login and log out page help

[mallen]

I have this simple sign in page. Sets a session for user and password. The problem is when I first load the page it shows the form and shows this error:

Notice Undefined index: username in ........on line 21

 

Then I type in a wrong user and password to test it and it clears the error and shows the "You are not logged in". message like it should.

The other problem is  my logout page. Seems simple it says you have been logged out, but it sends you back to the login page, shows that I am logged in and still shows the error: Notice Undefined index: username in ........on line 21

 

Login Page:

<?php session_start();

 

if ($dbc = @mysql_connect ('localhost', 'root', 'xxx')) {

if (!mysql_select_db ('phpbb')) {

die ('<p>Could not select the database because: <b>' . mysql_error() . '</b></p>');

}

 

} else {

die ('<p>Could not connect to MySQL because: <b>' . mysql_error() . '</b></p>');

}

 

// convert username and password from _POST or _SESSION

if($_POST){

  $_SESSION['username']=$_POST["username"];

  $_SESSION['password']=$_POST["user_password"];

 

}

 

// query for a user/pass match

$result=mysql_query("select * from phpbb_users

where username='" . $_SESSION['username'] . "' and user_password='" . $_SESSION['password'] . "'");

 

// retrieve number of rows resulted

$num=mysql_num_rows($result);

 

// print login form and exit if failed.

if($num < 1){

echo "You are not signed in.<br>

 

<form method=POST action=login.php>

  username: <input type=text name=\"username\">

  password: <input type=password name=\"user_password\">

  <input type=submit>

  </form>";

}

else {

echo "You are signed in.";

}

exit;

 

?>

---------------------------------------

 

Logout page:

<?php

session_start();

unset ($_SESSION['username']);

unset ($_SESSION['password']);

session_destroy();

 

echo "You have been successfully logged out.

 

<br><br>

You will now be returned to the login page.

 

<META HTTP-EQUIV=\"refresh\" content=\"2; URL=login.php\"> ";

?>

 

[rarebit]

Need some spaces in your mysql statement, I think... (not checked, but it's particular!)

[eldorik]

Is this login and logout connected to phpBB? If it is you can just use the phpBB login file.

[BlueSkyIS]

Notice Undefined index:

 

turn off notices in php.ini or you'll see this all the time.

[mallen]

No I am using a phpbb database for testing. As for the spaces its working just not the sessions part. I don't want to turn off all errors. Is there one setting I should check?

[rarebit]

When you first load the login page you have no $_POST's set, so nothing is set when you use $_SESS in the query statement...

[teng84]

Notice Undefined index:

 

turn off notices in php.ini or you'll see this all the time.

undefined index means u are calling an index of an array which is not set

so if your gonna do something like print_r you cant see that index that you are trying to access

eg. session

print_r($_SESSION);

[mallen]

I turned off the notice. But the log out page will not end the session. It takes me back to the log in page where it shows me logged.

 

1. I need for the log out page to kill the session

2. I need a check to see if its set when the page loads

[teng84]

when destroying a session no need for the unset

Logout page:
<?php
session_start();
unset ($_SESSION['username']);
unset ($_SESSION['password']);
session_destroy();

simply

session_start();
session_destroy();

 

to check if the session is set

if (isset($_SESSION['username'])){
echo 'your logged';
}

 

[mallen]

I tried changing it to this and it still says i am logged in.

 

<?php

session_start();

session_destroy();

 

echo "You have been successfully logged out.

 

<br><br>

You will now be returned to the login page.

 

<META HTTP-EQUIV=\"refresh\" content=\"2; URL=login.php\"> ";

?>

 

[teng84]

put this on the top page right before your session start

 

if (isset($_SESSION['username'])){

echo 'your logged';

}

else

{

put here the code that will redirect

}

[mallen]

That will send me back to my login page that says I am logged in. Nothing is killing the session to log me out.

[BlueSkyIS]

you may be seeing a cached page. change the headers on the login page to prevent caching, or, after logout send the user to the login page with a unique identifier appended, e.g., login.php?lo=12312312342

[teng84]

yep and

can you explain how you kill your session ?

[mallen]

<?php

session_start();

unset ($_SESSION['username']);

unset ($_SESSION['password']);

session_destroy();

 

 

or

 

session_start();

session_destroy();

 

 

Both examples don't work.

[teng84]

i mean how do you access your logout page?

[mallen]

At the bottom of my login page it displays a link if I am signed in.

 

echo "You are signed in. <p><a href=logout.php>Click here to log out.</a></p>

[BlueSkyIS]

hm, i'd still check out the cached page problem. if you're just redirecting to login.php and login.php is a relatively simple HTML page, chances are the browser will cache that page with the last message. but i've been wrong before....