A Multi User Experience!

Ham

OK, I have posted a simular question in other post I had but it didn't match my topic and wasn't very detailed. I would like some help with the following:

I have a web site (my first PHP one) that I designed for myself to allow me to catalog my DVD and Video Game collection. I can update records in case someone borrows a disc or I trade it in. I have set up a user signup area as well as a login in/out.

I used two tutorials to help me make it this far:
Login Tutorial
Adding and Editing Database Data

I am wondering what it would take to all other people to sign up and catalog their dvd's and games. I mean, I already have the sign up form working and a table in my database for users. But how do I take my PHP scripts and make them so they know which users data to display (so my movies are shown in someone elses collection).

I have two tables in my database which are as follows:

TABLE users

id
username
password
email
city
state

TABLE discs

discid
title
system
rating
discs (how many per movie/game)
loaned

My PHP for the data display page is as such:

<?php

require('/home/public_html/db_connect.php');

// require our database connection
// which also contains the check_login.php
// script. We have $logged_in for use.

if($logged_in == 0) {
	header("Location: /dvd_view.php");
}

// show content
$db_object->disconnect();
// when you are done.
?>

<?php include("/home/public_html/header.php"); ?>

<table width="725" border="0" cellspacing="0" cellpadding="0" align="center">
<tr> 
 <td><img src="/images/title_dvd.gif" width="725" height="50"></td>
</tr>

<tr> 
<td> 

<table width="725" border="0" cellspacing="1" cellpadding="2" bgcolor="#000000">
<tr bgcolor="#333333"> 
<td width="334"><b>GAME TITLE</b></td>
<td width="75"> 
<div align="center"><b>RATING</b></div>
</td>
<td width="95"> 
<div align="center"><b># OF DISCS</b></div>
</td>
<td width="115"> 
<div align="center"><b>BORROWED</b></div>
</td>
<td width="80"> 
<div align="center"><b>DELETE</b></div>
</td>
</table>

<table width="725" border="0" cellspacing="0" cellpadding="0" align="center">
<tr>
<td>

<?php

$db = mysql_connect("localhost", "username", "password");
mysql_select_db("database_name",$db);

if ($submit) {

// here if no ID then adding else we're editing
if ($discid) {

$sql = "UPDATE discs SET system='$system',title='$title',rating='$rating',discs='$discs',loaned='$loaned' WHERE discid=$discid";
} else {

$sql = "INSERT INTO discs (system,title,rating,discs,loaned) VALUES ('$system','$title','$rating','$discs','$loaned')";
}

// run SQL against the DB
$result = mysql_query($sql);
echo "Record updated/edited!<p>";

} elseif ($delete) {

// delete a record
$sql = "DELETE FROM discs WHERE discid=$discid";	
$result = mysql_query($sql);

echo "$sql Record deleted!<p>";

} else {

// this part happens if we don't press submit
if (!$discid) {

// print the list if there is not editing
// $result = mysql_query("SELECT * FROM discs",$db);
$result = mysql_query("SELECT discid, title, rating, discs, loaned FROM discs WHERE system = 'DVD' ORDER BY title",$db);

while ($myrow = mysql_fetch_array($result)) {

echo "<table width=725 border=0 cellspacing=1 cellpadding=2 bgcolor=#000000>";
echo "<tr bgcolor=#222222>"; 
echo "<td width=334><a href=\"{$_SERVER['PHP_SELF']}?discid={$myrow['discid']}\">{$myrow['title']}</td>";
echo "<td width=75><div align=center>{$myrow['rating']}</div></td>";
echo "<td width=95><div align=center>{$myrow['discs']}</div></td>";
echo "<td width=115><div align=center>{$myrow['loaned']}</div></td>";
echo "<td width=80>";
printf("<div align=center><a href=\"%s?discid=%s&delete=yes\">DELETE</a></div>", $PHP_SELF, $myrow["discid"]);
echo "</td>";
echo "</tr>";
echo "</table>";

}
}
?>

  <form method="post" action="<?php echo $PHP_SELF?>">

<?php
if ($discid) {

// editing so select a record
$sql = "SELECT * FROM discs WHERE discid=$discid";
$result = mysql_query($sql);
$myrow = mysql_fetch_array($result);
$discid = $myrow["discid"];
$system = $myrow["system"];
$title = $myrow["title"];
$rating = $myrow["rating"];
$discs = $myrow["discs"];
$loaned = $myrow["loaned"];

// print the discid for editing

?>

<input type=hidden name="discid" value="<?php echo $discid ?>">
<?php
}
?>
              <br><br>
              <table width="327" border="0" cellspacing="0" cellpadding="0" align="center" bgcolor="BDBDBD">
                <tr>
                  <td><img src="/images/spacer.gif" width="327" height="1"></td>
                </tr>
                <tr>
                  <td>
                    <table width="325" border="0" cellspacing="0" cellpadding="2" align="center" bgcolor="343434">
                      <tr> 
                        <td width="125">System:</td>
                        <td width="200"> 
                          <input type="Text" name="system" value="DVD">
                        </td>
                      </tr>
                      <tr> 
                        <td width="125">Title:</td>
                        <td width="200"> 
                          <input type="Text" name="title" value="<?php echo $title ?>">
                        </td>
                      </tr>
                      <tr> 
                        <td width="125"> Disc Rating:</td>
                        <td width="200"> 
                          <input type="Text" name="rating" value="<?php echo $rating ?>">
                        </td>
                      </tr>
                      <tr> 
                        <td width="125"># Of Discs:</td>
                        <td width="200"> 
                          <input type="Text" name="discs" value="<?php echo $discs ?>">
                        </td>
                      </tr>
                      <tr> 
                        <td width="125">On Loan:</td>
                        <td width="200"> 
                          <input type="Text" name="loaned" value="<?php echo $loaned ?>">
                        </td>
                      </tr>
                      <tr> 
                        <td width="125">&nbsp;</td>
                        <td width="200">&nbsp;</td>
                      </tr>
                      <tr> 
                        <td colspan="2"> 
                          <div align="center">
                            <input type="Submit" name="submit" value="Enter information">
                          </div>
                        </td>
                      </tr>
                    </table>
                  </td>
                </tr>
                <tr>
                  <td><img src="/images/spacer.gif" width="327" height="1"></td>
                </tr>
              </table>
            </form>

<?php
}
?>

</td>
</tr>
</table>

</td>
</tr>
</table>

<?php include("/home/public_html/footer.php"); ?>

If you want to help me out and need any other information from me, please let me know! Thanks in advance!

raymie

To make your database multiuser compatible you would need to add in the username (or id) field from the user table into the other one and only allow a user to see values which contain his key.

You must also make sure that you check this in all updates and deletes incase a user tinkers with any form data and bypasses your checks.

Ham

so can you give me some help or pointers with the coding for this and what fields I need to add to which database listed above?

Thanks

raymie

I am happy to help but I think it should be taken a stage at a time, there is too much to cover in one or two replies probably.

(Appologies if you have any of this covered already).

Stage 1:

Login. You mention that you have a user login function. How did you get that to work. Ideally I am hoping that you have used sessions and are storing the username in a session variable.

If you are not storing the value in a session variable then I assume you are using a cookie which would mean that only people who allow cookies could use your site. I would strongly suggest moving to session arrays.

The idea is that EVERY page on your site (except the login page) should check that the user is logged in and if not redirect them back to the login page. This is to ensure that they cannot go directly to a page without having verified their details.

Once you have that in place each page should have access to the username. This being the case each table should have the username on it as a primary key.

For example your code contains the query

$result = mysql_query("SELECT discid, title, rating, discs, loaned FROM discs WHERE system = 'DVD' ORDER BY title",$db);

That is fine for a single user system but totally incorrect for a multi user one.

$result = mysql_query("SELECT discid, title, rating, discs, loaned FROM discs WHERE system = 'DVD' AND username = '".$_SESSION['username']."' ORDER BY title",$db);

would be one possible change needed to allow it to work as a multiuser system. You will note that the username has been added onto the discs table and checked for the select.

That is the basic change you need to make. What is vital however is that you ALWAYS check the username when accessing data including the updates to prevent anyone from tinkering with your page and amneding some other users data.

Let me know how you get on with the above and then we will take it from there with any other outstanding issues.

Ham

Sorry for the delay... I had to go out of town to attend a funeral yesterday. I am back now and going to once again attempt to get this to work!

As for my login, I AM using Sessions to track the user. As for how I got it to work, I used the tutorial FOUND HERE

This is the check_login.php that the tutorial used:

<?php

/* check login script, included in db_connect.php. */

session_start();

if(!isset($_SESSION['username']) | !isset($_SESSION['password'])) {
	$logged_in = 0;
	return;
}
else {
// remember, $_SESSION['password'] will be encrypted.

if(!get_magic_quotes_gpc()) {
	$_SESSION['username'] = addslashes($_SESSION['username']);
}

// addslashes to session username before using in a query.

$pass = $db_object->query("SELECT password FROM 
users WHERE username = '".$_SESSION['username']."'");

if(DB::isError($pass)) {
	$logged_in = 0;
	unset($_SESSION['username']);
	unset($_SESSION['password']);
// kill incorrect session variables.
}

$db_pass = $pass->fetchRow();

// now we have encrypted pass from DB in 
//$db_pass['password'], stripslashes() just incase:

$db_pass['password'] = stripslashes($db_pass['password']);

$_SESSION['password'] = stripslashes($_SESSION['password']);

//compare:

if($_SESSION['password'] == $db_pass['password']) { 
	// valid password for username
	$logged_in = 1; // they have correct info
					// in session variables.
}

else {
	$logged_in = 0;
	unset($_SESSION['username']);
	unset($_SESSION['password']);
	// kill incorrect session variables.
}
}
// clean up

unset($db_pass['password']);
$_SESSION['username'] = stripslashes($_SESSION['username']);

?>

In the pages that you must be logged in to view I have this code. If they are not logged in it directs them to a page where they can only view my entries instead of edit them. However I could just redirect them to the signup/login area.

<?php

require('/home/public_html/db_connect.php');

// require our database connection
// which also contains the check_login.php
// script. We have $logged_in for use.

if($logged_in == 0) {
	header("Location: /dvd_view.php");
}

// show content
$db_object->disconnect();
// when you are done.
?>

As far as what you said I should change my $result = mysql_query too, I don't understand something. Do I need to add a 'username' column to my 'discs' table or does it pull the username variable from my 'users' table. Do I need to make a primary key value somewhere in my tables?

I understood everything up until that point 😃

raymie

Do I need to add a 'username' column to my 'discs' table

Yes. All data to be shown must be able to be related to a specific user, and so you need a field on the table for that and username is perhaps the most handy one.

Ham

So in the HTML form that you fill out to add a disc to your collection, I need to add a field for the person to enter their username? Or will this be filled in automatically once they are signed in?

In my 'users' table I have it automatically assign an 'id'... can this id number be used instead of adding a 'username' column to the 'discs' table... or am I making it more complicated now?

Thanks again for the help.

raymie

Obviously you are not understanding what I am trying to say, hopefully someone else will be able to explain it clearer for you.

For every item of data pertaining to a specific user you need to be able to identify that user, it does not matter what key you use to do that but it must be unique to that user and unchangeable.

THE LAST THING you want to do is add the username to any forms. If you do not populate the user information directly from the information given when the user logged in (and passes via session variable or cookies) then your system in inherently insecure and anyone could access anyone elses information simply by editing the form.

raymie

BTW:

I have not checked out the login tutorial you mentioned but if your code example of a secure page is representative of it then you have a major problem.

Your code relies on checking the variable $logged_in, it does not check how this variable is passed and so anyone just needs to tag on ?logged_in=1 onto the end of any url and the system will allow them onto the page.

rather than using this you should probably change it to use $_SESSION['logged_in'] so that you exclude the possibility of the variable being set via GET or POST methods.