Authentication

[Ivains]

I am trying to write my first login script. I would appreciate any guidance. My table is setup as follows:

Users

id
fname
lname
dept
username
password
rights

What I want it to do is if the person login and his/her rights is USER once he authenticates he will be taken to the user folder.

Or rights is ADMIN then they will be taken to the admin folder.

If they are not in the db they will be taken back to login with a msg stating to contact the administrator.

Here's my authuser.php:

include("config.inc");

$db_name = "$dbase";
$table_name = "$tbl";

$connection = @mysql_connect("$host", "$dbuser", "$dbpass") or
die("Couldn't connect.");

$db = @mysql_select_db($db_name, $connection) or die("Couldn't select
database.");

$sql = "SELECT * FROM $table_name WHERE username = \"$username\" AND password = password(\"$password\")";

$result = @($sql, $connection) or die("Couldn't execute query.");

$num = mysql_numrows($result);

if ($rights == 'ADMIN') {
header("Location: admin/index.php");
} elseif ($rights == 'USER') {
header("Location: users/index.php");
} else {
echo 'You are not authorized. Please contact the administrator.';
header("Location: index.php");
exit;

Thanks For ANY Help.
}

[Incubator]

$sql = "SELECT * FROM $table_name WHERE username = \"$username\" AND password = password(\"$password\")";

-->
shouldnt those quotes be too much?
$sql = "SELECT * FROM $table_name WHERE username =$username && password=password($password)";

[fac]

I can't help you with coding (too dumb) but why re-invent the wheel, unless it is just to get experience. There are several good authentication scripts you could use out of the box or modify to your needs:

http://www.hotscripts.com/PHP/Scripts_and_Programs/User_Authentication/index.html

I tried a few but due to my limited knowledge there was only one that fit my needs and that I was able to install:

http://freshmeat.net/releases/59225/

Good Luck

[archangel_617b]

I agree with fac, why reinvent the wheel? Well, because it's fun and a good learning exercise. Your quoting on the sql queries is correct (Incubator, string must be quoted within an SQL query).

If you want to display a message on a different page (this is the problem, correct?), you must pass it in the URL (shown below), store it in a cookie, or store it in a session.

// login page
header('Location: index.php?msg='.urlencode('Your login has failed because you are an un-authorized nutmunch!<br />'));

// index page
<!-- This is some stuff on your page -->
if ($msg) 
    print($msg);
<!-- This is some more stuff on your page -->

Does this help you?

[TheReverend]

I found a good (and easy) authentication script right here on PHPBuilder.net in the code snippets section. It's the one they use here on the web site. It's easy to integrate and customize:

http://www.phpbuilder.net/snippet/download.php?type=snippet&id=1223

Check it out ;-D!