Jump to content

Archived

This topic is now archived and is closed to further replies.

smartguyin

Using Session for Login system

Recommended Posts

I working on a login system for a database i want to know is using session is it suficient for login system.

this is my auth.user.inc.php file for checking logging in user please tell me if i am wrong any where :

[code]<?php
session_start();
if ((isset($_SESSION['user_logged']) && $_SESSION['user_logged'] != "") ||
(isset($_SESSION['user_password']) && $_SESSION['user_password'] != "")) {
$name = ($_SESSION['user_logged']);
session_register($_SESSION['user_logged']);
$name = $_SESSION['user_logged'];

$side = 1;
} else {
$side = 0;
$redirect = $_SERVER['PHP_SELF'];
header("Refresh: 5; URL=user_login.php");
echo "<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p><center>You are not currently no logged in, we are redirecting you to Login Page, be patient!<br>";
echo "(If your browser doesn't support this <a href=\"user_login.php\">Click Here</a>)</center>";
die();
}[/code]

this is my part of user_login.php just check if it is a correct lgin system or else i should try some thing else :

[code]<?php
session_start();
include "conn.inc.php";

if (isset($_POST['submit'])) {
$query = "SELECT username, password FROM ur WHERE username = '".$_POST['username']."' ".
"AND password = (PASSWORD('".$_POST['password']."'))";
$result = mysql_query($query)
or die(mysql_error());

if (mysql_num_rows($result) == 1) {
$user_logged = $name;
session_register("user_logged");
$_SESSION['user_logged'] = $_POST['username'];
$_SESSION['user_password'] = $_POST['password'];
header ("Refresh: 3; URL=controlpanel.php");
echo "<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p>
<p>&nbsp;</p><center>You are Logged in Now ! You are being redirected to your original page requested!<br>";
echo"(if your browser doen't support redirection, <a href=\"".$_POST['redirect']."\">Click Here</a>)";
} else {
?>[/code]

Share this post


Link to post
Share on other sites
Do you have any errors?

Answer to your question "using session is it suficient for login system"
The answer is yes, of course it is,
Thats one the reasons it was built,

Just Remember
session_start();
at the TOP of every page (Before <html> tag)

and
Sessions normally expire after X amount of time (see ur php_ini file) and die when the browser is closed

Share this post


Link to post
Share on other sites
I would not store the password in the session.

[code]if FORM_IS_SUBMITTED
  check if the user puttet the correct username and password in,
  else reload the login form (1)
[/code]

When the user has logged in you have to do something like this
[code]if USER_IS_LOGGED_IN
    show the site
ELSE
    load the login form[/code]

Maybe (1) is something like this
[code=php:0]$sql = 'SELECT ...';
// ..

if(LOGIN_IS_CORRECT)
{
    $_SESSION['loggedIn'] = true;
    $_SESSION['userData']['id'] = $id
    $_SESSION['userData']['name'] = $name;
}
else
{
    header('location: login.php');
    exit();
}[/code]

Just some sample code. Try to understand .. it is not really difficult.
Hope to help.

Regards, Ben.

Share this post


Link to post
Share on other sites
I normally store the username in the session
Then I can just called $_SESSION["logged_in_user"]; to get there username
and this helps running queries

Share this post


Link to post
Share on other sites
You have to decide what information you want to store in the session. Data like the username, that is used very often, i.e. in this forum " Hello °°Ben³", is a perfect example for such an information.

@smartguyin:
Do you have further questions?

Or has anyone a contrary opinion to my proposal?

Regards, Ben.

Share this post


Link to post
Share on other sites

×

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.