Sessions on my site

adrianpeyton

Hi, I've just implimented a sessioned logon to my site, and was wondering if any of you could see if you could forsee any problems with it. There will be a large volume of people viewing this site when it goes live, and it does involve database updates.

THis is my login page

<?php session_start(); ?>

<?php 

$db = mysql_connect("localhost", "username", "password");

mysql_select_db("dbname",$db);

 $sql="SELECT * FROM testtable where username = '$username'";

    $result=mysql_query($sql,$db);

    $myrow=mysql_fetch_row($result);

	 if($username==$myrow[0])
	 {
		 if($password==$myrow[1])
		 {
			$my_session_username = $username;
			session_register("my_session_username");
			print '<meta http-equiv="refresh" content="0; URL=/mycourse.php">';
		 }
	 }
?>

This is my logoff page

<?php 
session_start();
session_unregister("my_session_username");
session_destroy();
print '<meta http-equiv="refresh" content="0; URL=/logout.php">';
?>

THen my normal pages have

<?php
if(empty($my_session_username))
{
print '<meta http-equiv="refresh" content="0; URL=/notloggedin.html">';
}
else 
{
show normal page HTML code
?>

If you can think of anything that might affect performance with this code, then please let me know, or if I have gone about this in a completely stupid way.
Thanks,
A

procoder

Hi andrian, are you running php4? then i suggest looking at the new session methods

http://us4.php.net/manual/en/ref.session.php

for you login page I would change it too

<?php
session_start();

$db = mysql_connect("localhost", "username", "password"); 

mysql_select_db("dbname",$db); 

 $sql="SELECT * FROM testtable where username = '$username'"; 

    $result=mysql_query($sql,$db); 

    $myrow=mysql_fetch_row($result); 

     if(mysql_num_rows($result)) 
     { 
         if($password==$myrow[1]) 
         { 
            $_SESSION['my_session_username'] = $username; 
            print '<meta http-equiv="refresh" content="0; URL=/mycourse.php">'; 
         } 
     } else { bad login or whatever, add error here }
?>

<?php  

session_start(); 
unset($_SESSION['my_session_username']); 
session_destroy(); 
print '<meta http-equiv="refresh" content="0; URL=/logout.php">'; 
?>

<?php 
if(!empty($_SESSION['my_session_username'])) 
{ 
print '<meta http-equiv="refresh" content="0; URL=/notloggedin.html">'; 
} 
else  

{ 
show normal page HTML code 
?>

adrianpeyton

Thanks Procoder,
Just wondering, what are the advantages of using these new session methods over the ones I have.
Thanks,
Adrian

procoder

Well its better to stay current.

also its much easier just to set a session varible directly then, creating one and setting that one as a session. Leads to easier code and confusion later on/

I also edited the code alittle in the first page(num_rows).

I also recommand using encrypted password, passwords should never be stored plain