Authentication with sessions.

paddyhaig · May 21, 2010

Authentication session problem.

Please help me create a way of securing the pages of my website with a session cookie.

At present you can wander directory's simply by manipulating the URL.

I need a way to secure the pages if you do not have the correct credentials.

I want different users to have different levels of access.

Here's a copy of my present authentication form: index.php


<html>
<head>
    <meta http-equiv="Content-Language" content="en-us">
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
    <title>Login</title>
<link href="includes/primary_layout.css" rel="stylesheet" type="text/css" /> 
<!--[if IE]><style type="text/css">body { text-align: center; } #small-blue-box { text-align: left; }</style><![endif]-->
<link href="../includes/primary_layout.css" rel="stylesheet" type="text/css" />
</head>
<body onLoad="document.getElementById('account').focus()">
<div id="text">
<div id="wrapper">
<div id="small-blue-box">
<div id="form0">
<form action="scripts/authenticate/auth.php" method="POST">
<div>
<div align="center"><img src="graphics/general/concierge_banner.gif" width="180" height="28">Account:
<input name="account" type="text" id="account" value="[email protected]" size="20">
</div>
</div>
<div>
<div align="center">Username:
<input name="username" type="text" id="username" size="20">
</div>
</div>
<div>
<label for="password">
<div align="center">Password:
<input name="password" type="password" id="password" size="20">
</div>
</div>
<p align="center">
<input type="image" src="graphics/general/login_button.jpg" onClick="document.submit();>   
<p>
<img src="graphics/general/login_button.jpg" width="150" height="28" alt="login"></p></form>
</div>
</div>
<?php include("includes/footer.inc"); ?>
</div>
</body>
</html>

Here's a copy of the auth.php script: Which is called by the above.


<?php
if (isset($_POST['username']) && isset($_POST['password'])) {
  $db = mysql_connect('localhost', 'example', 'example') or die("Couldn't connect to the database<br>" . mysql_error());
  mysql_select_db('example', $db) or die("Couldn't select<br>" . mysql_error());
  
  $login = mysql_real_escape_string($_POST['username'], $db);
  $password = mysql_real_escape_string($_POST['password'], $db);
  
  $query = "SELECT privilage FROM auth WHERE login = '$login' AND password = '$password'";
  $result = mysql_query($query, $db) or die("Problem with the query: $query<br>" . mysql_error());
  if (0 === mysql_num_rows($result)) {
    header('Location: ../../index.php');
    exit(0);
  }
  
  $row = mysql_fetch_assoc($result);
  $privilage = $row['privilage'];
  
  session_start();
  $_SESSION['username'] = $login;
  $_SESSION['privilage'] = $privilage;

  
  if ('receptionist' === $privilage) {
    header('Location: ../../receptionists/index.php');
    exit(0);
  }

  if ('manager' === $privilage) {
    header('Location: ../../managers/index.php');
    exit(0);
  }

  if ('administrator' === $privilage) {
    header('Location: ../../admin/index.php');
    exit(0);
  }
}
?>

This is my present cookie information:

Name PHPSESSID

Value p2r4il0jeadghdoa7h4hb7uku5

Host www.example.com

Path /

Secure No

Expires At End Of Session

This is one of many pages I would like to secure: I beleive I need something in the header of these pages that will stop people wandering.


<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Concierge Admin Index</title>
<link href="../includes/primary_layout.css" rel="stylesheet" type="text/css" />
</head>
<body>
<div id="wrapper">
<div id="large-blue-box">
<div id="form1">

<!-- <?php include("../includes/footer.inc"); ?> I would like to make all the below code an include -->

  <p><img src="../graphics/general/ai_banner.gif" alt="" width="180" height="28" /></p>
  <p><a href="concierge-setup.php"><img src="../graphics/general/concierge-setup_button.gif" width="180" height="28" /></a></p>
  <p><a href="accommodation.php"><img src="../graphics/general/accomodate_button.gif" width="180" height="28" /></a></p>
  <p><a href="general-log.php"><img src="../graphics/general/gen-log_button.gif" width="180" height="28" /></a></p>
  <p><a href="../index.php"><img src="../graphics/general/lo_button.gif" alt="" width="180" height="28" /></a></p>
</div>
<div id="form2">
  <p><img src="../graphics/general/man_index_banner.gif" width="180" height="28" /></p>
  <p><a href="staff_management.php"><img src="../graphics/general/sm_button.gif" width="180" height="28" /></a></p>
<p><a href="bed_management.php"><img src="../graphics/general/bm_button.gif" width="180" height="28" /></a></p>
<p><a href="audit_system.php"><img src="../graphics/general/as_button.gif" width="180" height="28" /></a></p>
<p><a href="shift_summary.php"><img src="../graphics/general/shift-summary_button.gif" width="180" height="28" /></a></p>
</div>
<div id="form3">
  <p><img src="../graphics/general/recep_banner.gif" width="180" height="28" /></p>
  <p><a href="check-in-out_index.php"><img src="../graphics/general/check-inout_button.gif" width="180" height="28" /></a></p>
<p><a href="delinquent_payments.php"><img src="../graphics/general/delinquent-payments_button.gif" width="180" height="28" /></a></p>
  <p><a href="reservations.php"><img src="../graphics/general/reservations_button.gif" width="180" height="28" /></a></p>
  <p><a href="misc_index.php"><img src="../graphics/general/miscellaneous_button.gif" width="180" height="28" /></a></p>
</div>
</div>
<?php include("../includes/footer.inc"); ?>
</div>
</body>
</html>

Sign In

Authentication with sessions.

Recommended Posts

paddyhaig

Link to comment

Share on other sites

Archived

Browse

Activity

Important Information