[SOLVED] user login - direct to specific page

[illuz1on]

hey,

 

If im looking to make a login system, that when someone login in with a specific username and password, it takes them to a specific page, ex.

 

login: world

password: world

page they must get sent to once logged in: world.php

 

 

login: hello

password: hello

page they must get sent to once logged in: hello.php

 

Can someone give me a start to it here please? been looking around but cant find a good explanation of it

 

Thanks

[clown[NOR]]

just validate all the login info, and where you put the header() you do something like this:

 

header("Location: $username.php");

[soycharliente]

Agreed.

 

Use the posted information from the form to direct the user to the page you're looking for.

[illuz1on]

Dont really understand how thats done... :\

[illuz1on]

would anyone be able to expand on what they were saying?

 

Much appreciated

 

[Dragen]

well you have a login script. then check if logged in direct to a page otherwise if not logged in send error, or re-direct to login page.

 

just an example:

if($login = true){
header("Location: $username.php"); //$username would be replaced with whatever variable you use to determine the username
}
else {
echo "you are not logged in";
}

I'm just giving an example.. probably not the best way of doing it.. $login would probably be better set as a global value

then check as

global $login;
   if($login){
header("Location: $username.php"); //$username would be replaced with whatever variable you use to determine the username
}
else {
echo "you are not logged in";
}

[Stickybomb]

are you looking for help making the login system itself or just doing the redirect?

[illuz1on]

K well this is my login.php file, and im trying to use the header thing now..

 

Would this work? dont know if it registers the $username in $username.php

 

<?php
session_start();
// dBase file
include "dbConfig.php";

if ($_GET["op"] == "login")
{
if (!$_POST["username"] || !$_POST["password"])
  {
  die("You need to provide a username and password.");
  }

// Create query
$q = "SELECT * FROM `dbUsers` "
  ."WHERE `username`='".$_POST["username"]."' "
  ."AND `password`=PASSWORD('".$_POST["password"]."') "
  ."LIMIT 1";
// Run query
$r = mysql_query($q);

if ( $obj = @mysql_fetch_object($r) )
  {
  // Login good, create session variables
  $_SESSION["valid_id"] = $obj->id;
  $_SESSION["valid_user"] = $_POST["username"];
  $_SESSION["valid_time"] = time();

  // Redirect to specific page
  Header("Location: $username.php");
  }
else
  {
  // Login not successful
  die("Sorry, could not log you in. Wrong login information.");
  }
}
else
{
//If all went right the Web form appears and users can log in
echo "<form action=\"?op=login\" method=\"POST\">";
echo "Username: <input name=\"username\" size=\"15\"><br />";
echo "Password: <input type=\"password\" name=\"password\" size=\"8\"><br />";
echo "<input type=\"submit\" value=\"Login\">";
echo "</form>";
}
?

[Dragen]

umm.. that might be somewhat right, although you'd need

// Redirect to specific page
  Header("Location: $username.php");
  }

to be something like

// Redirect to specific page
  Header("Location: " . $_POST["username"]$username . ".php");
  }

not sure if that's the right way of putting it in a header() statement...

maybe

Header("Location:{$_POST["username"]$username}.php");

someone please correct me

 

 

EDIT: did your code above work?

[HeyRay2]

not sure if that's the right way of putting it in a header() statement...

maybe

Header("Location:{$_POST["username"]$username}.php");

someone please correct me

 

The following should do it for you:

 

Header("Location: ".$_POST["username"].".php");

 

Additionally, you shouldn't blindly trust the information that someone enters into your login form. You open yourself up to SQL injection attacks.

 

Protect yourself by formatting the $_POST['username'] and $_POST['password'] variables correctly for SQL queries:

 

$username = mysql_real_escape_string(trim($_POST['username']));
$password = mysql_real_escape_string(trim($_POST['password']));

 

... then change your query use the formatted variables:

 

 // Create query
$q = "SELECT * FROM `dbUsers` "
  ."WHERE `username`='".$username."' "
  ."AND `password`= PASSWORD('".$password."') "
  ."LIMIT 1";