Admin authentication?

[Anon]

How would I go about checking a DB for a username and password to allow people into the admin section?
this is what I have but it obviously doesn't work, I'm new to this so please bear with me
function confirm() {
global $result, $username_form, $password_form;
?>
<form action="Admin.php" method="post">
<input type=hidden name=op value=access>
<table align="center" width="100%" cellpadding="3" cellspacing="1" bgcolor="#000000">
<tr bgcolor="#c0c0c0">
<td>User Name:</td>
<td>Password:</td>
</tr>
<tr bgcolor="#c0c0c0">
<td><input type="text" name="username_form" size=20 maxlength=20></td>
<td><input type="text" name="password_form" size=20 maxlength=20></td>
</tr>
<tr bgcolor="#c0c0c0">
<td><input type="Reset"></td>
<td><input type="submit"></td>
</tr>
</table>
<?
}
function access() {
global $result, $username_form, $password_form;
if($myrow = mysql_fetch_array($result)) {
do {
if ($username_form = $myrow["username"]) {
Header("Location: Admin.php");
} else {
Header("Location: Admin.php?op=language");
}
} while($myrow = mysql_fetch_array($result));
}
}
switch ($op) {
case "":
confirm();
break;
case "access":
access();
break;
}

[Anon]

Well, your logic is more or less correct, you check the database, to see whether it has an entry for this user. But there are some points to make:

1. U dont have to have a loop, since the user must be unique.

2. U better register a session, when the details entered are correct, because some more or less smart people will be able to pass your password page with no difficulty at all.

3. If I were u, i'd keep the actual PHP script that accesses the database and does the redirection in a separate file, to whiche the form will POST its contents, call it something like login.php and do soemthing like

<?
include("dbconnect.inc.php");

$sql = "SELECT id FROM table WHERE username = '$user_name' AND userpass = password('$user_pass')";
$t = mysql_query($sql);
if($resultset=mysql_fetch_array($t)){
session_start("admin");
$username = 'admin'
session_register('username');
header("Location: becool.php");
}else{
header("Location: $HTTP_REFERER");
}
?>

[jeremy_brooks]

Try <a href='http://www.hotscripts.com/Detailed/4219.html'>php_mini_auth</a>
for MySQL auths...even if you don't use it, it is a good model for this type of thing...

[Anon]

thanks!
works perfect now

[Anon]

can you tell me what this part means though?

session_start("admin");
$username = 'admin';
session_register('username');

[dolce]

Null problemo, registering a simple Session Variable, which u can check on ALL the admin pages for validity, if it is there, then it is the admin, who is browsing the pages, if it is not valid, redirect to the login screen:

<?
session_start("admin");
if($username!='admin'){
header("Location: Loginpage.php");
}
?>

[Anon]

now I just get redirected to the login page no matter what. THis is from the login page:

function access() {
global $username_form, $password_form, $username;
$result = mysql_query("SELECT id FROM admins WHERE username = '$username_form' AND password = '$password_form'") or die ("Invalid");
if($resultset = mysql_fetch_array($result)) {
session_start("admin");
$username = 'admin';
session_register('username');
Header("Location: Admin.php?op=language");
} else {
Header("Location: Admin.php");
}
}

and on one of the admin pages:

function admincheck() {
global $username;
if ($username != 'admin'){
Header("Location: Admin.php");
}
}
now, any page that I call that function on just redirects to the main page