membership login and update script

jwilley

Hello again,
Ok, i've been working with this for so long to no avail... i've searched and searched and have come up with nothing.... that at least i can understand...

I just want a user to login against a database with their last name and member number, and then be able to update his or her own information in populated fields... i've found the part of the script where if i put in my last name it will give me only my name and all my information to update... but i want the lastname variable to pass from the login page to this PHP script so when they login it will show thier name and information... here is my PHP code for just the query part... :

 $result = mysql_query("SELECT * FROM membinfo where lastname='willey'",$db);

while ($myrow = mysql_fetch_array($result)) {

  printf("<a href=\"%s?id=%s\">%s %s</a> \n", $PHP_SELF, $myrow["id"], $myrow["lastname"], $myrow["firstname"]);

  printf("<a href=\"%s?id=%s&delete=yes\">(DELETE)</a><br>", $PHP_SELF, $myrow["id"]);

i want to change WILLEY (my last name) to $lastname.... this is the variable i want to pass from my login page...

<html>
<head>
<title>Untitled Document</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

<body>

<form method=post action="<?echo $PHP_SELF?>"> 
<table cellpadding=2 cellspacing=0 border=0> 
<td>Username:</td><td><input type="text" name="lastname" size=10></td><tr> 
<td>Password:</td><td><input type="password" name="membernumber" size=10></td><tr> 
<td>&nbsp;</td><td><input type="submit" name="login" value="Log In"></td> 
</table></form> 


<?php 
if ($login) { 
$db = mysql_connect("localhost", "oataorg_ohioata", "atmedical");
mysql_select_db("oataorg_memdb",$db);
$result=mysql_query("select * from membinfo where lastname='$lastname'",$db) or die ("cant do it"); 
while ($row=mysql_fetch_array($result)) { 
if ($row["membernumber"]==$membernumber) { 
printf("Successfully Logged In!<a href=\"newmemupd.php\">Click Here</a>"); 
}
}
}
?>



</body>
</html>

SO:
1)How can i pass $lastname from the login to the member update page and
2)then how can i have it get the ID number of the lastname so that it can populate the field with that persons info..

does this make sense at all?

bj_

They have a good article on session control at this site. Actually a couple good articles. You may want look at those. Also, you may want to look at the session functions in the php manual.

You will have to decide if you want to do sessions by Database tables, shared memory, cookies, or attaching all your variables to the end of your url ($_GET['']).

Remember that HTTP is a stateless protocal which means that it has no knowlege of what the user did in the previous page. You have to pass all the information to the next page yourself. That is basically session management. After doing some research you will probably want to restructure your website.

paulnaj

I think you're asking the following:

Once a member has successfully logged in, they click the [("Successfully Logged In!<a href=\"newmemupd.php\">Click Here</a>");] link to goto an update member page and you want to pass the current member's member number over to this page so that you can pull all of their details up again.

Two solutions: $membernumber
1) add '?membernumber=$membernumber' to the href to give ...

printf ("Successfully Logged In!<a href=\"newmemupd.php?membernumber=\"".$membernumber."\">Click Here</a>");

2) However, this means the member number is viewable in the address bar, which you might not want. So, build another form with a hidden field (name=\"membernumber\" value = \".$membernumber."\"). Add a submit button and set the method to POST.

Both methods will pass the member number to the update page and you can SELECT the relevant record using this in the WHERE clause.

Hope this helps!

jwilley

Ok, i understand how to pass it now via the URL... but it is not working... here is my code:

<form method=post action="<?echo $PHP_SELF?>"> 
<table cellpadding=2 cellspacing=0 border=0> 
<td>Username:</td><td><input type="text" name="lastname" size=10></td><tr> 
<td>Password:</td><td><input type="password" name="membernumber" size=10></td><tr> 
<td>&nbsp;</td><td><input type="submit" name="login" value="Log In"></td> 
</table></form> 

<?
if ($login) { 
$db = mysql_connect("localhost", "oataorg_ohioata", "atmedical");
mysql_select_db("oataorg_memdb",$db);
$result=mysql_query("select * from membinfo where lastname='$lastname'",$db) or die ("cant do it"); 
while ($row=mysql_fetch_array($result)) { 
if ($row["membernumber"]==$membernumber) { 
printf ("Successfully Logged In!<a href=\"newmemupd.php?membernumber=\"".$membernumber."\">Click Here</a>");
}
}
}
 ?>

When i login that works fine, but if i click on the Click Here link the URL shows http://www.oata.org/newmemupd.php?membernumber=
and it is blank after member number... so it's passing over nothing... how can i get it to show the member number and pass it along... i don't really care right now if it shows up in the URL... doesn't need to be hidden at this point...
Any ideas?
Jon

paulnaj

The printf line should have been:

printf ("Successfully Logged In!<a href=\"newmemupd.php?membernumber=".$membernumber."\">Click Here</a>");

(I'd left in an superfluous [\"], Sorry 'bout that!! )

jwilley

No problem,
Ok, now that i have everything working pretty much like i want it i need to worry about security... i liked your idea about hiding the ID# in the URL (since i am now validating wiht the ID#)

see my code:

<?
if ($login) { 
$db = mysql_connect("localhost", "oataorg_ohioata", "atmedical");
mysql_select_db("oataorg_memdb",$db);
$result=mysql_query("select * from membinfo where lastname='$lastname'",$db) or die ("cant do it"); 
while ($row=mysql_fetch_array($result)) { 
if ($row["membernumber"]==$membernumber) {
$id = $row['id'];  

printf ("Successfully Logged In!<br><a href=\"newmemupd.php?id=$id\">CLICK HERE to update your information!</a>");
}
}
}
 ?>

How can i hide the ID# in the URL like you suggested earlier? I'm not sure how to do it...
Jon

paulnaj

Remember that NO http transmission is ever secure. Also, any method that stores the [id] value on the page can be viewed by the client if he looks at the page source.

If that's OK, then this works:

<a href="javascript:document.forms.frm_update.submit();">CLICK HERE to update your information!</a>
<form action="newmemupd.php" name="frm_update" method="post"><input type="hidden" name="id" value="<?=$id?>"></form>

The form hides the value from the address bar because the form method is POST, not GET and the link just does the submission.

If you need more security then you should really have a good look at using session data, which allows variables to be stored at the server and used across pages. Then, the only time a clients data is transmitted across http is from the login page. Read the manual to try this.

Good luck!

jwilley

so should i make this form a second page after they successfully login or should i incorporate this code you just gave me into the PHP section after printf ("Success...etc...);???

paulnaj

Replace your original statement with ...

printf("<a href=\"javascript:document.forms.frm_update.submit();\">CLICK HERE to update your information!</a><form action=\"newmemupd.php\" name=\"frm_update\" method=\"post\"><input type=\"hidden\" name=\"id\" value=\"".$id."\"></form>");

jwilley

OK,
So now that we've gotten this down good with ALL your help one last thing... is there some sort of Else or If statement i can add to the script above to make it so that if they don't login correctly against the database they will get an error message? Something like "Sorry, the information you entered doesn't match oru records!"... right now it just reloads and empties the fields but says nothing...
any help would be appreciated AGAIN... sorry i'm so lame....
JW

paulnaj

At least have a go!

jwilley

Right on! I am going at it... will keep on... i think i'm close...
thanks for the push!

egats!

Jon

jwilley

Well, that was pretty simple....

else{ 
         echo 'User or password wrong.'; 
         }

shy's away embarrased at how stupid he is

Thanks for your help...
JDW

paulnaj

Well done!

jwilley

Nothings ever easy is it....

ok, so i've got an error message when it comes up that they've logged in wrong... here is my code:

<?
if ($login) { 
$db = mysql_connect("localhost", "oataorg_ohioata", "atmedical");
mysql_select_db("oataorg_memdb",$db);
$result=mysql_query("select * from membinfo where lastname='$lastname'",$db) or die ("cant do it"); 
while ($row=mysql_fetch_array($result)) { 
if ($row["membernumber"]==$membernumber) {
$id = $row['id'];  

printf("YOU HAVE SUCCESSFULLY LOGGED IN!<br><br><a href=\"javascript:document.forms.frm_update.submit();\">CLICK HERE to update your information!</a><form action=\"newmemupd.php\" name=\"frm_update\" method=\"post\"><input type=\"hidden\" name=\"id\" value=\"".$id."\"></form>");
}
else { 
echo 'Your Username or password seem to be wrong...<br>Try it again or contact <a href=mailto:stephdasher@aol.com>Stephanie Dasher</a> with questions!'; 
}
}
}
 ?>

the issue arises when they see the error message that they were wrong and they try again the error message comes up right behind the prior error message.... so it looks like this...

Your Username or password seem to be wrong...
Try it again or contact Stephanie Dasher with questions!Your Username or password seem to be wrong...
Try it again or contact Stephanie Dasher with questions!

I've tried moving it around and so on but i'm not sure where toeven go next to try and somehow refres the page or something? i have no clue and have searched this one out to no avail...
JW

paulnaj

You're loop-logic has gone a bit awry. Look carefully at what is happening ...
Say that the member number is a good one, but doesn't show up until, say, the third iteration of the loop. That means that the 'else' bit of your if{} else{} will be called twice before it finds out that the user is OK.

Actually, in this case, you need to check all the entries in the query BEFORE you print anything. I set the variable $id = false;
Then, loop through, asking if the membernumber matches, and if it does, set the $id and break out of the current loop.
If the membernumber never matches, then by the end of the loop the $id will still contain [false].
Use this to decide what to print.

if ($login) {
$db = mysql_connect("localhost", "oataorg_ohioata",
"atmedical");
mysql_select_db("oataorg_memdb",$db);
$result=mysql_query("select * from membinfo where lastname='$lastname'",$db) or die ("cant do it");

$id = false;
while ($row=mysql_fetch_array($result)) {
if ($row["membernumber"]==$membernumber) {
$id = $row['id'];

}
}
if ($id) {

printf("YOU HAVE SUCCESSFULLY LOGGED IN!<br><br><a href=\"java script:document.forms.frm_update.submit();\">CLICK HERE to update your information!</a><form action=\"newmemupd.php\" name=\"frm_update\" method=\"post\"><input type=\"hidden\" name=\"id\" value=\"".$id."\"></form>");

} else {

echo 'Your Username or password seem to be wrong...<br>Try it again or contact <a href=mailto:stephdasher@aol.com>Stephanie Dasher</a> with questions!';

}
}
?>

paulnaj

I left a bit out on my last reply
Everything's correct except the bit about breaking out of the loop ... so here it is again, with that added ...

$id = false;
while ($row=mysql_fetch_array($result)) {
if ($row["membernumber"]==$membernumber) {
$id = $row['id'];
break;
}
}
if ($id) {

printf("YOU HAVE SUCCESSFULLY LOGGED IN!<br><br><a href=\"java script:document.forms.frm_update.submit();\">CLICK HERE to update your information!</a><form action=\"newmemupd.php\" name=\"frm_update\" method=\"post\"><input type=\"hidden\" name=\"id\" value=\"".$id."\"></form>");

} else {

echo 'Your Username or password seem to be wrong...<br>Try it again or contact <a href=mailto:stephdasher@aol.com>Stephanie Dasher</a> with questions!';

}
}
?>

kevinsequeira

<?php
if ($login) { 
  $db = mysql_connect("localhost", "oataorg_ohioata", "atmedical");
  mysql_select_db("oataorg_memdb",$db);
  $result=mysql_query("select * from membinfo where lastname='$lastname' AND membernumber='$membernumber'",$db) or die ("cant do it"); 
  if(mysql_num_rows($result)==1){ 
    $row = mysql_fetch_array($result)
    $id = $row['membernumber'];
  ?>
    YOU HAVE SUCCESSFULLY LOGGED IN!<br><br>
  		<form action="newmemupd.php" name="frm_update" method="post">
  		<input type="hidden" name="id" value="<?php print($id); ?>">
  		<input type=submit value="CLICK HERE to update your information!">
  		</form>
  <?php
  	}else { 
      echo 'Your Username or password seem to be wrong...<br>';
  			echo 'Try it again or contact <a href=mailto:stephdasher@aol.com>Stephanie Dasher</a> with questions!'; 
  	}
}
?>

when u authenticate test for both membername and membernumber in the query, saves u the hassle of a while loop and besides the combination has to be unique.

reg
kevin

paulnaj

A decision is being made on EVERY iteration of the while loop ...

So, say, on the first iteration, the membernumber doesn't correspond, then immediately, it will print out the 'Not found' bit.
Then it will continue onto the next iteration of the loop ...

Suppose, on some iteration, the membernumber does correspond it will print out the 'Found' bit, but it will still continue on, printing (for sure, this time) more 'Not found' bits until the end of the while loop.

Here's how I migh do it ...

if ($login) {  

	$db = mysql_connect("localhost", "oataorg_ohioata", "atmedical"); 
	mysql_select_db("oataorg_memdb",$db); 
	$result = mysql_query("select * from membinfo where lastname='$lastname'",$db) 
			or die ("cant do it");  

// First see if the membernumber exists, and if so, store the relevant $id
while($row = mysql_fetch_array($result)){  
	if ($row["membernumber"] == $membernumber){ 
		$id = $row['id'];
		break; // Don't bother continuing in the loop
	}
} 
// Now see if the $id has been assigned a value, and act accordingly
if($id){ 
	printf("YOU HAVE SUCCESSFULLY LOGGED IN!<br><br><a href=\"java script:document.forms.frm_update.submit();\">CLICK HERE to update your information!</a><form action=\"newmemupd.php\" name=\"frm_update\" method=\"post\"><input type=\"hidden\" name=\"id\" value=\"".$id."\"></form>"); 
} else {  
	echo 'Your Username or password seem to be wrong...<br>Try it again or contact <a href=mailto:stephdasher@aol.com>Stephanie Dasher</a> with questions!';  
} 
} 
[\PHP]