blah blah blah

Mark

I need a good AUTH/LOGIN/MEMBERS script 🙁😕

and i'm still to stupid to write one, if anyone could help plz, that would be awesome :-p

i use MySQL for a database, IIS 5.0, win 2k pro, PHP 4 of coarse( in ISAPI, not the CGI executable).. just changed that today 🙂 hehe.

cahva

Here goes one...

First, create the login page. A form with user and password. Put the forms action to 'check.php' for example.

In check.php you basically need to do this:

<?php
session_start();
$sessid=session_id();

if ($_session['userid'])
{
header("Location: http://www.dot.com/main.php");
}

if ($_POST['submit'] && $_POST['user'] && $_POST['passwd']) {

$conn=mysql_connect("localhost","dbuser","dbpasswd");
mysql_select_db("yourdb",$conn);

$test = mysql_result(mysql_query("SELECT COUNT(*) FROM users WHERE user='".$_POST['user']."' AND passwd='".$_POST['passwd']."'"),0);

if ($test == 1) {                			
                $userid= mysql_result(mysql_query("SELECT id FROM users WHERE user='".$_POST['user']."' AND passwd='".$_POST['passwd']."'"),0);

$_SESSION['userid'] = $userid;
header( "http://www.dot.com/main.php");

} 
else 
{
mysql_close($conn);
session_destroy();

echo '<html>
<head>
<title>Login failed!</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

<body>
Invalid login. Blabla bla try again <a href="login.htm">here</a>
</body>
</html>';
}
?>

To make things simple, make couple of files that you can include in your pages: session_init.php and session_check.php

session_init.php

<?php
session_start();

if (!$_SESSION['userid'])
{ session_destroy(); }

?>

session_check.php

if (!$_SESSION['userid'])
{
header("Location:http://www.dot.com/login.php");
}

The idea behind those files are:
Include session_init.php in every page.
Include session_check to the pages that are only for logged users.

If you want your pages to show to everyone but for example want to show some links in that page to only logged users, dont include session_check.php.
Just use if sentences in your page like: if ($_SESSION['userid']) { ... }

Ok, that should get you started. Right?

lukemedway

Exactly what database fields would be needed for this code? If at all. Because I have been attempting to make a login with sessions, but so far nobody has even tried to help me. 🙁

I have never really understood login scripts and how they work, but just looking at your code I think I have a pretty good idea how. I just need to know whats what.

Also, can anyone tell me exactly what the count all is for and the 0 at the end of the query?

cahva

Basicly you need table with only 3 fields: id, user, passwd. If you want, you can create new fields such as address,email etc.

CREATE TABLE users (
id INT( 8 ) NOT NULL AUTO_INCREMENT PRIMARY KEY ,
user VARCHAR( 255 ) NOT NULL ,
passwd CHAR( 16 ) NOT NULL
);

lukemedway

Thanks ever so much, you would not believe how long I have been trying to do this without success. I'm going to try all this now and see what happens. Thanks again. 😃

P.S. How will I add the encryption from the login page, if I were to use char(32) or md5 encryption?

cahva

I thought you may ask that. Ok, change the field 'passwd' to CHAR(32).

Edit the check.php what I gave you like this.

...
$test = mysql_result(mysql_query("SELECT COUNT(*) FROM users WHERE user='".$_POST['user']."' AND passwd=MD5('".$_POST['passwd']."')"),0);

if ($test == 1) {                            

                $userid= mysql_result(mysql_query("SELECT id FROM users WHERE user='".$_POST['user']."' AND passwd=MD5('".$_POST['passwd']."')"),0);
...

And when you are inserting new users, the query should go like this:

example:
INSERT INTO users (user,passwd) VALUES ('test',MD5('test'))

So basicly you allways use MD5('something') when you fetch or insert into table.

lukemedway

Ok thanks, I think I shall be adding the members statically. Unless I can find out a way I can have privilages amoung members. I.E. Site Admin, Members, standard members.

Mark

thanks cahva!😃 but how do i allow them to register a name to the database? i have the login form and all that stuff you told me to do, done. but cant really use it if they cant register 🙁 did i miss something?

<table width="100" cellspacing="0" cellpadding="0" border="0">
<tr>
    <td>
	<form action="/login/login.php">
	<input type="text" name="user">
	</td>
</tr>
<tr>
    <td>
	<input type="text" name="password">
	</td>
</tr>
<tr>
    <td align="right">
	<input type="submit" value="Login">
	</form>
	</td>
</tr>
</table>

cahva

Yeah, you did miss something. In <form> you didnt put method as post. It sends it default by get.

You've put your forms action to itself. Change that to send it to check.php.

<input type="text" name="password"> should be changed to
<input type="password" name="passwd"> because in check.php it looks for $POST['passwd'] not $POST['password']. And ofcourse the type is password not text. So that when users login, their password doesnt show to a guy whos sneaking behind him. 🙂

And add name to submit button because in check.php it checks that the submit button was pressed.

Heres the correct form:

<table width="100" cellspacing="0" cellpadding="0" border="0">
<tr>
    <td>
	<form action="/login/check.php" method="post">
	<input type="text" name="user">
	</td>
</tr>
<tr>
    <td>
	<input type="password" name="passwd">
	</td>
</tr>
<tr>
    <td align="right">
	<input type="submit" name="submit" value="Login">
	</form>
	</td>
</tr>
</table>

Ofcourse you have to put the register form somewhere in your pages. So add a link to some page where it doesnt need a logged user to see the page. Your mainpage perhaps?

Ofcourse, in your register form you ask for the name and the password and check if username exists allready. If it does, then print the form again with info like "Username taken, please use a different one."

If the form is valid, then add the user to DB.

Mark

ya, after i posted that i saw that you named password passwd, and changed it 🙂 but i didnt notice i put login.php in the action oops 😃 . i'll try to get the registration thing but i'm not sure i know how. thanks for the help.

also, after i corrected the problems, i get this message...

Parse error: parse error, unexpected $ in C:\Documents and Settings\Mark\Desktop\My Web Sites\biohazard\login\check.php on line 41
PHP Parse error: parse error, unexpected $ in C:\Documents and Settings\Mark\Desktop\My Web Sites\biohazard\login\check.php on line 41

butttt.. theres not even a line 41.🙁

cahva

Ooopss! 🙂 I didnt test the code I sent and there IS a parse error. I somehow forget brace for the submit. Add these in the end of check.php:

}
header("Location: http://www.yoursite.com");

I added that header also to the end bcos if the "if ($_POST['submit'])" fails, it redirects to some other page. This happens when someone tries to load the page directly, so it doesnt show an empty page..

Mark

So this is right? right?

<?php
session_start();
$sessid=session_id();

if ($_session['userid'])
{
header("Location: [url]http://4.65.32.70/login/index.php[/url]");
}

if ($_POST['submit'] && $_POST['user'] && $_POST['passwd']) {

$conn=mysql_connect("localhost","l3lade","c6h12o6");
mysql_select_db("biohazard_login",$conn);

$test = mysql_result(mysql_query("SELECT COUNT(*) FROM users WHERE user='".$_POST['user']."' AND passwd='".$_POST['passwd']."'"),0);

if ($test == 1) {                            

                $userid= mysql_result(mysql_query("SELECT id FROM users WHERE user='".$_POST['user']."' AND passwd='".$_POST['passwd']."'"),0);

$_SESSION['userid'] = $userid;
header( "http://4.65.32.70/index.php");

} 
else 
{
mysql_close($conn);
session_destroy();

echo "<html>
<head>
<title>Login failed!</title>
<meta http-equiv=\"Content-Type\" content=\"text/html; charset=iso-8859-1\">
</head>

<body>
Invalid login. Try again <a href=\"/login/login.php\">here</a>
</body>
</html>";
} 
header("Location: [url]http://4.65.32.70/[/url]");
}
?>

[/SIZE]
also when i click login i get this.... :

Warning: open(/tmp\sess_a9bf6c12588cad2e5aee0e704f18e616, O_RDWR) failed: No such file or directory (2) in C:\Documents and Settings\Mark\Desktop\My Web Sites\biohazard\login\check.php on line 2

Warning: open(/tmp\sess_a9bf6c12588cad2e5aee0e704f18e616, O_RDWR) failed: No such file or directory (2) in Unknown on line 0

Warning: Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/tmp) in Unknown on line 0
PHP Warning: open(/tmp\sess_a9bf6c12588cad2e5aee0e704f18e616, O_RDWR) failed: No such file or directory (2) in C:\Documents and Settings\Mark\Desktop\My Web Sites\biohazard\login\check.php on line 2 PHP Warning: open(/tmp\sess_a9bf6c12588cad2e5aee0e704f18e616, O_RDWR) failed: No such file or directory (2) in Unknown on line 0 PHP Warning: Failed to write session data (files). Please verify that the current setting of session.save_path is correct (/tmp) in Unknown on line 0

also, how do i creat a table, i have a script that will add to a database, but it doesnt include creating the table.. helpppp meee plz 🙂:

<? 
$db = mysql_connect("localhost","*****","*******"); 

mysql_select_db (biohazard_login); 
$result = mysql_query ("INSERT INTO biohazard_login (username, passwd, firstname, lastname, email, age, homepage, imservicename, aim, yahoo, icq) 
                VALUES ('$username', '$passwd', '$firstname', '$lastname', '$email', '$age', '$homepage', '$imservicename', '$aim', '$yahoo', '$icq')"); 
if(!$result) 
{ 
   echo "<b>There was a problem!</b> ", mysql_error(); 
   exit; 
} 
if($result) 
    { 
    mysql_close($db); 
    print "Thank you for registering with Biohazard! you may now login!"; 
    } 
?>

Mark

woot, i got the registration part done and it works, so thats done, but when i try to log in it gives me that error i posted before, 🙁 any idea why?

Mark

🙁

cahva

Sorry... Couldnt answer you bcos I was ill and I dont have Inet-connection at home 🙁

Anyway, I think you have something wrong in your php.ini file. Maybe the line where it says where to save session files?

I allready put the table create but here goes again:

CREATE TABLE users (
id INT( 8 ) NOT NULL AUTO_INCREMENT PRIMARY KEY ,
user VARCHAR( 255 ) NOT NULL ,
passwd CHAR( 32 ) NOT NULL ,
firstname VARCHAR( 255 ) NOT NULL ,
lastname VARCHAR( 255 ) NOT NULL ,
... ( And so on..)
);

I advise you to use phpMyAdmin if you arent using it allready. Its so simple to use and adding tables is a childs play with it (It gives you graphical interface to manage your D😎.

So, you should be ready to go. Check your php.ini and set the correct folder to save things.

Mark

session.save_path = /tmp

thats where its trying to save it, is that correct, or need to be corrected?

cahva

I dont know... If you have a windows-server, could it be something like C:\tmp? But I dont know, I have only set up once apache and php on windows machine, so Im no expert on this issue. But I think it could work, seeing the error(Warning: open(/tmp\sess...)

jabba_29

Does the /tmp directory actually exist.
When I created something similar, I actually had to create the directory, and change permissions 😉

Jamie

lukemedway

Why not just save the sessions in a database then, after the user logs out delete it, or when they log back in again.

However, using this script, I have noticed a few bugs in which I managed to fix 1 of them, but can't seem to figure the other one out.

1 bug is that if you type a wrong username AND password, it will return a blank page, because there is no statement for it. So above the else, put the else statement in side the end and the beggining of the braces.

$_SESSION['id'] = $userid; 
header(Location:$_SERVER['DOCUMENT_ROOT']."/test.php?userid={$userid}");

}

session_destroy();
echo "Invalid username/password";
include("login.php");

} else {

session_destroy();
echo "Invalid username/password";
include("login.php");

}

Anyway, it's something along those lines. However, I found that to enter a page that is supposed to be protected...

<?php if (!$_SESSION['id']) {
echo "<font color=\"red\">Please Login to view this page</font><br><br>";
include("http://www.devjunkie.co.uk/~djclan/DJ2/test_site/main.php");
} else {
echo "The realm is yours to keep, until you logout anyway, your username is $UName";
echo "<br><br>Go here to return to the main site. <a href=\"site.php?sessid={$sessid}&UName={$UName}&userid={$userid}\">Main Site</a>";
}
?>

You can trick it, by entering the userid in the URL query string and gain access to the restricted area. Any way to stop this from happening?

cahva

Quite simple 'bug'. You have register_globals turned on. Turn them off. Read about sessions and register_globals from php-manual.