[SOLVED] How to allow only logged in users to a specific webpage

[scarlson]

I am wondering how I go about allowing those users who successfully login to be able to go to a certain page.  Those users who are not logged should be re-directed to login page.  I was able to get the user authentication to work fine on my site but not sure what I need to add to certain pages to check if a user is logged in.

 

Any help will be greatly appreciated.

 

Thanks,

 

Scott

[marcus]

session_start();

if($_SESSION['sexy'] == 'you'){
// redirect to login
}else

if($_SESSION['sexy'] == 'me'){
// logged in
}

[scarlson]

session_start();

if($_SESSION['sexy'] == 'you'){
// redirect to login
}else

if($_SESSION['sexy'] == 'me'){
// logged in
}

 

 

Sorry, pretty new to this.  What would ['sexy'] represent?  I think on my page that I do the authentication do I need to register the session with the username and password and then use it in the example above?

[marcus]

The variable would represent authorization. If you're sexy, access denied, if I'm sexy, in this case I am, you're logged in with authorization.

[scarlson]

Here is my code from the login page:

 

if($count==1){

// Register $myusername, $mypassword and redirect to file "ad_setup.php"

session_register("myusername");

session_register("mypassword");

header("location:ad_setup.php");

}

else {
echo "<div id='error_setup'>The account information does not exist, Try again!</div>";

 

So would I do something like this:

 

session_start();

if($_SESSION['username'] == 'not sure what to put here'){
// redirect to login
}else

if($_SESSION['username'] == 'not sure what to put here'){
// logged in
}

 

[phpSensei]

Here is my code from the login page:

 

if($count==1){

// Register $myusername, $mypassword and redirect to file "ad_setup.php"

session_register("myusername");

session_register("mypassword");

header("location:ad_setup.php");

}

else {
echo "<div id='error_setup'>The account information does not exist, Try again!</div>";

 

So would I do something like this:

 

session_start();

if($_SESSION['username'] == 'not sure what to put here'){
// redirect to login
}else

if($_SESSION['username'] == 'not sure what to put here'){
// logged in
}

 

 

 

 

Login Page

 

<?php
session_start(); // GOES ON TOP OF EVERYTHING  "LINE 1"

    if(isset($_POST['submit button']))
    { // check if user has posted the form
          if((trim($_POST['username'] != ""))||
             (trim($_POST['password']!= "")))
              { // Check if user has filled in the fields
                 $row = mysql_fetch_array(mysql_query("SELECT * FROM users WHERE username 
                        = ".mysql_real_escape_string(strip_tags($_POST['username']))." AND password    
                        = ".mysql_real_escape_string(strip_tags($_POST['password']))."");

            if(($row['username']==$_POST['username'])&&($row['password']==$_POST['password'])){

               $_SESSION['username'] = $row['username'];
                     
                        if($row['user_level']=="admin"){
                        $_SESSION['user_level'] = 2; // Make this a 1 for user, and 2 for admin
                        }
                       else
                       {
                       $_SESSION['user_level'] = 1; // Make this a 1 for user, and 2 for admin
                       }

                       header("location:ad_setup.php"); // Redirect user if loggin was successful

            }
   
else {

    echo 'Username/Password fields were incorrect.';          
} 
}
else 
{ 
echo "Empty Fields"; 
}
}

?>


/// FORM GOES HERE

 

 

Restricted Area

 

 

<?php
session_start();

if(isset($_SESSION['username'])){

// logged in


}
else
{

header("location:login.php"); // REDIRECT TO LOGIN PAGE

}
?>

[scarlson]

Thank you so much, I implemented parts of your code and it works great now.

[phpSensei]

Thank you so much, I implemented parts of your code and it works great now.

 

Ya, sorry if some parts were sort of confusing if its your first right now.

 

Good luck