[SOLVED] login session problems

SpiderSprog · November 1, 2007

Hi hope someone can help.

I'm an amatuer teachign myself as I go along.

Recently added a login to my site from some freeware code. I put it on the user submit sections so users must register and login before submiting comments ratings etc. However I pass form data which is submited to the database in the query string and this is dropped after the user logs in. Heres the code

Login.php

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
  <title>Parkour Hotspots</title>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
  <link href="style2.css" rel="stylesheet" type="text/css" />
</head>


<?

/**
* Checks whether or not the given user_name is in the
* database, if so it checks if the given user_password is
* the same user_password in the database for that user.
* If the user doesn't exist or if the user_passwords don't
* match up, it returns an error code (1 or 2). 
* On success it returns 0.
*/
function confirmUser($user_name, $user_password){
   global $conn;
   /* Add slashes if necessary (for query) */
   if(!get_magic_quotes_gpc()) {
$user_name = addslashes($user_name);
   }

   /* Verify that user is in database */
   $q = "select user_password, user_id from cpg144_users where user_name = '$user_name'";
   $result = mysql_query($q,$conn);
   if(!$result || (mysql_numrows($result) < 1)){
      return 1; //Indicates user_name failure
   }

   /* Retrieve user_password from result, strip slashes */
   $dbarray = mysql_fetch_array($result);
   $dbarray['user_password']  = stripslashes($dbarray['user_password']);
   $user_password = stripslashes($user_password);
   $dbarray['user_id']  = stripslashes($dbarray['user_id']);
   $user_id = stripslashes($user_id);
   
   
   /* Validate that user_password is correct */
   if($user_password == $dbarray['user_password']){
      return 0; //Success! User_name and user_password confirmed
   }
   else{
      return 2; //Indicates user_password failure
   }
}

/**
* checkLogin - Checks if the user has already previously
* logged in, and a session with the user has already been
* established. Also checks to see if user has been remembered.
* If so, the database is queried to make sure of the user's 
* authenticity. Returns true if the user has logged in.
*/
function checkLogin(){
   /* Check if user has been remembered */
   if(isset($_COOKIE['cookname']) && isset($_COOKIE['cookpass'])){
      $_SESSION['user_name'] = $_COOKIE['cookname'];
      $_SESSION['user_password'] = $_COOKIE['cookpass'];
   }

   /* User_name and user_password have been set */
   if(isset($_SESSION['user_name']) && isset($_SESSION['user_password'])){
      /* Confirm that user_name and user_password are valid */
      if(confirmUser($_SESSION['user_name'], $_SESSION['user_password']) != 0){
         /* Variables are incorrect, user not logged in */
         unset($_SESSION['user_name']);
         unset($_SESSION['user_password']);
         return false;
      }
      return true;
   }
   /* User not logged in */
   else{
      return false;
   }
}

/**
* Determines whether or not to display the login
* form or to show the user that he is logged in
* based on if the session variables are set.
*/
function displayLogin(){
   global $logged_in;
   if($logged_in){
      echo "<h1>Logged In!</h1>";
      echo "Welcome <b>$user_id</b>, you are logged in. <a href=\"logout.php\">Logout</a>";
   }
   else{
?>

<h1>Login</h1>
<p>You must login to use this feature<p>
<form action="" method="post">
<table align="left" border="0" cellspacing="0" cellpadding="3">
<tr><td>User name:</td><td><input type="text" name="user" maxlength="30"></td></tr>
<tr><td>Password:</td><td><input type="password" name="pass" maxlength="30"></td></tr>
<tr><td colspan="2" align="left"><input type="checkbox" name="remember">
<font size="2">Remember me next time</td></tr>
<tr><td colspan="2" align="right"><input type="submit" name="sublogin" value="Login"></td></tr>
<tr><td colspan="2" align="left"><a href="http://www.pkhotspots.com/gallery/register.php">Click here to Register, (using the gallery registration page)</a></td></tr>
</table>



</form>

<?
   }
}


/**
* Checks to see if the user has submitted his
* user_name and user_password through the login form,
* if so, checks authenticity in database and
* creates session.
*/
if(isset($_POST['sublogin'])){
   /* Check that all fields were typed in */
   if(!$_POST['user'] || !$_POST['pass']){
      die('You didn\'t fill in a required field.');
   }
   /* Spruce up user_name, check length */
   $_POST['user'] = trim($_POST['user']);
   if(strlen($_POST['user']) > 30){
      die("Sorry, the user_name is longer than 30 characters, please shorten it.");
   }

   /* Checks that user_name is in database and user_password is correct */
   $md5pass = md5($_POST['pass']);
   $result = confirmUser($_POST['user'], $md5pass);

   /* Check error codes */
   if($result == 1){
      die('That user_name doesn\'t exist in our database.');
   }
   else if($result == 2){
      die('Incorrect user_password, please try again.');
   }


   /* User_name and user_password correct, register session variables */
   $_POST['user'] = stripslashes($_POST['user']);
   $_SESSION['user_name'] = $_POST['user'];
   $_SESSION['user_id'] = $user_id;
   $_SESSION['user_password'] = $md5pass;

   /**
    * This is the cool part: the user has requested that we remember that
    * he's logged in, so we set two cookies. One to hold his user_name,
    * and one to hold his md5 encrypted user_password. We set them both to
    * expire in 100 days. Now, next time he comes to our site, we will
    * log him in automatically.
    */
   if(isset($_POST['remember'])){
      setcookie("cookname", $_SESSION['user_name'], time()+60*60*24*100, "/");
      setcookie("cookpass", $_SESSION['user_password'], time()+60*60*24*100, "/");
   }

   /* Quick self-redirect to avoid resending data on refresh */
   echo "<meta http-equiv=\"Refresh\" content=\"0;url=$HTTP_SERVER_VARS[php_SELF]\">";
   return;
}

/* Sets the value of the logged_in variable, which can be used in your code */
$logged_in = checkLogin();

?>

<form>
<input name="sid" type="hidden" id="sid" value="<? echo $id ?>">
</form>

</html>

comment.php

<? 
/* Include Files *********************/
session_start(); 
include("database.php");
include("login.php");
/*************************************/
?>

<html>

<body>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<title>HotSpot Submit Page</title>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
  <link href="http://www.pkhotspots.com/style2.css" rel="stylesheet" type="text/css" />
  <script type="text/javascript" src="http://www.pkhotspots.com/js/tooltip.js">
  </script>

</head>        
<body>

<? 
if($logged_in){
?>


<?php


$dbcnx = @mysql_connect('mysql3.freehostia.com:3306', 'chrall84_gallery', '*password*');
if (!$dbcnx) {
  exit('<p>Unable to connect to the ' .
      'database server at this time.</p>');
}

if (!@mysql_select_db('chrall84_gallery')) {
  exit('<p>Unable to locate the spot ' .
      'database at this time.</p>');
}




if (isset($_POST['comment'])): 
  // A new spot has been entered
  // using the form.

  $comment = $_POST['comment'];
  $authorid = $_SESSION['user_name'];
   $sid = $_POST['id'];
$textdate = date('d/m/y'); 


  $sql = "INSERT INTO comments SET
      comment='$comment',
      sid='$sid',
      date=CURDATE(),
authorid='$authorid',
textdate= '$textdate'";

  if (@mysql_query($sql)) {
    echo "<p>Thankyou, your comment has been added.</p>";
echo "<p>You may now close this window to return to the spot you were viewing</p>";

  } else {
    exit('<p>Error adding comment: ' . mysql_error() . '</p>');
  }
  
?>
<?php endif; ?>	



<p>Type in your comment then click Leave Comment!</p>


<form action="comment.php" method="post">

<p><strong>Comment:</strong><br />
<textarea name="comment" rows="1" cols="45">
</textarea></p>
<input name="sid" type="hidden" id="sid" value="<? echo $_GET['id'] ?>">
<input type="submit" name="Submit" value="Leave Comment!">


</form>

<? ;
}else{
   displayLogin(); 

}
?>

</body>
</html>

Example page to ilustrate problem is http://www.pkhotspots.com/spot.php?id=1

Again the problem is when comment is clicked it will go to comment with ?id=1 however once logged in I loose the ?id=1

thanks in advance for any help I know my ocde isnt the tidiest

sKunKbad · November 1, 2007

try

<? echo $_GET['id']; ?>

the location of the closing semi-colon might make a difference

you would of course have to remove the one that is a couple lines down

revraz · November 1, 2007

Careful on using <? instead of <?php, if your php.ini isn't set for short tags, it won't work.

sKunKbad · November 1, 2007

all of his/her code uses short tags, so it must be set that way.

SpiderSprog · November 1, 2007

I came up with a workaround for this (typically hit with inspiration to solve the problem moments after posting, its always the way with me)

I made the login script submit the $id passed in the query string to the login session

then in comment.php

used $id get $_GET['id']

and and if statement ($id >=1 ) to see if the id was set in the query string. if it is to use that and if not to use the id held in the session.

thanks for your help all the same

otuatail · November 1, 2007

the function confirmUser($user_name, $user_password)

the $q retreaves user_password, user_id on $user_name

Check that the $user_password in DB is the same as supplied.

Would it not be better to just

$q = "select * from cpg144_users where user_name = '$user_name' AND user_password = '$user_passwor'";

And check for rows returned?

Desmond.

SpiderSprog · November 2, 2007

I'm not sure, as I said the login code is not my own. I just left it as is rather than mess with it.

Sign In

[SOLVED] login session problems

Recommended Posts

SpiderSprog

Link to comment

Share on other sites

sKunKbad

Link to comment

Share on other sites

revraz

Link to comment

Share on other sites

sKunKbad

Link to comment

Share on other sites

SpiderSprog

Link to comment

Share on other sites

otuatail

Link to comment

Share on other sites

SpiderSprog

Link to comment

Share on other sites

Join the conversation

Browse

Activity

Important Information