Login Redirection

[mikebyrne]

I want to setup some login redirection on my page. My database is setup so that employees are assigned "2" on registration and customers "1". The is is stored in the field usertype.

 

If an Employee logs on I want them to be redirected to ../Admin_files/start.php and the customers to be redirected to ../Main Page/first

 

At present my code looks like this

 

<?php
include("adminconnect.php");

$tbl_name="adminusers";

if(isset($_POST['uname']) && isset($_POST['pword']))
{
session_start();
// Define $myusername and $mypassword
$uname=mysql_escape_string($_POST['uname']);
$pword=mysql_escape_string($_POST['pword']);


$sql="SELECT * FROM $tbl_name WHERE username='$uname' and password='$pword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if($count==1)
   {
while($row = mysql_fetch_assoc($result)) {
      // Register $myusername, $mypassword and redirect to file "login_success.php"
      $_SESSION['uname'] = $row['username'];
      $_SESSION['pword'] = $row['password'];
      //The : acts as a Else.  So if row user =1 then its a Cust, otherwise it's a Emp.
      $_SESSION['type'] = ($row['User']==1)?"Cust":"Emp";
    

header("Location: ../admin_files/start.php.php");
}
   }else{
      echo "Wrong Username or Password";
   }
}
?>
      <form action="login.php" method="POST">
      <div align="right">Pleas enter your Login Name</b>

<BR>(This is the name you signed up with)</div>
    </td>
    <td width="50%"> 
      <input type="text" name="uname" size="12" maxlength="50" class="field">
    </td>
  </tr>
  <tr> 
    <td class="bgrl"> 
      <div align="right">Please enter your <b>password</b></div>

    </td>
    <td width="50%" class="bgrl">
      <input type="password" name="pword" size="18" class="field">
    </td>
  </tr>
  <tr><td> </td>
    <td>
    <input type="submit" value="Login »" class="submit"></form></td>
  </tr>

 

[conker87]

I would recommend using mysql_result rather than a while { }.

 

Try:

<?php

if ($_SESSION['type'] == "Emp")
       {
              header("Location: ../admin_files/start.php");
       }
else if ($_SESSION['type'] == "Cust")
       {
              header("Location: ../Main Page/first.php");
       }

?>

[redarrow]

<?php session_start();?>

 

Always keep session start at the top off every

session page or your get error from other included pages...........

[mikebyrne]

Ok my code looks like this now

 

    <?php
include("adminconnect.php");

$tbl_name="adminusers";

if(isset($_POST['uname']) && isset($_POST['pword']))
{
session_start();
// Define $myusername and $mypassword
$uname=mysql_escape_string($_POST['uname']);
$pword=mysql_escape_string($_POST['pword']);


$sql="SELECT * FROM $tbl_name WHERE username='$uname' and password='$pword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if ($_SESSION['type'] == "Emp")
       {
              header("Location: ../admin_files/start.php");
       }
else if ($_SESSION['type'] == "Cust")
       {
              header("Location: ../Main Page/first.php");
       }
?>

 

I'm a little confused as to how the code tells what type of user it as as my "user" field only has two values 1 or 2 to tell the usertype 

[timmy0320]

You could always have it tell it that Emp = 1 and Cust = 2 or vice versa. Or you could simply set the session 'type' as 1 or 2.

 

Note that this way is insecure of doing it you should read up some on session security to help you secure it some. shiftlett.org has some good articles.

[mikebyrne]

Would that be

 

if ($_SESSION['type'] == "2")

      {

              header("Location: ../admin_files/start.php");

      }

else if ($_SESSION['type'] == "1")

      {

              header("Location: ../Main Page/first.php");

      }

 

or

 

if ($_SESSION['usertype'] == "2")

      {

              header("Location: ../admin_files/start.php");

      }

else if ($_SESSION['usertype'] == "1")

      {

              header("Location: ../Main Page/first.php");

      }

[timmy0320]

Whichever you want the [' '] inside the session is just the name of a variable in the session

 

on start.php you would go something like

 

<?

if (isset($_SESSION['type']) && $_SESSION['type'] == 1) {
   echo "You're logged in";
} else {
   echo "You must be logged in";
}
?>

 

and same with first.php just change the 1 to 2

[mikebyrne]

Im getting the error

 

 

Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at C:\xampp\htdocs\Main Page\login.php:5) in C:\xampp\htdocs\Main Page\login.php on line 10

 

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at C:\xampp\htdocs\Main Page\login.php:5) in C:\xampp\htdocs\Main Page\login.php on line 10

 

Line 10 refers to:

 

<?php session_start();?>

 

My code up to line 10  looks like

 

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>CD WOW!   - CD - DVD - GAMES | Best Prices & FREE Delivery Worldwide!</title><meta name="description" content="CD WOW! CDs, DVDs & Games at unbeatable prices with FREE delivery worldwide. www.cdwow.ie" /><meta name="keywords" content="cd's, cds, cheapest, music, cd, dvd, games, buy, free delivery, ireland, shop, bargain, low price, low, price, cheapest, cheap, gift" />

<link rel="stylesheet" type="text/css" href="../Main Page/style_main.css">
<link rel="stylesheet" type="text/css" href="../Main Page/style_1.css" title="stylesheet">

<?php session_start();?>

 

[BlueSkyIS]

session_start() must come before any output to the browser, including everything you have above it in your script.

[mikebyrne]

Thats fixed the error but the page returns to Login.php (the page its on) when I enter in the details rather than start.php or first.php

[BlueSkyIS]

latest code, please?

[mikebyrne]

<?php
include("adminconnect.php");

$tbl_name="adminusers";

if(isset($_POST['uname']) && isset($_POST['pword']))
{
session_start();
// Define $myusername and $mypassword
$uname=mysql_escape_string($_POST['uname']);
$pword=mysql_escape_string($_POST['pword']);


$sql="SELECT * FROM $tbl_name WHERE username='$uname' and password='$pword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if ($_SESSION['usertype'] == "2")
       {
              header("Location: ../admin_files/start.php");
       }
else if ($_SESSION['usertype'] == "1")
       {
              header("Location: ../Main Page/first.php");
       }
}
?>
      <form action="login.php" method="POST">
      <div align="right">Pleas enter your Login Name</b>

<BR>(This is the name you signed up with)</div>
    </td>
    <td width="50%"> 
      <input type="text" name="uname" size="12" maxlength="50" class="field">
    </td>
  </tr>
  <tr> 
    <td class="bgrl"> 
      <div align="right">Please enter your <b>password</b></div>

    </td>
    <td width="50%" class="bgrl">
      <input type="password" name="pword" size="18" class="field">
    </td>
  </tr>
  <tr><td> </td>
    <td>
    <input type="submit" value="Login »" class="submit"></form></td>
  </tr>



  <tr><td colspan="2" class="genericside"><span class="t11bw">Forgotten your password?</span></td>
  </tr>
  <tr valign="top"> 
    <td class="alignright">
    <form name="passwordreminder" action="/member_login.php" method="post">
    <input type="hidden" name="type" value="passwordreminder">
    Please enter your email here:</td>

<td><input type="text" name="reminderemail" class="field" maxlength="50"><br>
<input type="submit" value="Send Password »" class="submit">
    </form>  

 

[mikebyrne]

Should I be setting a session varible for $_SESSION['usertype']?? Could that be the problem?

[timmy0320]

How are you verifying what their usertype is? Is it in the database? If so here is what you should be doing. Everything I've added will have a /* comment above and below it

 

 

<?php

<?php
/* This always goes at the top */
session_start();

include("adminconnect.php");

$tbl_name="adminusers";

if(isset($_POST['uname']) && isset($_POST['pword']))
{
// Define $myusername and $mypassword
$uname=mysql_escape_string($_POST['uname']);
$pword=mysql_escape_string($_POST['pword']);


$sql="SELECT * FROM $tbl_name WHERE username='$uname' and password='$pword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

        /* grab the usertype */
        $r = mysql_fetch_array($result);
        
        /* We will verify that the num_rows exists, for some reason you weren'y verifying this  */
        /* After verifying, we will then set the session, this is assuming that there is a column  */
        /* in your table named 'type' and its value is either '1' or '2'                                     */
        if ($count > 0) {
               $_SESSION['type'] = $r['type'];
               $logged = true;
        } else {
               echo "Wrong Username/Password.";
        }
            
if ($_SESSION['usertype'] == "2" && $logged = 'true')
       {
              header("Location: ../admin_files/start.php");
       }
else if ($_SESSION['usertype'] == "1" && logged = 'true')
       {
              header("Location: ../Main Page/first.php");
       }
}
?>
      <form action="login.php" method="POST">
      <div align="right">Pleas enter your Login Name</b>

<BR>(This is the name you signed up with)</div>
    </td>
    <td width="50%"> 
      <input type="text" name="uname" size="12" maxlength="50" class="field">
    </td>
  </tr>
  <tr> 
    <td class="bgrl"> 
      <div align="right">Please enter your <b>password</b></div>

    </td>
    <td width="50%" class="bgrl">
      <input type="password" name="pword" size="18" class="field">
    </td>
  </tr>
  <tr><td> </td>
    <td>
    <input type="submit" value="Login »" class="submit"></form></td>
  </tr>



  <tr><td colspan="2" class="genericside"><span class="t11bw">Forgotten your password?</span></td>
  </tr>
  <tr valign="top"> 
    <td class="alignright">
    <form name="passwordreminder" action="/member_login.php" method="post">
    <input type="hidden" name="type" value="passwordreminder">
    Please enter your email here:</td>

<td><input type="text" name="reminderemail" class="field" maxlength="50"><br>
<input type="submit" value="Send Password »" class="submit">
    </form>  

?>

 

 

There's PLENTY of other ways to do it. That's just the basic idea of how it works, you can edit it and move stuff around. For your start.php and first.php pages would go something along the lines of what I said in a post above.

 

<?php
if (isset($_SESSION['type']) && $_SESSION['type'] == 1) {
   echo "You're logged in";
} else {
   echo "You must be logged in";
}
?>

 

 

You will also want to add some security to this. This is just to help you get it working.

if (isset[$_SESSION

[mikebyrne]

Yeah, the 3 fields in the database im looking at are password, username and usertype

[timmy0320]

Yeah, the 3 fields in the database im looking at are password, username and usertype

 

 

Then just change the

 

$r['user'];

 

To:

 

$r['usertype'];

 

 

Hope you got it figured out.

[mikebyrne]

Im getting the error

 

 

Parse error: syntax error, unexpected '=' in C:\xampp\htdocs\Main Page\login.php on line 303

 

line 303 is:

 

else if ($_SESSION['usertype'] == "1" && logged = 'true')

 

my php so far

 

    <?php
session_start();

include("adminconnect.php");

$tbl_name="adminusers";

if(isset($_POST['uname']) && isset($_POST['pword']))
{
// Define $myusername and $mypassword
$uname=mysql_escape_string($_POST['uname']);
$pword=mysql_escape_string($_POST['pword']);


$sql="SELECT * FROM $tbl_name WHERE username='$uname' and password='$pword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

        /* grab the usertype */
        $r = mysql_fetch_array($result);
        
        /* We will verify that the num_rows exists, for some reason you weren'y verifying this  */
        /* After verifying, we will then set the session, this is assuming that there is a column  */
        /* in your table named 'type' and its value is either '1' or '2'                                     */
        if ($count > 0) {
               $_SESSION['type'] = $r['usertype'];
               $logged = true;
        } else {
               echo "Wrong Username/Password.";
        }
            
if ($_SESSION['usertype'] == "2" && $logged = 'true')
       {
              header("Location: ../Admin_files/start.php");
       }
else if ($_SESSION['usertype'] == "1" && logged = 'true')
       {
              header("Location: ../Main Page/first.php");
       }
}
?>

[timmy0320]

My bad.

 

 

<?php
if ($_SESSION['usertype'] == "2" && $logged == "true")
?>

 

 

and

 

<?php

else if ($_SESSION['usertype'] == "1" && $logged == "true")
?>

[mikebyrne]

No my page still doesnt go anywhere, just refreshes!!!

 

<?php
session_start();

include("adminconnect.php");

$tbl_name="adminusers";

if(isset($_POST['uname']) && isset($_POST['pword']))
{
// Define $myusername and $mypassword
$uname=mysql_escape_string($_POST['uname']);
$pword=mysql_escape_string($_POST['pword']);


$sql="SELECT * FROM $tbl_name WHERE username='$uname' and password='$pword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

        /* grab the usertype */
        $r = mysql_fetch_array($result);
        
        /* We will verify that the num_rows exists, for some reason you weren'y verifying this  */
        /* After verifying, we will then set the session, this is assuming that there is a column  */
        /* in your table named 'type' and its value is either '1' or '2'                                     */
        if ($count > 0) {
               $_SESSION['type'] = $r['usertype'];
               $logged = true;
        } else {
               echo "Wrong Username/Pad =ssword.";
        }
            
if ($_SESSION['usertype'] == "2" && $logged == "true") 
       {
              header("Location: ../Admin_files/start.php");
       }

else if ($_SESSION['usertype'] == "1" && $logged == "true") 
       {
           
	     header("Location: ../Main Page/first.php");
       }
}
?>
      <form action="login.php" method="POST">
      <div align="right">Pleas enter your Login Name</b>

<BR>(This is the name you signed up with)</div>
    </td>
    <td width="50%"> 
      <input type="text" name="uname" size="12" maxlength="50" class="field">
    </td>
  </tr>
  <tr> 
    <td class="bgrl"> 
      <div align="right">Please enter your <b>password</b></div>

    </td>
    <td width="50%" class="bgrl">
      <input type="password" name="pword" size="18" class="field">
    </td>
  </tr>
  <tr><td> </td>
    <td>
    <input type="submit" value="Login »" class="submit"></form></td>
  </tr>



  <tr><td colspan="2" class="genericside"><span class="t11bw">Forgotten your password?</span></td>
  </tr>
  <tr valign="top"> 
    <td class="alignright">
    <form name="passwordreminder" action="/member_login.php" method="post">
    <input type="hidden" name="type" value="passwordreminder">
    Please enter your email here:</td>

<td><input type="text" name="reminderemail" class="field" maxlength="50"><br>
<input type="submit" value="Send Password »" class="submit">
    </form>  

 

[timmy0320]

No my page still doesnt go anywhere, just refreshes!!!

 

<?php

        if ($count > 0) {
               $_SESSION['type'] = $r['usertype'];
               $logged = true;
        } else {
               echo "Wrong Username/Pad =ssword.";
        }
            
if ($_SESSION['usertype'] == "2" && $logged == "true") 
       {
              header("Location: ../Admin_files/start.php");
       }

else if ($_SESSION['usertype'] == "1" && $logged == "true") 
       {
           
	     header("Location: ../Main Page/first.php");
       }
}
?>

 

 

 

Ah blah, change this:

 

<?php $_SESSION['type'] = $r['usertype']; ?>

 

 

to this:

 

<?php $_SESSION['usertype'] = $r['usertype']; ?>

 

 

If you noticed I gave you code that was checking for a $_SESSION named 'usertype' when it was being set as 'user'

 

 

 

[mikebyrne]

Getting the error

 

Warning: Cannot modify header information - headers already sent by (output started at C:\xampp\htdocs\Main Page\login.php:5) in C:\xampp\htdocs\Main Page\login.php on line 306

 

Line 306 is :  header("Location: ../Main Page/first.php")

 

<?php

include("adminconnect.php");

$tbl_name="adminusers";

if(isset($_POST['uname']) && isset($_POST['pword']))
{
// Define $myusername and $mypassword
$uname=mysql_escape_string($_POST['uname']);
$pword=mysql_escape_string($_POST['pword']);


$sql="SELECT * FROM $tbl_name WHERE username='$uname' and password='$pword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

        /* grab the usertype */
        $r = mysql_fetch_array($result);
        
        /* We will verify that the num_rows exists, for some reason you weren'y verifying this  */
        /* After verifying, we will then set the session, this is assuming that there is a column  */
        /* in your table named 'type' and its value is either '1' or '2'                                     */
        if ($count > 0) {
               $_SESSION['usertype'] = $r['usertype'];
               $logged = true;
        } else {
               echo "Wrong Username/Pad =ssword.";
        }
            
if ($_SESSION['usertype'] == "2" && $logged == "true") 
       {
              header("Location: ../Admin_files/start.php");
       }

else if ($_SESSION['usertype'] == "1" && $logged == "true") 
       {
           
	     header("Location: ../Main Page/first.php");
       }
}
?>
      <form action="login.php" method="POST">
      <div align="right">Pleas enter your Login Name</b>

<BR>(This is the name you signed up with)</div>
    </td>
    <td width="50%"> 
      <input type="text" name="uname" size="12" maxlength="50" class="field">
    </td>
  </tr>
  <tr> 
    <td class="bgrl"> 
      <div align="right">Please enter your <b>password</b></div>

    </td>
    <td width="50%" class="bgrl">
      <input type="password" name="pword" size="18" class="field">
    </td>
  </tr>
  <tr><td> </td>
    <td>
    <input type="submit" value="Login »" class="submit"></form></td>
  </tr>



  <tr><td colspan="2" class="genericside"><span class="t11bw">Forgotten your password?</span></td>
  </tr>
  <tr valign="top"> 
    <td class="alignright">
    <form name="passwordreminder" action="/member_login.php" method="post">
    <input type="hidden" name="type" value="passwordreminder">
    Please enter your email here:</td>

<td><input type="text" name="reminderemail" class="field" maxlength="50"><br>
<input type="submit" value="Send Password »" class="submit">
    </form>  

 

 

[timmy0320]

Remove the empty line in your code above the header. If that doesn't work try renaming your file without a space and fix your code accordingly.

[mikebyrne]

Ive changed the name to MainPage as suggested but im still getting the same problem with the page just refreshing

 

 

The top of the page login.php looks like this

 

<?php session_start();?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>

 

the php looks like this now

 

<?php
include("adminconnect.php");

$tbl_name="adminusers";

if(isset($_POST['uname']) && isset($_POST['pword']))
{
// Define $myusername and $mypassword
$uname=mysql_escape_string($_POST['uname']);
$pword=mysql_escape_string($_POST['pword']);


$sql="SELECT * FROM $tbl_name WHERE username='$uname' and password='$pword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

        /* grab the usertype */
        $r = mysql_fetch_array($result);
        
        /* We will verify that the num_rows exists, for some reason you weren'y verifying this  */
        /* After verifying, we will then set the session, this is assuming that there is a column  */
        /* in your table named 'type' and its value is either '1' or '2'                                     */
        if ($count > 0) {
               $_SESSION['usertype'] = $r['usertype'];
               $logged = true;
        } else {
               echo "Wrong Username/Pad =ssword.";
        }
            
if ($_SESSION['usertype'] == "2" && $logged == "true") 
       {
              header("Location: ../Admin_files/start.php");
       }

else if ($_SESSION['usertype'] == "1" && $logged == "true") 
       {
           
	     header("Location: ../MainPage/first.php");
       }
}
?>
      <form action="login.php" method="POST">
      <div align="right">Pleas enter your Login Name</b>

<BR>(This is the name you signed up with)</div>
    </td>
    <td width="50%"> 
      <input type="text" name="uname" size="12" maxlength="50" class="field">
    </td>
  </tr>
  <tr> 
    <td class="bgrl"> 
      <div align="right">Please enter your <b>password</b></div>

    </td>
    <td width="50%" class="bgrl">
      <input type="password" name="pword" size="18" class="field">
    </td>
  </tr>
  <tr><td> </td>
    <td>
    <input type="submit" value="Login »" class="submit"></form></td>
  </tr>



  <tr><td colspan="2" class="genericside"><span class="t11bw">Forgotten your password?</span></td>
  </tr>
  <tr valign="top"> 
    <td class="alignright">
    <form name="passwordreminder" action="/member_login.php" method="post">
    <input type="hidden" name="type" value="passwordreminder">
    Please enter your email here:</td>

<td><input type="text" name="reminderemail" class="field" maxlength="50"><br>
<input type="submit" value="Send Password »" class="submit">
    </form>  

 

[timmy0320]

Ahh.. I think I see why it's just 'refreshing' now. Try this:

 

<?php
include("adminconnect.php");

$tbl_name = "adminusers";

if(isset($_POST['uname']) && isset($_POST['pword'])) {
// Define $myusername and $mypassword
$uname  = mysql_escape_string($_POST['uname']);
$pword  = mysql_escape_string($_POST['pword']);


$sql    = "SELECT * FROM $tbl_name WHERE username='$uname' and password='$pword'";
$result = mysql_query($sql);

// Mysql_num_row is counting table row
$count = mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

        /* grab the usertype */
        $r = mysql_fetch_array($result);

        /****
        /* We will verify that the num_rows exists, for some reason you weren'y verifying this
        /* After verifying, we will then set the session, this is assuming that there is a column
        /* in your table named 'type' and its value is either '1' or '2'
        /****/
        if ($count > 0) {
               $_SESSION['usertype'] = $r['usertype'];
               $logged = true;
        } else {
               echo "Wrong Username/Pad =ssword.";
        }

        if ($_SESSION['usertype'] == "2" && $logged == "true") {
            header("Location: ../Admin_files/start.php");
        } elseif ($_SESSION['usertype'] == "1" && $logged == "true") {
            header("Location: ../MainPage/first.php");
        }

/* The form has not yet been submitted. */
} else {
?>
      <form action="login.php" method="POST">
      <div align="right">Pleas enter your Login Name</b>

<BR>(This is the name you signed up with)</div>
    </td>
    <td width="50%">
      <input type="text" name="uname" size="12" maxlength="50" class="field">
    </td>
  </tr>
  <tr>
    <td class="bgrl">
      <div align="right">Please enter your <b>password</b></div>

    </td>
    <td width="50%" class="bgrl">
      <input type="password" name="pword" size="18" class="field">
    </td>
  </tr>
  <tr><td> </td>
    <td>
    <input type="submit" value="Login »" class="submit"></form></td>
  </tr>



  <tr><td colspan="2" class="genericside"><span class="t11bw">Forgotten your password?</span></td>
  </tr>
  <tr valign="top">
    <td class="alignright">
    <form name="passwordreminder" action="/member_login.php" method="post">
    <input type="hidden" name="type" value="passwordreminder">
    Please enter your email here:</td>

<td><input type="text" name="reminderemail" class="field" maxlength="50"><br>
<input type="submit" value="Send Password »" class="submit">
    </form>

<td><input type="text" name="reminderemail" class="field" maxlength="50"><br>
<input type="submit" value="Send Password »" class="submit">
    </form>
<?php
}
?>

[mikebyrne]

No that still brings up the error

 

 

Warning: Cannot modify header information - headers already sent by (output started at C:\xampp\htdocs\MainPage\login.php:5) in C:\xampp\htdocs\MainPage\login.php on line 301

 

Plus my form doesnt appear

 

again line303 is: header("Location: ../MainPage/first.php");

 

The start of first.php

 

<?PHP

if (isset($_SESSION['usertype']) && $_SESSION['usertype'] == 1) {
   echo "You're logged in";
} else {
   echo "You must be logged in";
}
?>