Login

[steveangelis]

<?PHP

session_start();  

if($_POST){ 
  $_SESSION['username']=$_POST["username"]; 
  $_SESSION['password']=$_POST["password"];   
} 

$result=mysql_query("select * from members where mbr_name='" .$_SESSION['username'] . "' and mbr_pass='" . md5($_SESSION['password']) . "'"); 

$num=mysql_num_rows($result);  

if($num < 1){ 
  echo "Login needed!!!<br><br> 
   
  <form method=POST action=index.php> 
  username: <input type=text name=\"username\"> 
  password: <input type=password name=\"password\"> 
  <input type=submit> 
  </form>"; 
   
  exit; 

} 
?> 

 

I keep getting this error: 

 

 

Notice: Undefined index: username in C:\Program Files\wamp\www\clan\login\inc\auth.php on line 10

 

Notice: Undefined index: password in C:\Program Files\wamp\www\clan\login\inc\auth.php on line 10

 

Does anyone know why?

 

Line 11 is this:  $result=mysql_query("select * from members where mbr_name='" .$_SESSION['username'] . "' and mbr_pass='" . md5($_SESSION['password']) . "'");

[jackpf]

Probably because the session "username" doesn't exist.

This isn't really an error though, you can just ignore it and set your php settings to do the same.

However, you can avoid it by doing this:

if(isset($_SESSION['username']))
{
$username = $_SESSION['username'];
}
else
{
$username = null;
}

That way the username session is only called if it exists.

[steveangelis]

That did not help.  I am still getting the error.

[jackpf]

And than you need to use $username in place of $_SESSION['username']

[DjMikeS]

The error's simply mean that you are trying to get a value from an array, POST in this case, that doesn't exist...

 

So check your html form's method to POST and check if your inputs have a "name" value set to username and password...

 

You also realize that this script is by far secure ? For example, I don't see you sanitizing your form data before sending it to the database.

Also, there is no need to register the POST variables as SESSION vars, because you haven't checked...

 

So:

1. Check for simple contents, eg. empty form submitted

2. Sanitize POST vars

3. Check them with the database

4. Register the database result as SESSION vars

 

[jackpf]

I think you'll find line 10 is the session variables.

[nankoweap]

i believe

 

if ($_POST) ...

 

should be

 

if ($_SERVER['REQUEST_METHOD'] == 'POST') ...

 

jason

[mikesta707]

<?PHP

session_start();  

if($_POST){ 
  $_SESSION['username']=$_POST["username"]; 
  $_SESSION['password']=$_POST["password"];   
} 

$result=mysql_query("select * from members where mbr_name='" .$_SESSION['username'] . "' and mbr_pass='" . md5($_SESSION['password']) . "'"); 

$num=mysql_num_rows($result);  

if($num < 1){ 
  echo "Login needed!!!<br><br> 
   
  <form method=POST action=index.php> 
  username: <input type=text name=\"username\"> 
  password: <input type=password name=\"password\"> 
  <input type=submit> 
  </form>"; 
   
  exit; 

} 
?> 

 

I keep getting this error: 

 

 

Notice: Undefined index: username in C:\Program Files\wamp\www\clan\login\inc\auth.php on line 10

 

Notice: Undefined index: password in C:\Program Files\wamp\www\clan\login\inc\auth.php on line 10

 

Does anyone know why?

 

Line 11 is this:  $result=mysql_query("select * from members where mbr_name='" .$_SESSION['username'] . "' and mbr_pass='" . md5($_SESSION['password']) . "'");

 

First off, this is a pretty bad way to go about things. As a few people have said, you don't want to set the session as the post variables, before you even check them. You want to just set them as simple variables, like so

if (isset($_POST['username']) && $_POST['password'])){//or whatever your forms are called
$uname = $_POST['username'];
$pass = $_POST['password'];

$result=mysql_query("select * from members where mbr_name='" .$uname . "' and mbr_pass='" . md5($pass) . "'");

$num=mysql_num_rows($result); 

if($num < 1){ 
echo "Bad Longin!"
exit();
}
//now here we set the sessions
$_SESSSION['Username'] = $username;
$_SESSION['isLoggedin'] = true;
echo "Welcome $username!";

}
else {//if the post variables arent set, put the form here
... etc.

 

You also want to sanitize the post variables also. Check this tutorial: http://www.phpeasystep.com/workshopview.php?id=6 on secure logins for more information,

but something like

$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);

 

would do the trick