Authorization, And Some Other Thing :S

[tuf-web_co_uk]

right, this make take a while to read, but its a simple problem for any expert i think. (go to toilet if u need 🙂 )

right i have a page which i make admins use to log in to post messages for my main page bulletin board.
and when they log in it takes you to a page where you can choose what you want to do.
this page has only 1 option, but it'll have more soon.
anyways.......on this page i load the variables from the form on the previous page (user & password)
which i want to load from a database instead of loading from the
page.

here is my coding for the options page so far....

// Check to see if $user and %password contains info

if (!$user | !$password) {

	// If empty, send header causing dialog box to appear

	echo 'Authorization Required';
	exit;

}

// check database to see if the user with pass exists

else if ($user&&$password) {

		if ($user==pass&&$password==user) {
		?>

		<font face=verdana size=1>

		Welcome <? echo "$user"; ?><br><br>

		-- Choose An Action -- <script language="Javascript"><!--

function gotoLink(form) {

var OptionIndex=form.ListBoxURL.selectedIndex;

parent.location = form.ListBoxURL.options[OptionIndex].value;}

//-->

</script>

</form>

<form name="AutoListBox3">


<select name="ListBoxURL" size="1" language="javascript"

onchange="gotoLink(this.form);" class="nav">

<option selected>--[Menu]--</option>

<option value="../newmessage.php">Post A Message</option>

</select>

</div><script language="JavaScript">

<!--

function gotoLink(form) {

var OptionIndex=form.ListBoxURL.selectedIndex;

parent.location = form.ListBoxURL.options[OptionIndex].value;}

//-->

</script>
			<br>
			</font>
			<?
			}

		else if ($user != pass | $password != user) {

		echo "<font face=verdana size=1>";
		echo "Authorization Required<br>";
		echo "Your Not Authorized, Try The Right Password/Username Next Time<br><br>";

		}

}

firstly i want to know how i can load the user name and password from a database
i know how to load them, but not in a way to implement auth!

then i want to store these variables posted, so that when the admin
goes into post a message it requires authorization, from those variables it will unlock the page.
or echo an error message.

my coding for this page so far is

if (!$user | !$password) {

	// If empty, send header causing dialog box to appear

	echo '<font face=verdana size=1>Authorization Required<br><br><Br><br><font size=-10>Hacker :P<Br><Br>';

}

// check database to see if the user with pass exists

else if ($user&&$password) {

		if ($user==pass&&$password==user) {
		?>

<form method="GET" action="submit.php">
    <p align="center"><font face="Verdana" size="2">Who Are You<br>
    <select size="1" name="writer">
    <option selected>-- Person --</option>

<option>Comms</option>
<option>Pager</option>
<option>DOA</option>

</select></font></p>
<p align="center"><font face="Verdana" size="2">Headline<br>
<input type="text" name="headline" size="20"></font></p>
<p align="center"></p>
  <p align="center"><font face="Verdana" size="2">Message<br>
  </font><font size="1" face="Verdana"><textarea rows="13" name="story" cols="35"></textarea></font></p>
  <p align="center"><font face="Verdana" size="2">Your Image Src<br>
  <select size="1" name="user_image">
  <option selected>-- Your Image --</option>
  <option>/images/comms.gif</option>
  <option>/images/pager.gif</option>
  <option>/images/doa.gif</option>
  </select></font></p>
  <p align="center"><font face="Verdana" size="1"><input type="submit" value="Insert"></font></p>
</form>

<?
		}

		else if ($user != pass | $password != user) {

		echo "<font face=verdana size=1>";
		echo "Authorization Required<br>";
		echo "Your Not Authorized, Try The Right Password/Username Next Time<br><br>";

		}

} 

so what i need help with is

• Authentication The Users From A Database

• Storing (And Posting) The Variables (Using Cookies, If So Needs Explaning)

• Using Them In The Message Posting Page To Implement More Authorization

if anyone can do this it would be a great help

as always - thnks in advance 🙂

[stolzyboy]

try this

<?
$conn = mysql_connect("localhost", "username", "password") or die ("Could not connect to database!");
$db = mysql_select_db("database") or die ("Could not select database");
if (isset($signin)) // name of submit button
{
    $query = "select * from table where username='$username' and password=(password('$password'))"; // don't use password() function if you didn't use it to input into the database
    $result = mysql_query($query) or die ("Could not select records");

$isAuth = false; //set to false originally

while($row = mysql_fetch_array($result))
{
    if($row['username'] == $username) // if true set $isAuth to true, if not it will stay false
    {
        $isAuth = true;
    }  
}  

if($isAuth)
{
             echo "username and password successfully";
}
else
{
echo "no username/password found";
}
?>

[tuf-web_co_uk]

that worked great 😃 thanks very much!

but how would i store the sent variables so that my
post message page doesnt require the user to login
again?!

thanks in advance again! 🙂

[stolzyboy]

you will need to use sessions for that one, check out how to use them at php.net

[tuf-web_co_uk]

oh no sessions!

well so far i put the

session_start(); 

tag at the top my my admin_cp panel page.
where the user is sent when trying to log in. and it works fine.

but then i go to the postmessage.php page using the same authorization coding we used for the admin_cp page.
but nothing shows up

<?

include("../includes/header.php");

$conn = mysql_connect("localhost", "username", "password") or die ("Could not connect to database!");
$db = mysql_select_db("theuther_content") or die ("Could not select database");
if (isset($signin)) // name of submit button
{
    $query = "select * from users where username='$username' and password=(password('$password'))"; // don't use password() function if you didn't use it to input into the database
    $result = mysql_query($query) or die ("Could not select records");

$isAuth = false; //set to false originally

while($row = mysql_fetch_array($result))
{
    if($row['username'] == $username) // if true set $isAuth to true, if not it will stay false
    {
        $isAuth = true;
    }  
}  

if($isAuth)
{

?>

<form method="GET" action="submit.php">
    <p align="center"><font face="Verdana" size="2">Who Are You<br>
    <select size="1" name="writer">
    <option selected>-- Person --</option>

<option>Comms</option>
<option>Pager</option>
<option>DOA</option>

</select></font></p>
<p align="center"><font face="Verdana" size="2">Headline<br>
<input type="text" name="headline" size="20"></font></p>
<p align="center"></p>
  <p align="center"><font face="Verdana" size="2">Message<br>
  </font><font size="1" face="Verdana"><textarea rows="13" name="story" cols="35"></textarea></font></p>
  <p align="center"><font face="Verdana" size="2">Your Image Src<br>
  <select size="1" name="user_image">
  <option selected>-- Your Image --</option>
  <option>/images/comms.gif</option>
  <option>/images/pager.gif</option>
  <option>/images/doa.gif</option>
  </select></font></p>
  <p align="center"><font face="Verdana" size="1"><input type="submit" value="Insert"></font></p>
</form>

<?

}
else
{
echo "<font size=1 face=verdana>no username/password found<br><br>";
}	
}

include("../includes/footer.php");

thats the code for my postmessage.php page
also when i tried to end the session on this page just to see if it
had loaded i got an error mesagin saying i was trying to destroy
and unkown session

any more help, would be much aprreciated!!🙂

[stolzyboy]

ok, you will need to use

<?
session_start();
session_register(logged);
?>

on your auth page, then if they are auth'd you need to set the session

$_SESSION['logged'] = 1;

then on your other pages all you need to do is check if the session is alive using

<?
session_start();
?>

at the top of every page you want the session to stay alive, then check if it is registered like

if ($_SESSION['logged']
{
echo out your page
}
else
{
send them to the auth page
}

so you don't need to use the auth code on every page, just the one

[tuf-web_co_uk]

right i think i have this wrong, no error messages appear but there is nothing at all appearing.

heres what i have so far.

page where the admin is sent to when submitted form - here

page where admin posts new message - here

please could you tell me what i am doing wrong cos this doesnt seem to work correctly

thanks again for you so much needed help 🆒

[stolzyboy]

i didn't see anywhere where you used this, you need to put it somewhere on the pages to see if the session is still alive for sure

if ($_SESSION['logged'])
{
echo out your page
}
else
{
send them to the auth page
}

[tuf-web_co_uk]

i thought i did that sorry..

well anyways i put it into my page and this is the code i have now

<?
session_start();
include("../includes/header.php");
if ($_SESSION['logged']) 
{ 
$conn = mysql_connect("localhost", "username", "password") or die ("Could not connect to database!");
$db = mysql_select_db("theuther_content") or die ("Could not select database");
if (isset($signin)) // name of submit button
{
    $query = "select * from users where username='$username' and password=(password('$password'))"; // don't use password() function if you didn't use it to input into the database
    $result = mysql_query($query) or die ("Could not select records");

$isAuth = false; //set to false originally

while($row = mysql_fetch_array($result))
{
    if($row['username'] == $username) // if true set $isAuth to true, if not it will stay false
    {
        $isAuth = true;
    }  
}  

if($isAuth)
{

?>

<form method="POST" action="submit.php">
    <p align="center"><font face="Verdana" size="2">Who Are You<br>
    <select size="1" name="writer">
    <option selected>-- Person --</option>

<option>Comms</option>
<option>Pager</option>
<option>DOA</option>

</select></font></p>
<p align="center"><font face="Verdana" size="2">Headline<br>
<input type="text" name="headline" size="20"></font></p>
<p align="center"></p>
  <p align="center"><font face="Verdana" size="2">Message<br>
  </font><font size="1" face="Verdana"><textarea rows="13" name="story" cols="35"></textarea></font></p>
  <p align="center"><font face="Verdana" size="2">Your Image Src<br>
  <select size="1" name="user_image">
  <option selected>-- Your Image --</option>
  <option>/images/comms.gif</option>
  <option>/images/pager.gif</option>
  <option>/images/doa.gif</option>
  </select></font></p>
  <p align="center"><font face="Verdana" size="1"><input type="submit" value="Insert"></font></p>
</form>

<?

}
else
{
echo "<font size=1 face=verdana>no username/password found<br><br>";
}	
}
} 
else 
{ 
echo "your not authorized, try again<br>";
echo "<a href=admin.php>login</a>"; 
}
include("../includes/footer.php");

?>

this brings up the error message

Warning: Cannot send session cache limiter - headers already sent (output started at /home2/theuther/public_html/admin/newmessage.php:12) in /home2/theuther/public_html/admin/newmessage.php on line 13

have i put the session start in the wrong place?!

[stolzyboy]

<?
session_start();
?>

absolutely has to be the first line of code in your doc, even before any html like

<?
session_start();
?>
<html>.....
.....

....
....
</html>

[tuf-web_co_uk]

yeh thanks that got rid of the error message, but my "post message" page isnt show anything at all
it includes my header and footer file but it doesnt show the form for the messages.

the code is the same as the above just with the session tag at the top

can u please help me, after this one is sorted thats all thats left!

[stolzyboy]

ok i stripped it down a little to make it work on my machine with my databases, all you should have to do is figure out where to put the includes that i took out and it should work just fine, i think you were just if'ing yourself away from the form

<?
session_start();
?>
<html>
<body>
<?
if ($_SESSION['logged']) 
{ 
$conn = mysql_connect("localhost", "user", "pass") or die ("Could not connect to database!");
$db = mysql_select_db("database") or die ("Could not select database");
if (isset($signin)) // name of submit button
{
$query = "select * from table where username = '$username' and password = (password('$password'));";
$result = mysql_query($query) or die ("Could not select records");

$isAuth = false; //set to false originally

while($row = mysql_fetch_array($result))
{
if($row['username'] == $username) // if true set $isAuth to true, if not it will stay false
{
$isAuth = true;
}
else
{
$isAuth = false;
}
}
if($isAuth)
{
?>
this is where the form will be if they are logged in
<?
}
}
else
{
?>
this can be a form that posts to your login.php or just a link to it to login<br>
<form action="login.php" method="post">
Username: <input type="text" name="username"><br>
Password: <input type="text" name="password"><br>
<input type="submit" name="signin">
</form>
<?
}
}
else
{
?>
You must be logged in, this is when the session isn't available.
<?
}
?>
</body>
</html>

[tuf-web_co_uk]

ok thanks it now displays something 😃, but it always
says log in. even though i have!!

here is the code with the includes and my html head

<?
session_start();
?>
<html>

<head>
<meta http-equiv="Content-Language" content="en-gb">
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
<meta name="ProgId" content="FrontPage.Editor.Document">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>Add New Message</title>
</head>

<body bgcolor="#EEEEEE">
<?

include("../includes/header.php");
if ($_SESSION['logged']) 
{ 
$conn = mysql_connect("localhost", "user", "pass") or die ("Could not connect to database!");
$db = mysql_select_db("theuther_content") or die ("Could not select database");
if (isset($signin)) // name of submit button
{
$query = "select * from users where username = '$username' and password = (password('$password'));";
$result = mysql_query($query) or die ("Could not select records");

$isAuth = false; //set to false originally

while($row = mysql_fetch_array($result))
{
if($row['username'] == $username) // if true set $isAuth to true, if not it will stay false
{
$isAuth = true;
}
else
{
$isAuth = false;
}
}
if($isAuth)
{
?>
<form method="POST" action="submit.php">
    <p align="center"><font face="Verdana" size="2">Who Are You<br>
    <select size="1" name="writer">
    <option selected>-- Person --</option>

<option>Comms</option>
<option>Pager</option>
<option>DOA</option>

</select></font></p>
<p align="center"><font face="Verdana" size="2">Headline<br>
<input type="text" name="headline" size="20"></font></p>
<p align="center"></p>
  <p align="center"><font face="Verdana" size="2">Message<br>
  </font><font size="1" face="Verdana"><textarea rows="13" name="story" cols="35"></textarea></font></p>
  <p align="center"><font face="Verdana" size="2">Your Image Src<br>
  <select size="1" name="user_image">
  <option selected>-- Your Image --</option>
  <option>/images/comms.gif</option>
  <option>/images/pager.gif</option>
  <option>/images/doa.gif</option>
  </select></font></p>
  <p align="center"><font face="Verdana" size="1"><input type="submit" value="Insert"></font></p>
</form>
<?
}
}
else
{
?>
<font face="Verdana" size="1"><a href=admin.php>log in</a><br><br>
<?
}
}
else
{
?>
<font face="Verdana" size="1">You must be logged in, so try loggin in!.<br><a href=admin.php>log in</a>
</font></font>
<?
}
include("../includes/footer.php");
?>
</body>
</html>

and like i said i log in and i log in but it doesnt show the form for the admins, it just keeps saying log in!

maybe i havent sent the session right from the page which u get taken to when u submit the form.

is this right?!

<?
session_start();
?>
<? 
session_register(logged); 

include("../includes/header.php");

$conn = mysql_connect("localhost", "user", "pass") or die ("Could not connect to database!");
$db = mysql_select_db("theuther_content") or die ("Could not select database");
if (isset($signin)) // name of submit button
{
    $query = "select * from users where username='$username' and password=(password('$password'))"; // don't use password() function if you didn't use it to input into the database
    $result = mysql_query($query) or die ("Could not select records");

$isAuth = false; //set to false originally

while($row = mysql_fetch_array($result))
{
    if($row['username'] == $username) // if true set $isAuth to true, if not it will stay false
    {
        $isAuth = true;
    }  
}  

if($isAuth)
{
$_SESSION['logged'] = 1;
?>

		<font face=verdana size=1>

		Welcome <? echo "$username"; ?><br><br>

		-- Choose An Action -- <script language="Javascript"><!--

function gotoLink(form) {

var OptionIndex=form.ListBoxURL.selectedIndex;

parent.location = form.ListBoxURL.options[OptionIndex].value;}

//-->

</script>

</form>

<form name="AutoListBox3">


<select name="ListBoxURL" size="1" language="javascript"

onchange="gotoLink(this.form);" class="nav">

<option selected>--[Menu]--</option>

<option value="newmessage.php">Post A Message</option>

</select>

</div><script language="JavaScript">

<!--

function gotoLink(form) {

var OptionIndex=form.ListBoxURL.selectedIndex;

parent.location = form.ListBoxURL.options[OptionIndex].value;}

//-->

</script>
			<br>
			</font>
			<?

}
else
{
echo "<font size=1 face=verdana>no username/password found<br><br>";
}	
}
include("../includes/footer.php");

?>

thanks again for your time and much needed help! 🙂

[stolzyboy]

try this, i rearranged some stuff

<?
session_start();
?>
<html>

<head>
<meta http-equiv="Content-Language" content="en-gb">
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
<meta name="ProgId" content="FrontPage.Editor.Document">
<meta http-equiv="Content-Type" content="text/html; charset=windows-1252">
<title>Add New Message</title>
</head>

<body bgcolor="#EEEEEE">
<?
include("../includes/header.php");
$conn = mysql_connect("localhost", "user", "pass") or die ("Could not connect to database!");
$db = mysql_select_db("database") or die ("Could not select database");
if (isset($signin)) // name of submit button
{
$query = "select * from table where username = '$username' and password = (password('$password'));";
$result = mysql_query($query) or die ("Could not select records");

$isAuth = false; //set to false originally

while($row = mysql_fetch_array($result))
{
if($row['username'] == $username) // if true set $isAuth to true, if not it will stay false
{
$isAuth = true;
}
else
{
$isAuth = false;
}
}
if($isAuth)
{
?>
<form method="POST" action="submit.php">
<p align="center"><font face="Verdana" size="2">Who Are You<br>
<select size="1" name="writer">
<option selected>-- Person --</option>

<option>Comms</option>
<option>Pager</option>
<option>DOA</option>

</select></font></p>
<p align="center"><font face="Verdana" size="2">Headline<br>
<input type="text" name="headline" size="20"></font></p>
<p align="center"></p>

<p align="center"><font face="Verdana" size="2">Message<br>
</font><font size="1" face="Verdana"><textarea rows="13" name="story" cols="35"></textarea></font></p>
<p align="center"><font face="Verdana" size="2">Your Image Src<br>
<select size="1" name="user_image">
<option selected>-- Your Image --</option>
<option>/images/comms.gif</option>
<option>/images/pager.gif</option>
<option>/images/doa.gif</option>
</select></font></p>
<p align="center"><font face="Verdana" size="1"><input type="submit" value="Insert"></font></p>
</form>
<?
}
if ($_SESSION['logged'])
{

}
else
{
?>
<font face="Verdana" size="1"><a href=admin.php>log in</a><br><br>
<?
}
}
else
{
?>
<font face="Verdana" size="1">You must be logged in, so try loggin in!.<br><a href=admin.php>log in</a>
</font></font>
<?
}
include("../includes/footer.php");
?>
</body>
</html>

[tuf-web_co_uk]

now instead of echoing the else statement 2nd from bottom it just echos the last else statement

You must be logged in, so try loggin in!.
log in

damn this is really confusing!

[stolzyboy]

on the page you are logging in from do you have this at the very top

<?
session_start();
session_register("logged");
$logged = true;
?>

this is the quick admin page i made to test this whole thing on my machine

<?
session_start();
session_register("logged");
$logged = true;
?>

<html>
<head>
<title>Untitled</title>
</head>

<body>
<form action="whateveryourmainpageiscalled.php" method="post">
<input type="text" name="username"><br>
<input type="text" name="password"><br>
<input type="submit" name="signin">
</form>

</body>
</html>

[tuf-web_co_uk]

no i didnt, sorry i didnt know i needed it.

well i put it in and still got the problem

[stolzyboy]

can you send me all your code by attaching a zip so i can see all your code, just xxxx out the usernames and passwords

[tuf-web_co_uk]

here you go

if it was in the browser, and someone was going to post a message theywhould go through these pages
in this order

login_page.php > page_after_login.php > message_posting.php

all files in attached zip

thanks again 🙂

[stolzyboy]

ok, here is the whole thing. it works on my machine, all you should have to do is open page_after_login.php and replace the database stuff and it will work