Sessions help -- Is this right?

Radon3k

I have a login system, which works fine but the problem is that if someone finds out the page it redirects you to if you logged in correctly then people can bypass the login system altogether. So I'm trying to use sessions to prevent this and this is what I have for my "login.php" script:

<?php

$db = mysql_connect("localhost", "username", "password");

mysql_select_db("dbname", $db);

if($_POST['submit'] == "Login") {
	$login = mysql_query("SELECT * FROM users WHERE username = $uname AND password = $passwd");

$num = mysql_num_rows($login);

if($num == 0) {
	echo("Invalid user name and/or password. Please use your browsers back button and try logging in again.");
}

if($num == 1) {
	session_start();

	$valid_user = $uname;
	$id = session_id();
	$ip_address = $_SERVER['REMOTE_ADDR'];

	session_register("valid_user");
	session_register("id");

	header("Location: /members2.php");
}
}
?>

What else do I need to add so that it verifies that the person is that person and they can't bypass the login page? Thanks! 🙂

alanzhao

people can bypass the login system altogether

what do you mean by that? users of the same computer? or from different computer?

if you use session, there is a chance the users of the same computer can access it altogether. maybe assign a unique id to user when they login will help, and kick off the user without a unique id.

Radon3k

No I mean like this: members.php is where you type your info in. members2.php is where the actual content is. If someone finds out that members2.php exists they can just go straight there and bypass members.php. See what I mean? I'm trying to avoid that by using sessions. I'm not worried about users on the same computer.

alanzhao


// add to member2.php
if (!eregi("member.php", $_SERVER['PHP_SELF'])) {
  die ("You can't access this file directly...");
}

it forces the user to access from member.php

hope it helps in your case:rolleyes:

Radon3k

I looked it up on php.net and I don't see what that has to do with it. I know you can do it with sessions but I'm not sure how and that's what I'm looking for.

Radon3k

Anybody else?