I have a very simple login script.
Don't think it's very secure though 🙂
I'll worry about that later.
Unless someone here can comment on it
<?php
session_start();
header("Cache-control: private"); // IE6 fix
include_once('config.php');
include (DIR_INCLUDE.'initDB.php');
# Get username and password from login page
$username = $HTTP_POST_VARS['username'];
$password = md5($HTTP_POST_VARS['password']);
$location = $HTTP_POST_VARS['location'];
if(!get_magic_quotes_gpc())
{
$username = addslashes($username);
}
# SQL query to get the user from database
$result = @mysql_query('SELECT empID, empFname, empLname, empPsw FROM employee WHERE empUsrName="'.$username.'"') or die (mysql_error());
$row = mysql_fetch_array($result);
//check if the username is in database
if(mysql_numrows($result) != 1)
{
echo ' ERROR - User not found';
} else {
if ($row['empPsw'] == $password)
{
$_SESSION['_userID'] = $row['empID'];
$_SESSION['_username'] = $row['empFname'].' '.$row['empLname'];
# If username and password matches, go to a defined page.
header("Location: main.php?page=".$location."");
} else { echo 'Incorrect Password'; }
}
mysql_free_result($result);
?>