[Meterpreter]

Just something I made as a learning point... Was a big accomplishment for me going from basic login systems to this.

https://github.com/curlyaz/CPP-MySQL-Login-64-bit

You can either setup a free SQL database online (lots of websites - here for example) or use a localhost server,
Any pointers or tips with my coding structure and methods are very much welcomed.

Enjoy :)

[SlowMehMo]

-snip-

(\ /)
(O,O)
(> <)

I wont lie, im pretty jelly, but im sure ill need to read from this soon.
Im STILL stuck in that awkward stage where im paranoid about taking on a bigger and more involved kind of project.
My last build was litterally a console app that pulls waffle and pancake images from google taking user input as adjectives...
Good news is i can now spawn buttery syrup waffles at will :D

[Xamarin]

Just something I made as a learning point... Was a big accomplishment for me going from basic login systems to this.

https://github.com/curlyaz/CPP-MySQL-Login-64-bit

You can either setup a free SQL database online (lots of websites - here for example) or use a localhost server,
Any pointers or tips with my coding structure and methods are very much welcomed.

Enjoy :)

Nice. One question though. When you query the username, you are executing this query:

Code

SELECT username FROM users WHERE username = ?

That is OK of course, but when you search for the password, you do this:

Code

SELECT password FROM users WHERE password = ?

Well ... shouldn't the password be specific to the user ? What I mean, is that if for example we have the following users:

Code

Id     username     password
1       John         blahblah
2      Patricia      dododo

and I put in the username input: John, and then in the password I input the password: dododo then the program will successfully find both of them, but it will be for different users. It will be better to change the second query so that it takes in consideration the username that the user provided. Then you can just check the output, and that way you will be certain that the provided credentials are OK.

Additionally, in C++ is considered a bad practice to declare std. At the end of the day, the output will be the same, but is better to follow as much as possible the good practices. Check the attached link for more information.

[Meterpreter]

Nice. One question though. When you query the username, you are executing this query:

Code

SELECT username FROM users WHERE username = ?

That is OK of course, but when you search for the password, you do this:

Code

SELECT password FROM users WHERE password = ?

Well ... shouldn't the password be specific to the user ? What I mean, is that if for example we have the following users:

Code

Id     username     password
1       John         blahblah
2      Patricia      dododo

and I put in the username input: John, and then in the password I input the password: dododo then the program will successfully find both of them, but it will be for different users. It will be better to change the second query so that it takes in consideration the username that the user provided. Then you can just check the output, and that way you will be certain that the provided credentials are OK.

Additionally, in C++ is considered a bad practice to declare std. At the end of the day, the output will be the same, but is better to follow as much as possible the good practices. Check the attached link for more information.

Updated the query man, good spot!

The fix looks much cleaner as well as actually working properly. Let me know what you think of my fix :)

[Xamarin]

Much better/cleaner. Nice 😉

[Meterpreter]

Much better/cleaner. Nice 😉

Just upgraded the login to login with registration: https://github.com/curlyaz/CPP-MySQL-Log...tion-64bit

Lemme know if you can spot anything silly ;)

---

(\  /)
(O,O)
(> <)

I wont lie, im pretty jelly, but im sure ill need to read from this soon.
Im STILL stuck in that awkward stage where im paranoid about taking on a bigger and more involved kind of project.
My last build was litterally a console app that pulls waffle and pancake images from google taking user input as adjectives...
Good news is i can now spawn buttery syrup waffles at will :D

That..... Actually sounds pretty sick tbh :')

[Xamarin]

Just upgraded the login to login with registration: https://github.com/curlyaz/CPP-MySQL-Log...tion-64bit

Lemme know if you can spot anything silly ;)

I currently cannot see anything wrong on your code. Nevertheless, this "do-while" loop made my eyes hurt badly.

I don't understand why you even need this do-while loop; why your user needs to login at least one time to escape from the loop ? Anyway, if for any reason you need the loop, put a userLoggedIn (or something like that) boolean in there, so that when a user manages to log in, it will change its value to 'true' and the loop will break.

Additionally, using the exit() function is also a bad programming practice. You shall use it only if it's necessary. Use return instead.

[Meterpreter]

I currently cannot see anything wrong on your code. Nevertheless, this "do-while" loop made my eyes hurt badly.

I don't understand why you even need this do-while loop; why your user needs to login at least one time to escape from the loop ? Anyway, if for any reason you need the loop, put a userLoggedIn (or something like that) boolean in there, so that when a user manages to log in, it will change its value to 'true' and the loop will break.

Additionally, using the exit() function is also a bad programming practice. You shall use it only if it's necessary. Use return instead.

The do while loop is for someone who doesnt have an account and then registers, then loops back to the login

[Xamarin]

The do while loop is for someone who doesnt have an account and then registers, then loops back to the login

Then you should create a menu, because a registered user may not want to login. You can create a menu with the following options:

1) Log In
2) Register
3) Exit

That way, the user can enter his preferred value from the menu (i.e enters 2 and registers), and do whatever he wants + it will look much more beautiful and completed. Of course, you don't have to do it ... it is an idea.

[Meterpreter]

Then you should create a menu, because a registered user may not want to login. You can create a menu with the following options:

1) Log In
2) Register
3) Exit

That way, the user can enter his preferred value from the menu (i.e enters 2 and registers), and do whatever he wants + it will look much more beautiful and completed. Of course, you don't have to do it ... it is an idea.

Changed it from the increment do-while, to a bool like you suggested. Now uses bool loginSuccess/!loginSuccess.

I might add a menu as another separate project.

[Friedrich Nietzsche]

This is a terrible idea that should never be used in production, you should never store SQL username and password client side.

Create a PHP page that does this for you and send the username and password to it using a POST request and then check the response. Also make sure your queries are not SQL-injectable.

[Meterpreter]

This is a terrible idea that should never be used in production, you should never store SQL username and password client side.

Create a PHP page that does this for you and send the username and password to it using a POST request and then check the response. Also make sure your queries are not SQL-injectable.

"
//never store raw login info inside the program purely educational basis
//change sqlservername.com, sqlusername, and sqlpassword....
"

[SlowMehMo]

This is a terrible idea that should never be used in production, you should never store SQL username and password client side.

Create a PHP page that does this for you and send the username and password to it using a POST request and then check the response. Also make sure your queries are not SQL-injectable.

what if its encrypted and only the server has the key?
I would imagine that would be safe-ish
(Just curious)

[Lucifer Morningstar]

what if its encrypted and only the server has the key?
I would imagine that would be safe-ish
(Just curious)

Which server? The only way you’re truly going to be safe is if you do everything on serverside and send the data via http. And even then you can bypass the login system if not done properly.

Authenticating via php is better because you can edit code on the fly without having to recompile/redistribute the new file. Plus your database credentials are safer as only you know what they are.

[Xamarin]

what if its encrypted and only the server has the key?
I would imagine that would be safe-ish
(Just curious)

No, it will not be; it will not be even if you encrypt your code. You can just get the key through a debugger at run-time. Its very easy. When you are querying data that way from a client, you will get hacked no matter what. That is one reason that clients nowadays when they need data from a server, they ask the server to fetch the data for them, usually through an http Api, so that the server can make the necessary checks that the client isn't asking any sensitive information, or it's not "POSTing" harmful data.

I just didn't mention the security implications myself, because I knew it was only meant for educational purposes and not for production.