Very good Login Script (problems)

gat

Hello

http://art.uk-graffiti.co.uk/login_form.html

this is my login page, you can regsiter to the DB, and a confrimation email is sent back to your email.

when the link is clicked, the users become activated in the DB (set to 1)

however, when i try to login..my checkstatus page is displaying nothing.

feel free to register and try or here is one

user = Tom
pass = e4ftv2ss

here is the code that appears to do nothing.

<?
/* Check User Script */
session_start();  // Start Session

include 'db.php';
// Conver to simple variables
$username = $_POST['username'];
$password = $_POST['password'];

if((!$username) || (!$password))
    die( "Please enter ALL of the information! <br />");

// Convert password to md5 hash
$password = md5($password);

// check if the user info validates the db
$sql = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password' AND activated='1'");
$login_check = mysql_num_rows($sql);

if($login_check > 0){
	while($row = mysql_fetch_array($sql)){
	foreach( $row AS $key => $val ){
		$$key = stripslashes( $val );
	}
		// Register some session variables!

	$_SESSION['first_name'] = $first_name;
    $_SESSION['last_name'] = $last_name;
	$_SESSION['email_address'] = $email_address;
	$_SESSION['user_level'] = $user_level;

	mysql_query("UPDATE users SET last_login=now() WHERE userid='$userid'");

	header("Location: login_success.php");
}
} else {
	echo "You could not be logged in! Either the username and password do not match or you have not validated your membership!<br />
	Please try again!<br />";

}
?>

gat

here is the code for login_success.php

<?
session_start();

echo "Welcome ". $_SESSION['first_name'] ." ". $_SESSION['last_name'] ."! You have made it to the members area!<br /><br />";

echo "Your user level is ". $_SESSION['user_level']." which enables you access to the following areas: <br />";

if($_SESSION['user_level'] == 0){
	echo "- Forums<br />- Chat Room<br />";
}
if($_SESSION['user_level'] == 1){
	echo "- Forums<br />- Chat Room<br />- Moderator Area<br />";
}

echo "<br /><a href=logout.php>Logout</a>";

?>

after i log on, if i go to this page, the session vars are not shown, so the session is obviously not working properly.,,

would be much appreciated if some one could take a look.
Thanks

Nixon

Shouldn't you use

$username="Jack";
session_register("username");

Thats what I always use to register session variables.

Jack

gat

well the code did look like this..i was recomended to change it from another guy..

// Register some session variables!
		session_register('first_name');
		$_SESSION['first_name'] = $first_name;
		session_register('last_name');
		$_SESSION['last_name'] = $last_name;
		session_register('email_address');
		$_SESSION['email_address'] = $email_address;
		session_register('special_user');
		$_SESSION['user_level'] = $user_level;

	mysql_query("UPDATE users SET last_login=now() WHERE userid='$userid'");

	header("Location: login_success.php");
}
} else {
	echo "You could not be logged in! Either the username and password do not match or you have not validated your membership!<br />
	Please try again!<br />";
	include 'login_form.html';
}
?>

Nixon

I think it should be just:

session_register("first_name");
session_register("last_name");

as long as all your variables above are named like that.

$SESSION_[first_name]=$firstname

I've never used before and never had too.

And where are you setting the variables as $first_name etc.... Wouldn't it be $row[first_name]?

Weedpacket

Originally posted by Nixon
I think it should be just:

....

I've never used before and never had too.

You might want to look at PHP's [man]session[/man]. The $SESSION[] array was introduced back in 4.1 along with $GET[], $POST[], $SERVER[], and $ENV[]. Frankly, $SESSION[] is a lot simpler, because you only need session_start() and all of your session variables are available without having to remember to session_register() them.

That page also says not to mix session_register() and $_SESSION[].

gat

This is so frustrating, i been pissing about with this all day.

I uploaded all the files again to a test domain

http://test.uk-graffiti.co.uk

Please try everything, its got validation, and you can follow the link, which activates your account, then when you log in it displays your name and access privilidges.

so why....when im using all the same code does it not work on this domain

http://art.uk-graffiti.co.uk/login_welcome.php

The code must be ok, but i think its because the code is always including the pages with forms. Im sure this could be messing about with the session vars or something

please please help me...im dying here....