Here's the code...did you have the same 'bug'?
<form method="POST" action="example.9-9.php">
<?php
// Include the formatted error message
if (isset($errorMessage))
echo
"<h3><font color=red>$errorMessage</font></h3>";
// Generate the login <form> layout
?>
<table>
<tr><td>Enter your user-name:</td>
<td><input type="text" size=10
maxlength=10
name="formUsername"></td></tr>
<tr><td>Enter your password:</td>
<td><input type="password" size=10
maxlength=10
name="formPassword"></td></tr>
</table>
<p><input type="submit" value="Log in">
</form>
</body>
</html>
<?php
}
//
// Function that returns HTML page showing that
// the user with the $currentLoginName is logged on
//
function logged_on_page($currentLoginName)
{
// Generate the page that shows the user
// is already authenticated and authorized
?>
<!DOCTYPE HTML PUBLIC
"-//W3C//DTD HTML 4.0 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd" >
<html>
<head>
<title>Navy ROTC Logged In</title>
<META HTTP-EQUIV="Pragma" CONTENT="no-cache">
<META HTTP-EQUIV="Expires" CONTENT="-1">
</head>
<body>
<h2>Navy ROTC</h2>
<h2>You are currently logged in as
<?php echo $currentLoginName; ?></h2><br>
<a href="authTest-chp9.php">authorized test?!?</a><br>
<img src="../images/wolf.gif" alt="wolf" width="40" height="77"><br>
<a href="example.9-10.php">Logout</a>
</body>
</html>
<?php
}
// Main
session_start();
// Check if we have established a session
if (isset($HTTP_SESSION_VARS["authenticatedUser"]))
{
// There is a user logged on
logged_on_page(
$HTTP_SESSION_VARS["authenticatedUser"]);
}
else
{
// No session established, no POST variables
// display the login form + any error message
login_page($HTTP_SESSION_VARS["loginMessage"]);
session_destroy();
}
?>
here's example.9-9.php's code:
<?php
header("Cache-Control: post-check=0, pre-check=0", false);
header("Pragma: no-cache");
header("Expires: Mon, 26 Jul 1997 05:00:00 GMT");
/* Date in the past*/
header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
/* always modified*/
header("Cache-Control: no-cache, no-store, must-revalidate");
/* HTTP/1.1 read*/
header("Cache-Control: post-check=0, pre-check=0", false);
include '####.inc'; //db file
include '####.inc';//db file
function authenticateUser($connection,
$username,
$password)
{
// Test that the username and password
// are both set and return false if not
if (!isset($username) || !isset($password))
return false;
// Get the two character salt from the username
$salt = substr($username, 0, 2);
// Encrypt the password
//$crypted_password = crypt($password, $salt);
$crypted_password = $password;
// Formulate the SQL query find the user
$query = "SELECT password FROM phpOriellyusers
WHERE user_name = '$username'
AND password = '$crypted_password'";
// Execute the query
$result = @ mysql_query ($query,
$connection)
or showerror();
// exactly one row? then we have found the user
if (mysql_num_rows($result) != 1)
return false;
else
return true;
}
// Main ----------
session_start();
$authenticated = false;
// Clean the data collected from the user
$appUsername =
clean($HTTP_POST_VARS["formUsername"], 10);
$appPassword =
clean($HTTP_POST_VARS["formPassword"], 15);
// Connect to the MySQL server
//$connection = @ mysql_connect($hostName,
$connection = mysql_connect($hostName,
$username,
$password)
or die("Cannot connect");
if (!mysql_selectdb($databaseName, $connection))
showerror();
$authenticated = authenticateUser($connection,
$appUsername,
$appPassword);
if ($authenticated == true)
{
// Register the customer id
session_register("authenticatedUser");
$authenticatedUser = $appUsername;
// Register the remote IP address
session_register("loginIpAddress");
$loginIpAddress = $REMOTE_ADDR;
}
else
{
// The authentication failed
session_register("loginMessage");
$loginMessage =
//"Could not connect to the winestore " .
//"database as \"$appUsername\"";
"Could not log you in to the secure Navy ROTC area";
}
// Relocate back to the login page
header("Location: example.9-8.php");
?>
