Loggin In

[Kol]

Hi there.

I am making a login system which will have a number of users + passwords, and plan to use sessions to do this.

<? 
// Initialise the session
session_start(); 

//connect to DB
//BLLLLAAAAAHHHHHHH

// Select the user's password 
$sql = "SELECT * WHERE username = '$username'"; 
$result = mysql_query( $sql ); 
$row = mysql_fetch_row( $result ); 
$user_pwd = $row["password"]; 


if ( md5( $password ) == $user_pwd ) 
{ 

$_SESSION['logged_in'] = "true"; 
} 
else 
{ 
    print "Password incorrect"; 
} 
?>

I will need to create the uses a private area, however this wil require the $username or $userID variables to be transfered with the pages, e.g. <a href="page.php?userID=3">link</a>

That part is easy, however, the user would be able to just edit the userID variable using the address bar, and would therefore be able to access other user's areas.

How would i get around this?

Thanks for your help!!

[dalecosp]

Why don't you just use the session, since you're using sessions?

[pablodelapena]

^ good point

try something on every page like

<?php
if ((!isset($_SESSION['logged_in'])) || ($_SESSION['logged_in'] != "true")) {
echo "You do not have permission to view this page.";
exit();
}
?>

an idea?

[Kol]

Thanks, BUT, i am able to find out if they are logged in, i just want to find out wether they are logged in AND are using the usename they logged in with.

dalecosp - what do you mean.

Thanks

[foofoobar]

Well the first problem I am seeing is a problem with your query:

SELECT * WHERE username = '$username'";

The query SHOULD be:

SELECT * FROM table WHERE username='".$username."';

You are not specifying from which table you are selecting all this data from.

[dalecosp]

what do you mean.

Let's say we know, by whatever logic you've used thus far, a particular user's ID. Let's say that your logic has put this in a var called "useID". At some point (probably during the login session) you'll do something like this. (Note that session_start() should have already been called.)

$_SESSION['user_id']=$useID;

then you just check that var on each page to see which "member area" to put this client in.

It's what sessions were created for in the first place. You don't pass the ID around in a GET string, or even via POST, 'cause the server is doing the work of keeping track of clients for you. Security problem solved.....

[pablodelapena]

sessions are magic 😃

[parawizard]

hey man theres a easier way!!!!!!!!!!

ok think about this

make a PHP file that detects if ur logged in or not

using sessions then any PHP file that u want to be restricted access just include ur log in detection php file!

include 'logincheck.php';

😃 theres a good tutorial found here about how to manage users with sessions

http://www.sitepoint.com/article/319/1

its 6 pages long and shows u how to make a login system with PHP and mysql 🙂 enjoy it helps alot

[silent]

I work for a website doing the PHP code and managing the databases. (you can check it out if you want - http://www.cashwon.com)

NOTE: if it looks like crap, the layout/graphics are NOT my department.

ANYWAY - I use a method like follows :

requirelogin.php : requires log in - goes to sign in/sign up page if the user is not logged in

<?php
  session_start();  

  if(!isset($HTTP_SESSION_VARS['id'])) {
    //if they are not sessioned, then show them the proper page
    include('notsignedin.php');
    exit;
  }
?>

checklogin.php : just checks to see if the user is logged in. For pages where logins aren't required, but additional items/capabilites may be displayed if they are logged in.

<?php
  session_start();
  if(!isset($HTTP_SESSION_VARS['id'])) { $logged_in = false; } else
  { 
    $logged_in = true; 
    //the next two lines are just to make accessing these
    //pieces of data easier for everyone
    $username = $HTTP_SESSION_VARS['name'];
    $userid = $HTTP_SESSION_VARS['id'];
  }
?>

These are much more simplified than the ones used on the site, but the basic idea is here.

Hope it helps.

[Kol]

Thank you everyone!

😃