User authentication problem with sessions.

paddyhaig · May 20, 2010

Please can someone help my create a way of securing the pages on my web site with a

session cookie.

At present you can wander users directorys simply by manipulating the URL.

Here's a copy of my present authentication form: index.php


<html>
<head>
    <meta http-equiv="Content-Language" content="en-us">
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
    <title>Login</title>
<link href="includes/primary_layout.css" rel="stylesheet" type="text/css" /> 
<!--[if IE]><style type="text/css">body { text-align: center; } #small-blue-box { 

text-align: left; }</style><![endif]-->
<link href="../includes/primary_layout.css" rel="stylesheet" type="text/css" />
</head>
<body onLoad="document.getElementById('account').focus()">
<div id="text">
<div id="wrapper">
<div id="small-blue-box">
<div id="form0">
<form action="scripts/authenticate/auth.php" method="POST">
<div>
<div align="center"><img src="graphics/general/concierge_banner.gif" width="180" 

height="28">Account:
<input name="account" type="text" id="account" value="info@example.com" size="20">
</div>
</div>
<div>
<div align="center">Username:
<input name="username" type="text" id="username" size="20">
</div>
</div>
<div>
<label for="password">
<div align="center">Password:
<input name="password" type="password" id="password" size="20">
</div>
</div>
<p align="center">
<input type="image" src="graphics/general/login_button.jpg" onClick="document.submit();>   
<p>
<img src="graphics/general/login_button.jpg" width="150" height="28" 

alt="login"></p></form>
</div>
</div>
<?php include("includes/footer.inc"); ?>
</div>
</body>
</html>

Here's a copy of the auth.php script: Which is called by the above.


<?php
if (isset($_POST['username']) && isset($_POST['password'])) {
  $db = mysql_connect('localhost', 'example', 'example') or die("Couldn't connect to the 

database<br>" . mysql_error());
  mysql_select_db('example', $db) or die("Couldn't select<br>" . mysql_error());
  
  $login = mysql_real_escape_string($_POST['username'], $db);
  $password = mysql_real_escape_string($_POST['password'], $db);
  
  $query = "SELECT privilage FROM auth WHERE login = '$login' AND password = '$password'";
  $result = mysql_query($query, $db) or die("Problem with the query: $query<br>" . 

mysql_error());
  if (0 === mysql_num_rows($result)) {
    header('Location: ../../index.php');
    exit(0);
  }
  
  $row = mysql_fetch_assoc($result);
  $privilage = $row['privilage'];
  
  session_start();
  $_SESSION['username'] = $login;
  $_SESSION['privilage'] = $privilage;

  
  if ('receptionist' === $privilage) {
    header('Location: ../../receptionists/index.php');
    exit(0);
  }

  if ('manager' === $privilage) {
    header('Location: ../../managers/index.php');
    exit(0);
  }

  if ('administrator' === $privilage) {
    header('Location: ../../admin/index.php');
    exit(0);
  }
}
?>

This is my present cookie information:

Name PHPSESSID

Value p2r4il0jeadghdoa7h4hb7uku5

Host www.example.com

Path /

Secure No

Expires At End Of Session

This is one of many pages I would like to secure:


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" 

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Concierge Admin Index</title>
<link href="../includes/primary_layout.css" rel="stylesheet" type="text/css" />
</head>
<body>
<div id="wrapper">
<div id="large-blue-box">
<div id="form1">

<!-- <?php include("../includes/footer.inc"); ?> I would like to make all the below code 

an include -->

  <p><img src="../graphics/general/ai_banner.gif" alt="" width="180" height="28" /></p>
  <p><a href="concierge-setup.php"><img 

src="../graphics/general/concierge-setup_button.gif" width="180" height="28" /></a></p>
  <p><a href="accommodation.php"><img src="../graphics/general/accomodate_button.gif" 

width="180" height="28" /></a></p>
  <p><a href="general-log.php"><img src="../graphics/general/gen-log_button.gif" 

width="180" height="28" /></a></p>
  <p><a href="../index.php"><img src="../graphics/general/lo_button.gif" alt="" 

width="180" height="28" /></a></p>
</div>
<div id="form2">
  <p><img src="../graphics/general/man_index_banner.gif" width="180" height="28" /></p>
  <p><a href="staff_management.php"><img src="../graphics/general/sm_button.gif" 

width="180" height="28" /></a></p>
<p><a href="bed_management.php"><img src="../graphics/general/bm_button.gif" width="180" 

height="28" /></a></p>
<p><a href="audit_system.php"><img src="../graphics/general/as_button.gif" width="180" 

height="28" /></a></p>
<p><a href="shift_summary.php"><img src="../graphics/general/shift-summary_button.gif" 

width="180" height="28" /></a></p>
</div>
<div id="form3">
  <p><img src="../graphics/general/recep_banner.gif" width="180" height="28" /></p>
  <p><a href="check-in-out_index.php"><img 

src="../graphics/general/check-inout_button.gif" width="180" height="28" /></a></p>
<p><a href="delinquent_payments.php"><img 

src="../graphics/general/delinquent-payments_button.gif" width="180" height="28" 

/></a></p>
  <p><a href="reservations.php"><img src="../graphics/general/reservations_button.gif" 

width="180" height="28" /></a></p>
  <p><a href="misc_index.php"><img src="../graphics/general/miscellaneous_button.gif" 

width="180" height="28" /></a></p>
</div>
</div>
<?php include("../includes/footer.inc"); ?>
</div>
</body>
</html>

calmchess · May 20, 2010

well i secure pages with session by wrapping the whole page in an if statement something like.

if(isset(['sess'])){

allow accecess

}else{

echo "you are not allowed"

}

paddyhaig · May 20, 2010

Could you possibly be a little more specific? calmchess. Are you suggesting that I put this bit of code at the top of my pages. What do you mean by wrap exactly? No: onload()

calmchess · May 21, 2010

<html>

<?php

if(isset(['loggedin'])){

?>

<body>

//other html and PHP elements here

</body>

<?php }else{

echo "you are not logged in";

}

?>

</html>

Sign In

User authentication problem with sessions.

Recommended Posts

paddyhaig

Link to comment

Share on other sites

calmchess

Link to comment

Share on other sites

paddyhaig

Link to comment

Share on other sites

calmchess

Link to comment

Share on other sites

Join the conversation

Browse

Activity

Important Information