password check with frames.

[Anon]

I have created a login page that redirects the user to a page with frames, if the user uses the right username and password.
On the frames page I check the variables with the code:

<?php
require("../include/logincheck.inc");
session_start();
?>

The logincheck.inc calls the mysqldb and verifies the variables.
The check works just fine on the frames page, but how can I check the variables on the pages that the frame page contains of?

-Mattias

[jesus_hairdo]

firstly your session_start should be the first line of the file. does the logincheck register anything in the session?
The best thing to do is to register a session variable something like $valid_user = $username if the user has successfuly logged in. then on your protected pages, just do ,
if (session_is_registered("valid_user"))
{
//user has access so show page
}
else
{
//sorry not authorised to view
}

the session_is_registered just checks to see if the variable $vaild_user is registered in the session.

Jamie

[Anon]

Should I have the session_start before I do the logincheck?
The logincheck registers a $username variable and a $passw variable.

The problem I am having is to protect the pages that the frames page is made up from. The frames page itself is no problem to do the check on, but if I try your check code on the top frame it doesn't seem to find the variables.
How do I do to have a password check on the top frame page?

[jesus_hairdo]

Just noticed that i forgot the start_session();
this needs to be in every page that needs to access session variables. Try this if not,
can you post the include file. and i'll take a look.

[Anon]

I Understood that the start_session(); should be included on the page.
Here is the include file:

<?php
if(IsSet($a_username))
$username = $a_username;
if(IsSet($a_password))
$password = $a_password;

$connection = mysql_connect("localhost", "user", "password") or die ("Gick ej att ansluta till server"); 
$db = mysql_select_db("setdelight", $connection) or die("Couldn't execute query");
$result = mysql_query("SELECT 1 FROM adminusers where username ='$username' and password = '$password'", $connection) or die("Här blev det galet!"); 
$num_rows = mysql_num_rows($result); 

if(!$num_rows)
Header("Location:http://localhost/login1.php");

?>

The strange thing is that when I try to echo $username; on the page, it prints the right username but it still acts like there is no session registered.

[Anon]

Just realized that I don't register the $username as a session variable anywhere.

Stupid!

[Anon]

Everything works just great now!
Thanks a million Jamie for helping me to open my eyes.

[jesus_hairdo]

no problems,often it just needs someone else to ask some questions before you see the problem yourself.

Jamie