=@mysql_select_db($db);
return $connect; }

Now, call the function and it should connect to the database. You can test it by writing something like:

If (!db_connect()) { echo “Error connecting!”; }

Ok, to make you happy, let’s create a user based on the info you sent in the HTML form. Here is the code you will use:

$ip = $REMOTE_ADDR; // this will get user’s IP address
$username = $_POST[“username”];
$password = $_POST[“password”];
$email = $_POST[“email”];
$query = “insert into users set
ip=’$ip’,
username=’$username’,
password=’$password’,
egold=’$egold’,
email=’$email’,
added=now(),
status=’0′;”;$res=@mysql_query($query);

Some explanations here: the fields enters into the application form are being passed in the $_POST array to your script. The identifier of the array item is the name of the INPUT tag.

So, if you want to extend your registration form to include an address, for example, you will need to add the following:

To your form.php:

Address:

To your database creation script:

`address` varchar(60) NOT NULL default ”,

To your register.php:

$address = $_POST[“address”];

And finally you need to modify the SQL query to look like this:

$query = “insert into users set ip=’$ip’,
username=’$username’,
address=’$address’,
password=’$password’,
egold=’$egold’,
email=’$email’,
added=now(),
status=’0′;”;

Hopefully, you will find it simple. It really is

4. How it all gels together

Now, let’s see how it works. You should have a MySQL table “users” and two files – form.php and register.php. Upload it to your hoster and run the form.php file. Fill it out and click “Submit”. Now, the register.php file should be loaded in your browser and it will show an empty page.

However, if you go and take a look at your MySQL table “users”, a new record will be created there with the details you provided. This is basic stuff, but you are on the right track.

Ruby Blocks 101

allaboutruby — Fri, 20 Jan 2006 01:00:33 +0000

One of the difficulties you might have with jumping into Ruby on Rails is that you need to learn the Ruby language (yes, you do ). And if you come from the PHP background as I am, the single weirdest thing in Ruby would be the notion of blocks. I have never seen the blocks in any other language. The concept seems beautiful, but completely unrelated to anything I know about programming.

The concept of blocks is logical and intuitive, but most likely very different from the way you experienced programming. Blocks are like alien logic - something so basic, that it changes the meaning of everything. Think of how an amphibian race of super-intellectual beings would differ from humans - this is how different the blocks concept is from your PHP functions.

As blocks are the basic structures of Ruby, chances are you have already seen them and did not really understand what was going on. I hope this post will be able to help you out with getting the hang of the concept really quickly.

So let’s start with an easy example. Run irb (cmd irb.bat) and define the method:

def aliens
i = 1
j = 2
yield(i, j)
end

This method just assigns two variables and then passes those variables to the block. Now let’s call the block:

aliens { |x, y| puts x, y }

It works as follows: aliens method is called, with Ruby recognizing that this method has a block attached to it. Once the yield is encountered within the aliens, it is passed to the block together with any parameters in the brackets. As i and j are local variables, we need to define the first and second variable to be used to hold i and j values. Finally we have the Ruby code that does something with those parameters. Puts just displays the values of i and j on screen. But you can do something more complicated:

aliens { |x, y| puts x+y*y }

This should display 5.

If you are not confused at this moment, great - you have almost mastered the blocks ;). If you are, think about the aliens as a function that allows three parameters - x, y and some arbitrarily complex Ruby code. Yield is the place where this code is executed. To make sure that this is the case, try this: (copy the code, save it to blocks.rb in your project directory and run ruby blocks.rb)

def aliens
i = 1
j = 2
yield(i, j)
i = “magick”
return nil
end

aliens { |x, y| puts x }

The script should print “1″. This is easy stuff. (Pedantic note. You can ignore “return nil“, it is there because Ruby returns the last value in the function (=method) as the result of the function, so if you run the code above in irb without “return nil”, you will see that aliens actually returns “magick”)

Another cool feature is the ability to test whether the method has a block. Check out this code:

def aliens
if block_given?
i = 1
j = 2
yield(i, j)
else puts “magick”
end
end

aliens { |x, y| puts x }
aliens

In that case if the block is provided to the method, we execute the if statement, otherwise we execute the else statement. So, as a result the script should print “1″ and “magick”.

How cool is that?

Another good introduction article from Curt Hibbs

allaboutruby — Mon, 16 Jan 2006 19:51:03 +0000

Curt Hibbs’ tutorials are the only accessible tutorials that I’ve read on Ruby on Rails. Curt has also written a great introductory article on Rails which you can find here.

Newbies beware!

allaboutruby — Mon, 16 Jan 2006 19:48:32 +0000

So, I am trying to get deeper in the understanding of Ruby and Rails and things are progressing nicely. However, I have to say - the information on Rails and Ruby is not up to notch. Unless you are a seasoned programmer or a smart hacker, chances are you will be lost when trying to understand how to use the Rails API or what exactly you are supposed to do after you have installed Ruby on Rails and did an ONLamp tutorial. A good sentiment that every newbie will recognize instantly is expressed here.

TextMate v1.5 released

allaboutruby — Tue, 10 Jan 2006 21:13:07 +0000

TextMate by the look of it is a great editor for Ruby developers. New version was released just recently, but there are still no plans to release a PC version - only Mac users need to celebrate.

Ruby on Rails Cheatsheet

allaboutruby — Tue, 10 Jan 2006 21:01:00 +0000

Blaine Kendall released a very nice 14-page PDF that summarizes nicely gotchas, syntax and some basic building blocks of both Ruby and Rails. Get the pdf from his blog post here.

Installing Rails on Windows (step-by-step tutorial)

allaboutruby — Mon, 09 Jan 2006 21:33:34 +0000

Ok, so this will basically be somewhat a repeat of the information made by Curt Hibbs in this great hands-on tutorial. However, the versions of all products changed from the time Curt made his tutorial, and in some areas I felt that additional description was required. So, in this tutorial you’ll get a step-by-step instructions on installing Rails on Windows 2000 Server (Windows XP would be very similar).

In order to have a fully working development environment, you can use your PC. You will need to install:

Ruby - the language
Ruby Gems - the plug-in manager for Ruby
Scite or FreeRIDE - IDE for Ruby
MySQL - the database
MySQL query builder / MySQL admin tools - GUI to create databases, add users and create tables
Rails Framework

I. Installing Ruby
This is easy. Just get the latest One-click Installer for Windows (currently 1.8.2-15). Installation is simple, and indeed one-click. Once the installation is complete, check that path to ruby\bin directory is in your PATH variable (Run “cmd”, then type “path” at the prompt and check that the path is there.

The great thing about the one-click installer is that it comes with Ruby Gems, Scite and FreeRIDE preinstalled. The thing to watch out for is that one-click installer does not have the very latest version of Ruby, so when you are reading Ruby Docs, make sure you know which version of Ruby you have (run “ruby -v” in the command prompt).

II. Installing MySQL
This might be more tricky, depending on your home computer’s set up. First, download and run the latest Windows Essentials (x86) version of MySQL (currently 5.0.18). After the files are unzipped, an Instance Config should run automatically (you can run it manually at any time from your MySQL bin directory just run “MySQLInstanceConfig.exe”).

Below are the options to use for the Instance Configuration.

1. Select “Detailed Configuration”

2. Choose “Developer Machine”

3. Choose “Multifunctional Database”

4. Leave the next screen unchanged

5. Choose “Decision Support / OLAP”

6. From the security perspective it is better to have “Enable TCP/IP Networking” unchecked, however I wasn’t able to make MySQL work with Rails in that case. So, choose “Enable TCP/IP Networking” for now and leave “Strict mode” checked.

7. Choose “Best Support for Multilingualism” (MySQL will use Unicode for stored data).

8. Have both options checked.

9. Now, create a password for root account. Make sure that you do not use an easily guessable password and do NOT leave these fields blank (ie, do not use blank password for root). Also, leave the “Enable root access from remote machines” unchecked.

10. Click “Execute”. If everything went ok, you should have green tick marks for all installation steps.

11. Now, you need to do some basic security tweaking, to make sure nobody hacks your database from the outside. Go to the MySQL directory (c:\mysql by default), open my.ini and add the following line to the [mysqld] section of your server configuration file:

bind-address=127.0.0.1

This line will make sure that only services from your localhost will be able to access database (so, this means you and your web server).

Now, you need to restart MySQL. Go to Services (In Windows 2000: Start -> Programs -> Accessories -> Administrative tools -> Services), find “MySQL”, highlight it, click “Stop” and then “Start” icon.

12. Quickly try if your mysql set up is working, by running this command in the prompt:

mysql.exe -h 127.0.0.1 -u root -p

You will be asked to type your password and if everything is fine, should be presented with the message “Welcome to the MySQL Monitor” and the mysql prompt. It works! You are almost there.

If it does not work - first, make sure that you are entering the password right (check Caps Lock and Language Indicator). Check that MySQL service is running (see step 11). Another usual suspect is your local Firewall (your router firewall will not interfere with the local MySQL installation). A quick fix would be to allow communication for ruby.exe and mysqld-nt.exe on all ports (check your Firewall manual or help).

III. Installing Rails

1. Go into the ruby bin directory and run this command from the command prompt:

gem install rails --include-dependencies

(If this command gives you an error, you do not have the latest version of gems installed. Run “gem -v”, it should be 0.8.10. If it’s an earlier version, I recommend to reinstall the newest package - see beginning of the tutorial).

This command will install rails 1.0 and RDoc documentation for it. It should take up to 5-10 minutes, so do not worry when for a couple of minutes you just see a message “Updating Gem source index for: http://gems.rubyforge.org/” - there is no progress bar or any other indication of activity, but it is doing the work.

At the end you should see something like this:

2. After that, create a directory for all of your projects. I just have one in the ruby directory. Go into this directory by using the “cd c:\ruby/myprojectsdir” and run

rails firstproject

You should see something similar:

3. Finally, “cd firstproject” and run

ruby script/server

This will run the file “server” (no extension) in the script subdirectory of “firstproject directory”, which will in turn run the Rails built-in web server WEBrick. Test the web server by opening the following address in your browser:

http://127.0.0.1:3000/

You should see the following pic:

One of the drawbacks of having a Ruby-based web server is that WEBrick needs to run in its separate command prompt window, so you should be careful not to close the window down incidentally, or you will need to restart the web server.

Congratulations! YOU ARE ALMOST DONE!

IV. MySQL Admin

Here, you have several options, however the tool I love the most - MySQL Control Center - is no longer in development. You can still download it here (v.0.9.2) or here (v.0.9.4). Or you can download MySQL Administrator and Query Browser from MySQL.com. I haven’t tried those tools yet, so I will show how to work with MySQL CC, but the steps will be very similar.

Note on MySQL CC and MySQL Administrator / Query Browser:
MySQL CC is not fully compatible with MySQL 5.x, so it might be better to use Administrator and Query Browser. However, MySQL CC is a very easy to use bare-bones program and it allows to do everything you need in this tutorial. If you opt for Administrator / Query Browser set-up, you would use the Administrator only for creating database users (and in future for setting up security, back-ups and restarting MySQL). For all other things you will use the Query Browser (in the Query Browser databases are called “Schemas”, and when you first run QB, you can safely ignore the warning to supply the schema name).

1. Install MySQL Admin and run it.

2. Create a new database connection by clicking the icon shown (or press Ctrl-N):

3. Fill out the information as shown in the picture below:

Name: This is any name you want - for GUI purposes only. Call it “My Development Database”.
Host name: This would be either “localhost” or “127.0.0.1″. On some weird configs “localhost” might not work, so try to use either one.
User name: “root”. Leave it as is.
Password: your root password. Remember setting it when installing MySQL?
Make this server the default connection: If you do not have any other databases, tick this box. By running MySQL CC next time, you will automatically connect to the database.

Now, click the “Test” icon, and if successful, click “Add”.

4. Create the database.

Go to the main console. It now should have your database “My Development Database”. Check that it is connected, if not click the “Connect” icon.

Right click on the “Databases” folder and select “New database”. You will be presented with the following prompt. Just name the database “firstproject”, although it does not really matter how you call the database.

5. Now, back to the main console window, you should see the database name “firstproject” in the list of databases for your server. Double click on the database and then click on the “Tables” subfolder. It should look something like this:

6. Now, the database for your project has been created, you need to create a test table. Right click the “Tables” folder and choose “New table”. Let’s make two fields: id (type: int) and title (type: varchar).

“id” field is required by Rails and is the usual feature for the majority of tables. You do not usually insert the “id” directly, so we need to make sure that “id” is never empty (not null) and is automatically incremented (0,1,2,3,…). Also, make sure that the “id” is written in lowercase, for Rails to understand that this is your unique id field.

Now, let’s define “id” as our primary field. Go into the “indexes” tab, select “id” field and press the right arrow, it should end up looking something like this:

Now, add the “title” and choose the type “varchar”, like this (length of 100 symbols should be enough for your title, but when you will be adding a field for url you would want to change it to 255):

Finally, click the “Save” icon and you will be asked to name your table. Rails has a special notation for naming tables - basically they have to be in plurals, as they will hold instances of particular class (objects).

Let’s call the table “Stories” (Rails is supposed to know the plural form for “Story”, so let’s try it out). Go back to the main console window and double click the “Tables” subfolder. On the right you will see the list of tables (we have only one at the moment - called “Stories”). Double click the table, it should return an empty set, as you do not have any records yet. (Do not try to create a record - MySQL CC will not correctly do this in MySQL 5.x).

7. Finally, it would be wrong to run your project using a root password. So, you need to create the database user especially for your project. It is very easy to do. In the main console right-click on the “User Administration” folder and select “New User”. Fill out the form as shown:

Username: rails (this would be the username exclusively used for your project)
Host: localhost
Password: password you will use to access this user account
Priviliges: You should provide the least possible priviliges for the user. The ones selected by default are ok, but you can actually safely leave priviliges to only “Select, Insert, Update and Delete”, as we do not plan to create, drop (delete) or alter (change structure of) tables from our Rails scripts. Finally, select, to which databases you are allowing access. Select ONLY the “firstproject” database and click “Add”.

V. Rails in action

1. Now that the database model was prepared, we need to switch it on for our project. Go into your rails project subdirectory (you remember where you created it, right?). In the “config” subfolder you will find file database.yml. Open it and find the “development” section. In it, change database name to “firstproject”, username to “rails”, password to rails user password. Leave socket unchanged. Here is how it will look like:

development:
adapter: mysql
database: firstproject
username: rails
password: railspass55
socket: /path/to/your/mysql.sock

In order for those changes to work, you will need to restart the WEBrick server. Close the WEBrick window and run the server command again:

ruby script/server

2. You have the database schema defined and you configured Rails to access your database. Now, what we need is to create the class called “Story”. The easiest way to go is to create a scaffold, which is basically a default script to work with the standard database operations under the acronym of CRUD (Create Read Update Delete or in SQL terms: INSERT, SELECT, UPDATE and DELETE). To do this, again go to your script’s directory and run this command:

ruby script\generate scaffold Story

Make sure that you use the capital “S” - this is actually a Ruby rule that you need to follow - class names need to be capitalized. So, this is where the magic happens - you do not need to define the class in Ruby the “hard-way”. You define the class variables (so-called states) only once - in the database, and then those variables are automatically recognized by Rails and a standard CRUD framework is applied, which you can replace with your own code as you go.

3. Finally, check that everything works by going to this link: http://127.0.0.1:3000/stories/

For fun, try creating, updating and deleting records and see how the table records are automatically updated in the MySQL CC or Query Browser.

IN CONCLUSION
Installing Ruby on Rails is not a difficult process, but it takes some time. However, once installed you will not only feel comfortable with basic MySQL administration, but will also get a development environment which is much faster and easier to use than a hosting based alternative. Once you create a web service that can be released to public, you can easily move it to one of the Rails hosting providers.

Do you need instant rails?

allaboutruby — Sun, 08 Jan 2006 16:41:23 +0000

I have written about the Instantrails package before, but having tried it for a day, I decided to go with a proper installation. The reason for this is that I’ve never used to run either MySQL or Apache on my local computer, and as I have all sorts of firewalls and quirks on my computer, when things went wrong, I did not understand how I could fix them. Instantrails does not have any real documentation and I was not sure what exactly went wrong.

Also, Instantrails comes with phpmyadmin for MySQL admin, and for this it also needs to install php, which I thought was excessive - I’d rather go with my old trusted MySQL Control Center or the new Query Browser. So, if you are not a power user of either MySQL or Apache, I would recommend against using InstantRails.

Finally, for development you do not need to install Apache, as Rails comes with WEBrick, which should do the job good enough.

Great way to start with Ruby

allaboutruby — Fri, 06 Jan 2006 21:21:17 +0000

Yes, books…

I have purchased the “Programming Ruby” Book from Pragmatic Programmers, and based on what I’ve read (I’ve read around 60 pages up to now) - this is an excellent book that guides you through Ruby from the very beginning (you do not even need to know what classes and methods are) to the very end (which is a long section describing methods). I recommend everyone to purchase it on-line, and while there, you can consider also purchasing their Ajax and Rails books (I haven’t bought them yet, but they are high on my wishlist).