PHP fgets返回一个空字符串

Question

So I'm making a webshop, well, trying to atleast for a course project using WAMP. But when trying to register new users and in the process checking their password against a list of common ones the use of fgets() returns an empty string.

if(empty(trim($_POST["password"]))){
    ...
} elseif (!checkPassword($_POST["password"])) {
    $password_err = "Password to common.";
    echo "<script>alert('Password to common.'); location.href='index.php';</script>";
}

The checkPassword() is where the fault lies.

function checkPassword($passwordtocheck) {
    $passwordtocheck = strtolower($passwordtocheck);

    $common_passwords = fopen("commonpasswords.txt", "r");

    while(!feof($common_passwords)) {
        $check_against = fgets($common_passwords);
        echo "<script>alert('Checking $passwordtocheck against $check_against.'); location.href='index.php';</script>";
        if($check_against == $passwordtocheck) {
            fclose($common_passwords);
            return false;
        }
    }
    fclose($common_passwords);
    return true;
}

Lets say that I input the password 12345678 when registering, then the scripted alert will say "Checking 12345678 against ." and send me back to index.php. So it looks like it doesn't succeed in reading the file at all. The commonpasswords.txt is in the same folder as the rest of the files and with a single password on each row.

And there is no problem opening the file to begin with either, if I do this instead:

$common_passwords = fopen("commonpasswords.txt", "a");
fwrite($common_passwords, "test");

'test' will appear at the bottom of the file under the existing words on its own row without a hitch. And this is where I'm at, would appreciate whatever input people can give!

EDIT; I do understand that this probably breaks a ton of good-practice 'rules' in general and regarding security. But the website is not really supposed to function or look good, it just need to barely work so that we can later try and use different methods of attacking it and the connected database.

Answer 1

If you insist on doing this yourself – which I do not recommend – you can simplify things a lot by using the file() function. This returns an array of every line in the file. Then use array_filter(); it runs a callback on each element of the array where you can check if there's a match with your password. If the callback returns false, the element is removed from the array. After that, if you have any elements left you know there was a match.

function checkPassword($pwd) {
    $pwd = strtolower($pwd);
    $common = file("commonpasswords.txt", FILE_IGNORE_NEW_LINES);
    $results = array_filter($common, function($i) use ($pwd) {return $i == $pwd;});
    return count($results) === 0;
}

But really, there are dozens of libraries out there to check password strength. Use one of them.

Or, as pointed out in the comment, even simpler array_search:

function checkPassword($pwd) {
    $pwd = strtolower($pwd);
    $common = file("commonpasswords.txt", FILE_IGNORE_NEW_LINES);
    return array_search($pwd, $common) === false;
}