login

[thenewperson]

Looking for a stronger way for login. This way makes it where you can type the username in the url to login. How do i make the login where they cant type it in or more secure login way.

 

<? 
include ('confirm.php');//the database information

$user = $_POST['user']; 
$pass = $_POST['pass']; 

$sql="SELECT * FROM users WHERE user_name='$user' and user_password='$pass'"; 
$result=mysql_query($sql); 

$count=mysql_num_rows($result); 

//takes user back to the homepage and adds their name so they are logged in
if($count==1){ 
header("Location: http://likeftp.com?user=$user"); } 
if($count==1){
	$name=strip_tags($_POST['user']);
	$sql2="INSERT INTO login SET username='$user', online='ONLINE'";
	$result2=mysql_query($sql2);
}else 
{ header("Location: http://likeftp.com/invalidname.php"); 
} 
?>

[tivrfoa]

Don't do this way. oO

Use session:  http://www.tizag.com/phpT/phpsessions.php

http://www.google.com/search?q=php+session

[thenewperson]

Don't do this way. oO

Use session:  http://www.tizag.com/phpT/phpsessions.php

http://www.google.com/search?q=php+session

 

bit new to php but when the person logs on, it redirects it to my homepage than  takes user name than starts session in main page. The code for sessoin on main page below or is that completly wrong. Currently it keeps the session threw all the pages but i can log on by typing a username threw the url

 

<? 
$user = $_GET['user']; 
session_start(); 
$_SESSION['user'] = $user; 

?>