Login script problem

[andrew_ww]

Hello,

 

I've had a working login script for sometime now - however I have now tried to improve it be added a image verification system.  Whilst this works okay if the user enters the details correctly, if they do not, the ability to have error messages displayed back to the user has disappeared.

 

I would appreciate any help in strightening this out?

 

Code:

 

<?php
// Get MySQL connection
require_once('Connections/DII.php');
// Begin session
if (!isset($_SESSION)) {
  session_start();
}

   $number = trim($_REQUEST['txtnumber']);

   if (md5($number) == $_SESSION['image_random_value']) {
      include 'library/config.php';
      include 'library/opendb.php';

// Check username and password exist
if(isset($_REQUEST['login_submit'])) {
      $user = trim($_REQUEST['username']);
      $pass = trim($_REQUEST['password']);
      $query_users = "SELECT * FROM tbl_users WHERE user_name = '$user' AND user_pass = '$pass'";
      //$rs_users = mysql_query($query_users);
      $rs_users = mysql_query($query_users) or die("Query failed: $query_users. <br />MySQL error was : " . mysql_error());
      $row_users = mysql_fetch_assoc($rs_users);
      $personExists = mysql_num_rows($rs_users);
      if($personExists) {
            $_SESSION['authenticated'] = $row_users['user_id'];
            $_SESSION['session_username'] = $row_users['user_name'];
            header("location: user/");
      } else {
            header("location: index.php?notification=badlogin");
      }
}
}

// If session is registered redirect to user page
if(isset($_SESSION['authenticated'])) {
      header("location: user/");
}
// Check for notification messages and output
if(isset($_REQUEST['notification'])) {
      $message = '<div id="notifications">'."\n";
      switch($_REQUEST['notification']) {
            case ('badlogin') :
                  $message .= "<p>Sorry</p>\n";
                  $message .= "<p>The details you provided didn't match any user on this site.</p>\n";
            break;
            case ('loggedout') :
                  $message .= "<p>You have been logged out.</p>\n";
            break;
            case ('pleaselogin') :
                  $message .= "<p>Sorry</p>\n";
                  $message .= "<p>You must provide your user details to view your page.</p>\n";
            break;
      }
      $message .= '</div>'."\n";
}


?>