How about something like this:
login.php:
<?PHP
//check that the user is calling the page from the login form and not accessing it directly
//and redirect back to the login form if necessary
if (!isset($username) || !isset($password)) {
header( "Location: http://www.yourdomain/login.htm" );
}
//check that the form fields are not empty, and redirect back to the login page if they are
elseif (empty($loginName) || empty($loginPass)) {
header( "Location: http://www.yourdomain.com/login.htm" );
}
else{
//convert the field values to simple variables
//add slashes to the username and md5() the password
$user = addslashes($POST['username']);
$pass = md5($POST['password']);
//set the database connection variables
$dbHost = "localhost";
$dbUser = "yourUsername";
$dbPass = "YourPassword";
$dbDatabase = "yourDB";
//connet to the database
$db = mysql_connect("$dbHost", "$dbUser", "$dbPass") or die ("Error connecting to database.");
mysql_select_db("$dbDatabase", $db) or die ("Couldn't select the database.");
$result=mysql_query("select * from users where username='$user' AND password='$pass'", $db);
//check that at least one row was returned
$rowCheck = mysql_num_rows($result);
if($rowCheck > 0){
while($row = mysql_fetch_array($result)){
//start the session and register a variable
session_start();
session_register('username');
//successful login code will go here...
echo 'Success!';
//we will redirect the user to another page where we will make sure they're logged in
header( "Location: checkLogin.php" );
}
}
else {
//if nothing is returned by the query, unsuccessful login code goes here...
echo 'Incorrect login name or password. Please try again.';
}
}
?>
How to use the session:
checkLogin.php:
<?php
//start the session
session_start();
//check to make sure the session variable is registered
if(session_is_registered('username')){
//the session variable is registered, the user is allowed to see anything that follows
echo 'Welcome, you are still logged in.';
}
else{
//the session variable isn't registered, send them back to the login page
header( "Location: http://www.yourdomain.com/login.htm" );
}
?>
Just replace all the generic variables with your own.
Hope this helps
