PHP HELP

justinede · February 28, 2008

Im currently working on a project for school. I need it so when the user logs in using my php script, that uses a mysql database, the page goes to a page that only people that have logged in can see.

trq · February 28, 2008

Simple example.

<?php
  
  session_start();

  if ($_SESSION['logged'])) {
    header("Location: membersonly.php");
  }

?>

Then, in membersonly.php.

<?php
  
  session_start();

  if (!$_SESSION['logged'])) {
    header("Location: login.php");
  }

?>

justinede · February 28, 2008

can we talk through email for more security?

trq · February 28, 2008

No, this is a public forum.

justinede · February 28, 2008

ok well can u try and see whats wrong...

go http://innercircle.preeminentdesign.net/index.php

and log in with

username: justin

password: justin1

it goes to what i have echoed in login.php but i want it to go to main2.php which can only be seen if u are logged in. But it wont go there. i think its because on the index the form isnt actually there is inside login.php cause of

<? displayLogin(); ?>

i dont know how to get this to work.. i want it to to go a whole new page when they log in. not just change the little area inside the login section.

amwd07 · February 28, 2008

This php tutorial may help you

http://www.phpeasystep.com/phptu/6.html

trq · February 28, 2008

Asking vague questions without supplying revent code won't get us anywhere.

Post some relevent code within

tags.

cyrixware · February 28, 2008

maybe this will help you.

loginAdmin.php

<?session_start();?>

//your html codes here..............

      <?php
if($_REQUEST['Submit'] == "Login")
{
	$username = $_REQUEST['username'];
	$passwrd = $_REQUEST['passwrd'];

	include("../connDB.php");

	$sql = "SELECT * FROM admin WHERE Username = '$username' AND Password = '$passwrd'";

	if(!$q = mysql_query($sql))
	{
		die(mysql_error());

	}

	elseif(mysql_num_rows($q) == 0)
	{
		echo "<font size=2 face=Verdana color=red><b>Invalid Username or Password!</b></font><br>";
		echo "<font size=2 face=verdana color=red><b>Try Again</b></font>";

	}

	else
	{
		$r = mysql_fetch_assoc($q);
		$TID = '1';

		$session_id = md5(date("Y-m-d H:i:s") . $TID);

		$sql1 = "UPDATE admin SET SessionID= '$session_id' WHERE Type = '$TID'";

		if(!$q1 = mysql_query($sql1))
		{
			die(mysql_error());
		}

		elseif(mysql_affected_rows() == 0)
		{
			echo "<font size=2 face=Verdana color=red>Failed to create session id!</font>";
		}	

		else
		{
			$_SESSION['session_id'] = $session_id;	
		}
	}

	$session_id = $_SESSION['session_id'];

	if($session_id != null && $session_id != "")
	{

	?>
          <script language=JavaScript>
		 	win = window.open('admin.php?ID=<?=$session_id;?>','_self')
		</script>
          <?	
	}
}

?>

session.php

<?php
session_start();

include("../connDB.php");

$session_id = $_SESSION['session_id'];

$message = "Invalid or Expired session id...";

if($session_id == null || $session_id == "")
{
	header("Location: loginAdmin.php?Message=$message");
	exit();
}

$sql = "SELECT * FROM admin WHERE SessionID = '$session_id'";

if(!$q = mysql_query($sql))
{

	header ("Location: loginAdmin.php?Message=$message"); 
}

if(mysql_num_rows($q) == 0)
{
	$message = "Re-logon for security purposes...";
	header ("Location: loginAdmin.php?Message=$message"); 
}

$r = mysql_fetch_assoc($q);	



?>

<?php include_once("session.php");?>
//Your codes here...................

So in every page you have you must include the session.php at the upper part of every pages.. The user the login corectly only can view every pages you made.

justinede · February 28, 2008

<? 
if($logged_in){
   echo 'Hello';
}else{
   echo 'Not logged in.';
}
?>

ok this is whats on a page that only logged in members should see.. instead of echoing "hello" can i echo html and other php inside the html... like a whole webpage..

cyrixware · February 28, 2008

In your database create a field for the session id.

cyrixware · February 28, 2008

<? 
if($logged_in){
   echo 'Hello';
}else{
   echo 'Not logged in.';
}
?>
ok this is whats on a page that only logged in members should see.. instead of echoing "hello" can i echo html and other php inside the html... like a whole webpage..

lack of security i think if you are going to use that technique..

justinede · February 28, 2008

no ty.. ive already got a solid script i just need it so it shows html instead of hello

trq · February 28, 2008

instead of echoing "hello" can i echo html and other php inside the html... like a whole webpage..

Yes. You can echo whatever you like.

justinede · February 28, 2008

so inside the "" i put the html?

justinede · February 28, 2008

srry for double post... but it shows the layout and all inside the echo but i cant get it to show the

<? displayLogin(); ?>

trq · February 28, 2008

Once again, we need to see code!

justinede · February 28, 2008

i showed u code!!! ok......

<? 
if($logged_in){
hello <br><? displayLogin(); ?>]

heres whats inside login

<?

/**
* Checks whether or not the given username is in the
* database, if so it checks if the given password is
* the same password in the database for that user.
* If the user doesn't exist or if the passwords don't
* match up, it returns an error code (1 or 2). 
* On success it returns 0.
*/
function confirmUser($username, $password){
   global $conn;
   /* Add slashes if necessary (for query) */
   if(!get_magic_quotes_gpc()) {
$username = addslashes($username);
   }

   /* Verify that user is in database */
   $q = "select password from users where username = '$username'";
   $result = mysql_query($q,$conn);
   if(!$result || (mysql_numrows($result) < 1)){
      return 1; //Indicates username failure
   }

   /* Retrieve password from result, strip slashes */
   $dbarray = mysql_fetch_array($result);
   $dbarray['password']  = stripslashes($dbarray['password']);
   $password = stripslashes($password);

   /* Validate that password is correct */
   if($password == $dbarray['password']){
      return 0; //Success! Username and password confirmed
   }
   else{
      return 2; //Indicates password failure
   }
}

/**
* checkLogin - Checks if the user has already previously
* logged in, and a session with the user has already been
* established. Also checks to see if user has been remembered.
* If so, the database is queried to make sure of the user's 
* authenticity. Returns true if the user has logged in.
*/
function checkLogin(){
   /* Check if user has been remembered */
   if(isset($_COOKIE['cookname']) && isset($_COOKIE['cookpass'])){
      $_SESSION['username'] = $_COOKIE['cookname'];
      $_SESSION['password'] = $_COOKIE['cookpass'];
   }

   /* Username and password have been set */
   if(isset($_SESSION['username']) && isset($_SESSION['password'])){
      /* Confirm that username and password are valid */
      if(confirmUser($_SESSION['username'], $_SESSION['password']) != 0){
         /* Variables are incorrect, user not logged in */
         unset($_SESSION['username']);
         unset($_SESSION['password']);
         return false;
      }
      return true;
   }
   /* User not logged in */
   else{
      return false;
   }
}

/**
* Determines whether or not to display the login
* form or to show the user that he is logged in
* based on if the session variables are set.
*/
function displayLogin(){
   global $logged_in;
   if($logged_in){
      echo "<h1>Logged In!</h1>";
      echo "Welcome <b>$_SESSION[username]</b>, you are logged in.<br> <br><a href=\"mail.php\">Mail<br><a href=\"\">Profile<br><a href=\"\">Friends</a><br><a href=\"\">Search</a><br><a href=\"\">Invite<br></a><a href=\"\">Music</a><br><br><a href=\"logout.php\">Logout</a>";
   }
   else{
?>
<form action="" method="post">
  <table align="left" border="0" cellspacing="0" cellpadding="3">
<tr>
  <td>Username:</td>
  <td><input type="text" name="user" maxlength="30"></td></tr>
<tr><td>Password:</td><td><input type="password" name="pass" maxlength="30"></td></tr>
<tr><td colspan="2" align="left"><input type="checkbox" name="remember">
<font size="2">Remember Me </td>
</tr>
<tr><td colspan="2" align="right"><div align="left">
  <table width="246" border="0">
    <tr>
      <td width="62">
        <input type="submit" name="sublogin" value="Login">
      </td>
      <td width="174"><a href="register.php">Register</a>|<a href="forgotpw.php">Forgot Password</a></td>
    </tr>
  </table>
  </div></td></tr>
<tr><td colspan="2" align="left"></td></tr>
</table>
</form>

<?
   }
}


/**
* Checks to see if the user has submitted his
* username and password through the login form,
* if so, checks authenticity in database and
* creates session.
*/
if(isset($_POST['sublogin'])){
   /* Check that all fields were typed in */
   if(!$_POST['user'] || !$_POST['pass']){
      die('You didn\'t fill in a required field.');
   }
   /* Spruce up username, check length */
   $_POST['user'] = trim($_POST['user']);
   if(strlen($_POST['user']) > 30){
      die("Sorry, the username is longer than 30 characters, please shorten it.");
   }

   /* Checks that username is in database and password is correct */
   $md5pass = md5($_POST['pass']);
   $result = confirmUser($_POST['user'], $md5pass);

   /* Check error codes */
   if($result == 1){
      die('That username doesn\'t exist in our database.');
   }
   else if($result == 2){
      die('Incorrect password, please try again.');
   }

   /* Username and password correct, register session variables */
   $_POST['user'] = stripslashes($_POST['user']);
   $_SESSION['username'] = $_POST['user'];
   $_SESSION['password'] = $md5pass;

   /**
    * This is the cool part: the user has requested that we remember that
    * he's logged in, so we set two cookies. One to hold his username,
    * and one to hold his md5 encrypted password. We set them both to
    * expire in 100 days. Now, next time he comes to our site, we will
    * log him in automatically.
    */
   if(isset($_POST['remember'])){
      setcookie("cookname", $_SESSION['username'], time()+60*60*24*100, "/");
      setcookie("cookpass", $_SESSION['password'], time()+60*60*24*100, "/");
   }

   /* Quick self-redirect to avoid resending data on refresh */
   echo "<meta http-equiv=\"Refresh\" content=\"0;url=$HTTP_SERVER_VARS[php_SELF]\">";
   return;
}

/* Sets the value of the logged_in variable, which can be used in your code */
$logged_in = checkLogin();

?>

cyrixware · February 28, 2008

srry for double post... but it shows the layout and all inside the echo but i cant get it to show the
<? displayLogin(); ?>

can you pls post some codes here so that were' going to see if ther's a problem....

trq · February 28, 2008

If this....

<? 
if($logged_in){
hello <br><? displayLogin(); ?>]

is your code, you have issues and should be producing errors. Can we see your actual code?

cyrixware · February 28, 2008

no ty.. ive already got a solid script i just need it so it shows html instead of hello

header("Location: login.php");

header("Location: login.html");

justinede · February 28, 2008

ok here's the protected page

<? 
/* Include Files *********************/
session_start(); 
include("database.php");
include("login.php");
/*************************************/
?>
<html>
<title>
Justin
</title>
<body>

<? 
if($logged_in){
   echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<? 
/* Include Files *********************/
session_start(); 
include("database.php");
include("login.php");
/*************************************/
?>
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<link rel="icon" href="favicon.ico" type="image/x-icon">
<link rel="shortcut icon" href="favicon.ico" type="image/x-icon"> 
<meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>Inner Circle</title>
<meta name="keywords" content="" />
<meta name="description" content="" />
<link href="default.css" rel="stylesheet" type="text/css" />
<style type="text/css">
<!--
.style1 {color: #FF5723}
-->
</style>
</head>
<body>
<div id="header">

  <div id="logo"> 
    <h1><a href="index.html">Inner Circle<font size="1">®</font></a></h1>

    <h2>Made for Santa Susanna Teens.</h2>
    <center><font size="2">Brought to you by: <a href="http://justinledelson.com">Justin Edelson</a></font>
    </center>
  </div>
<div id="menu">
	<ul>

      <li class="active"><a href="index.php"><font size="2.5">Home</font></a></li>
		<li><a href="about.php"><font size="2">About</font></a></li>
		<li><a href="events.php"><font size="2">Events</font></a></li>
		<li><a href="invite.php"><font size="2">Invite</font></a></li>
		<li><a href="games.php"><font size="2">Games</font></a></li>
		<li><a href="contact.php"><font size="2">Contact</font></a></li>
	</ul>
</div>
</div>
<div id="page">
<div id="content">

    <div style="margin-bottom: 20px;"> 
      <h1 class="title">Welcome to the Inner Circle!</h1>

      <p><strong>Inner Circle</strong> is an active online community for Santa Susanna High School Teens. While on <strong>Inner Circle</strong>, You can  share photos, music, and comment Your Friends. You can create your FREE account and start socializing now by <a href="register.php">registering</a>.  Also, <strong>Inner Circle</strong> has a special section for Dating. If you are worried about your privacy, <strong>Inner Circle</strong> is open to Santa Susanna High School Teens only and upon registering you will be required to fill out valid TAP information.</p>
		<h2>Donations</h2>
		<p><strong>Inner Circle</strong> will soon be accepting Pay Pal donations for those of you that feel the need to be generous. Make sure you donate with a verified Pay Pal account only. Thanks for your generosity.</p>
  </div>
	<div> </div>
	<div class="twocols">
		<div class="col1">
			<h3 class="title">Newest Member</h3>
			<p>Donec leo, vivamus fermentum nibh in augue praesent a lacus at urna congue rutrum. Quisque dictum integer nisl risus, sagittis convallis, rutrum id, congue, and nibh.</p>
			<p><a href="#">Read more…</a></p>
		</div>
		<div class="col2">
			<h3 class="title">Pellentesque Quis</h3>
			<ul class="list">
				<li><a href="#">Ut semper vestibulum est</a></li>
				<li><a href="#">Vestibulum luctus dui</a></li>
				<li><a href="#">Integer rutrum nisl in mi</a></li>
				<li><a href="#">Etiam malesuada rutrum</a></li>
				<li><a href="#">Aenean facilisis ligula</a></li>
				<li><a href="#">Vestibulum luctus dui</a></li>
				<li><a href="#">Ut elit vitae augue</a></li>
				<li><a href="#">Sed sagittis leo vehicula</a></li>
				<li><a href="#">Ut elit vitae augue</a></li>
			</ul>
		</div>
	</div>
</div>
<!-- end content -->
<div id="sidebar">
	<div id="search" class="boxed">
		<h2 class="title">Member\'s Area</h2>
	  <div class="content">
		  <? displayLogin(); ?>
              <br />
              <br />
              <br />
               <br />
              <br />
              <br />
              <br />
              
		</div>
	</div>
	<div id="news" class="boxed">
		<h2 class="title">News & Events</h2>
		<div class="content">
			<ul>
				<li class="first">
					<h3>03 March 2008</h3>
					<p class="style1">Need suggestions and ideas so go ahead and send them to me or say hi at school.</p>
				</li>
				<li>
					<h3>28 February 2008</h3>
					<p class="style1">Got the login database all set up. Go ahease and try it if you want.</p>
				</li>
				<li>
					<h3>27 February 2008</h3>
					<p class="style1">Beta version is now open for bug testers.</p>
				</li>
			</ul>
		</div>
	</div>
	<div id="extra" class="boxed">
		<h2 class="title">Sponsored Links</h2>
		<div class="content">
			<ul class="list">
				<li class="first"><a href="#">Ut semper vestibulum est…</a></li>
				<li><a href="#">Vestibulum luctus venenatis…</a></li>
				<li><a href="#">Integer rutrum nisl in mi…</a></li>
			</ul>
		</div>
	</div>
</div>
<!-- end sidebar -->
<div style="clear: both;"> </div>
</div>
<!-- end page -->
<div id="footer">

  <p id="legal">©2007 Justin Edelson. All Rights Reserved. Designed by Justin 
    Edelson </p>

  <p id="links"><a href="#">Privacy</a> | <a href="#">Terms</a> | <a href="https://ip-208-109-23-19.ip.secureserver.net:8443/">Admin</a></p>
</div>

</body>
</html>';
}else{
   echo 'Not logged in.';
}
?>

</body>
</html>

heres the login

<?

/**
* Checks whether or not the given username is in the
* database, if so it checks if the given password is
* the same password in the database for that user.
* If the user doesn't exist or if the passwords don't
* match up, it returns an error code (1 or 2). 
* On success it returns 0.
*/
function confirmUser($username, $password){
   global $conn;
   /* Add slashes if necessary (for query) */
   if(!get_magic_quotes_gpc()) {
$username = addslashes($username);
   }

   /* Verify that user is in database */
   $q = "select password from users where username = '$username'";
   $result = mysql_query($q,$conn);
   if(!$result || (mysql_numrows($result) < 1)){
      return 1; //Indicates username failure
   }

   /* Retrieve password from result, strip slashes */
   $dbarray = mysql_fetch_array($result);
   $dbarray['password']  = stripslashes($dbarray['password']);
   $password = stripslashes($password);

   /* Validate that password is correct */
   if($password == $dbarray['password']){
      return 0; //Success! Username and password confirmed
   }
   else{
      return 2; //Indicates password failure
   }
}

/**
* checkLogin - Checks if the user has already previously
* logged in, and a session with the user has already been
* established. Also checks to see if user has been remembered.
* If so, the database is queried to make sure of the user's 
* authenticity. Returns true if the user has logged in.
*/
function checkLogin(){
   /* Check if user has been remembered */
   if(isset($_COOKIE['cookname']) && isset($_COOKIE['cookpass'])){
      $_SESSION['username'] = $_COOKIE['cookname'];
      $_SESSION['password'] = $_COOKIE['cookpass'];
   }

   /* Username and password have been set */
   if(isset($_SESSION['username']) && isset($_SESSION['password'])){
      /* Confirm that username and password are valid */
      if(confirmUser($_SESSION['username'], $_SESSION['password']) != 0){
         /* Variables are incorrect, user not logged in */
         unset($_SESSION['username']);
         unset($_SESSION['password']);
         return false;
      }
      return true;
   }
   /* User not logged in */
   else{
      return false;
   }
}

/**
* Determines whether or not to display the login
* form or to show the user that he is logged in
* based on if the session variables are set.
*/
function displayLogin(){
   global $logged_in;
   if($logged_in){
      echo "<h1>Logged In!</h1>";
      echo "Welcome <b>$_SESSION[username]</b>, you are logged in.<br> <br><a href=\"mail.php\">Mail<br><a href=\"\">Profile<br><a href=\"\">Friends</a><br><a href=\"\">Search</a><br><a href=\"\">Invite<br></a><a href=\"\">Music</a><br><br><a href=\"logout.php\">Logout</a>";
   }
   else{
?>
<form action="" method="post">
  <table align="left" border="0" cellspacing="0" cellpadding="3">
<tr>
  <td>Username:</td>
  <td><input type="text" name="user" maxlength="30"></td></tr>
<tr><td>Password:</td><td><input type="password" name="pass" maxlength="30"></td></tr>
<tr><td colspan="2" align="left"><input type="checkbox" name="remember">
<font size="2">Remember Me </td>
</tr>
<tr><td colspan="2" align="right"><div align="left">
  <table width="246" border="0">
    <tr>
      <td width="62">
        <input type="submit" name="sublogin" value="Login">
      </td>
      <td width="174"><a href="register.php">Register</a>|<a href="forgotpw.php">Forgot Password</a></td>
    </tr>
  </table>
  </div></td></tr>
<tr><td colspan="2" align="left"></td></tr>
</table>
</form>

<?
   }
}


/**
* Checks to see if the user has submitted his
* username and password through the login form,
* if so, checks authenticity in database and
* creates session.
*/
if(isset($_POST['sublogin'])){
   /* Check that all fields were typed in */
   if(!$_POST['user'] || !$_POST['pass']){
      die('You didn\'t fill in a required field.');
   }
   /* Spruce up username, check length */
   $_POST['user'] = trim($_POST['user']);
   if(strlen($_POST['user']) > 30){
      die("Sorry, the username is longer than 30 characters, please shorten it.");
   }

   /* Checks that username is in database and password is correct */
   $md5pass = md5($_POST['pass']);
   $result = confirmUser($_POST['user'], $md5pass);

   /* Check error codes */
   if($result == 1){
      die('That username doesn\'t exist in our database.');
   }
   else if($result == 2){
      die('Incorrect password, please try again.');
   }

   /* Username and password correct, register session variables */
   $_POST['user'] = stripslashes($_POST['user']);
   $_SESSION['username'] = $_POST['user'];
   $_SESSION['password'] = $md5pass;

   /**
    * This is the cool part: the user has requested that we remember that
    * he's logged in, so we set two cookies. One to hold his username,
    * and one to hold his md5 encrypted password. We set them both to
    * expire in 100 days. Now, next time he comes to our site, we will
    * log him in automatically.
    */
   if(isset($_POST['remember'])){
      setcookie("cookname", $_SESSION['username'], time()+60*60*24*100, "/");
      setcookie("cookpass", $_SESSION['password'], time()+60*60*24*100, "/");
   }

   /* Quick self-redirect to avoid resending data on refresh */
   echo "<meta http-equiv=\"Refresh\" content=\"0;url=$HTTP_SERVER_VARS[php_SELF]\">";
   return;
}

/* Sets the value of the logged_in variable, which can be used in your code */
$logged_in = checkLogin();

?>

^^ once u login u have protected links. u click on mail and that brings you to the protected mail.php. inside the mail.php there is a part that shows login.php..

trq · February 28, 2008

You are including login.php within your protected page, twice actually.

justinede · February 28, 2008

o ok.. so thats a no no.. lol?

Sign In

PHP HELP

Recommended Posts

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Join the conversation

Important Information