smartguyin Posted September 10, 2006 Share Posted September 10, 2006 I working on a login system for a database i want to know is using session is it suficient for login system.this is my auth.user.inc.php file for checking logging in user please tell me if i am wrong any where :[code]<?phpsession_start();if ((isset($_SESSION['user_logged']) && $_SESSION['user_logged'] != "") ||(isset($_SESSION['user_password']) && $_SESSION['user_password'] != "")) {$name = ($_SESSION['user_logged']);session_register($_SESSION['user_logged']);$name = $_SESSION['user_logged'];$side = 1;} else {$side = 0;$redirect = $_SERVER['PHP_SELF'];header("Refresh: 5; URL=user_login.php");echo "<p> </p><p> </p><p> </p><p> </p><center>You are not currently no logged in, we are redirecting you to Login Page, be patient!<br>";echo "(If your browser doesn't support this <a href=\"user_login.php\">Click Here</a>)</center>";die();}[/code]this is my part of user_login.php just check if it is a correct lgin system or else i should try some thing else :[code]<?phpsession_start();include "conn.inc.php";if (isset($_POST['submit'])) {$query = "SELECT username, password FROM ur WHERE username = '".$_POST['username']."' "."AND password = (PASSWORD('".$_POST['password']."'))";$result = mysql_query($query)or die(mysql_error());if (mysql_num_rows($result) == 1) {$user_logged = $name;session_register("user_logged");$_SESSION['user_logged'] = $_POST['username'];$_SESSION['user_password'] = $_POST['password'];header ("Refresh: 3; URL=controlpanel.php");echo "<p> </p><p> </p><p> </p><p> </p><center>You are Logged in Now ! You are being redirected to your original page requested!<br>";echo"(if your browser doen't support redirection, <a href=\"".$_POST['redirect']."\">Click Here</a>)";} else {?>[/code] Quote Link to comment Share on other sites More sharing options...
onlyican Posted September 10, 2006 Share Posted September 10, 2006 Do you have any errors?Answer to your question "using session is it suficient for login system"The answer is yes, of course it is,Thats one the reasons it was built,Just Remembersession_start();at the TOP of every page (Before <html> tag)and Sessions normally expire after X amount of time (see ur php_ini file) and die when the browser is closed Quote Link to comment Share on other sites More sharing options...
°°Ben³ Posted September 10, 2006 Share Posted September 10, 2006 I would not store the password in the session.[code]if FORM_IS_SUBMITTED check if the user puttet the correct username and password in, else reload the login form (1)[/code]When the user has logged in you have to do something like this[code]if USER_IS_LOGGED_IN show the siteELSE load the login form[/code]Maybe (1) is something like this[code=php:0]$sql = 'SELECT ...';// ..if(LOGIN_IS_CORRECT){ $_SESSION['loggedIn'] = true; $_SESSION['userData']['id'] = $id $_SESSION['userData']['name'] = $name;}else { header('location: login.php'); exit();}[/code]Just some sample code. Try to understand .. it is not really difficult.Hope to help.Regards, Ben. Quote Link to comment Share on other sites More sharing options...
onlyican Posted September 10, 2006 Share Posted September 10, 2006 I normally store the username in the sessionThen I can just called $_SESSION["logged_in_user"]; to get there usernameand this helps running queries Quote Link to comment Share on other sites More sharing options...
°°Ben³ Posted September 10, 2006 Share Posted September 10, 2006 You have to decide what information you want to store in the session. Data like the username, that is used very often, i.e. in this forum " Hello °°Ben³", is a perfect example for such an information.@smartguyin:Do you have further questions?Or has anyone a contrary opinion to my proposal?Regards, Ben. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.