Problem with session not taking all info

[SeanKann]

THis is part of my logon.php file

session_start();
  session_register('username');
  session_register('user_level');
  //successful login code will go here...
 $username = $_POST['username'];
 $user_level = $_POST['user_level'];
 $_SESSION['username'] = $username;
 $_SESSION['user_level'] = $user_level;

User level will display a level for the user for a value of 1, 2 or 3.

My index.php file

Very top of the page
<?php
session_start();
header("Cache-control: private"); //IE 6 Fix
?>

THen with in the page I have this 
<? echo $_SESSION['username']; ?>

which works great.. displays the persons user name

but.. when I do
<? echo $_SESSION['user_level']; ?>
Doesn't show anything

I need to get this so that I can do an if statement so that it will show certain links for that person rather then a guest

[devinemke]

your code seems to suggest that user_level is something that the user will input via a form:

$user_level = $_POST['user_level'];

is that correct? is this something that the users inputs, or perhaps from hidden field?

[SeanKann]

It's actually nothing the user does.. It's something that is done from the Admin Panel from PHPbb forum

I'm using the PHPbb forum to use the user database and where it has the ranks and everything else

And from that they will be set a certain user level. via the admin panel.

So far showing the user name works great.. works with other pages as well via a form post and takes the session user name and posts it with the form..

It's just this for the main page..

So say someone has a rank1 which is the highest rank..
They will see the following
Post public news
Post private news
Edit Info

Rank2 seconds highest
they will see
Post Private News
Edit info

And rank 3 will see
Edit info

for this i'll be using if statements to do it so like

if(user_level == 1);
print editinfo.php
print post.php

} elseif {

print edit.php
}

I think thats correct not sure yet 😉 Still learning

[tsinka]

How does the form look like that submits the POST values ?

Thomas

[SeanKann]

[php[
<form method="post" action="admin/login.php">
Username: <input type="text" name="username" size="20">
Password: <input type="password" name="password" size="20">
<input type="submit" value="Submit">
[/code]

[tsinka]

That form doesn't post any user_level variable. Where does that variable come from ? You might need to get it from somewhere else (PHPbb database).

Thomas

[SeanKann]

Well.. I think that it grabs it from this..

$result=mysql_query("select * from $table where username='$user' AND user_password='$pass'", $db);

//check that at least one row was returned

$rowCheck = mysql_num_rows($result);
if($rowCheck > 0){
while($row = mysql_fetch_array($result)){

Telling it to select everything then I'd hope it would let me select different data from the database..

Cuz the userlevel is set by the admin panel in PHPBB.. Not when the user loggs in

[tsinka]

In that case you need to fetch the user level from the database.

Here's an example:

<?PHP
  session_start();
  header("Cache-control: private"); //IE 6 Fix 

  // default value
  $loggedIn  = false;
  $submitted = false;
  $error     = "";
  $user      = "";
  $pass      = "";

  if (isset($_POST['submit'])) {
    // form submitted
    $submitted = true;

// db connection data
$dbHost    = "dbhost";
$dbUser    = "dbuser";
$dbPass    = "dbpass";
$dbName    = "dbname";
$dbTable   = "dbtable";

// set username and password to well known values
$user  = (isset($_POST['username']) && !empty($_POST['username'])) ? $_POST['username'] : "";
$pass  = (isset($_POST['password']) && !empty($_POST['password'])) ? $_POST['password'] : "";
$userlevel = 0;

if (!empty($user) && !empty($pass)) {
  // username and password submitted at all

  // get user_level
  $conn = mysql_connect($dbHost,$dbUser,$dbPass) or die("Could not connect to server: ".mysql_error());
  mysql_select_db($dbName,$conn) or die("Could not select database: ".mysql_error());

  $sql = "SELECT user_level FROM $dbTable where username='"
        .mysql_escape_string($user)
        ."' AND user_password='"
        .mysql_escape_string($pass)
        ."'";

  $res = mysql_query($sql,$conn) or die("SQL error: ".mysql_error());

  if ($row = mysql_fetch_array($res)) {
    // user with given username and password exists
    // set bool value and session variables
    $loggedIn = true;
    $_SESSION['sess_username'] = $user;
    $_SESSION['sess_userlevel'] = $row['user_level']; 
    $_SESSION['sess_authenticated'] = 1;
  } else {
    $error = "No such user found<br>";
  }
} else {
  $error = "Invalid user data<br>";
}
  }

  if ($loggedIn) {
    // login successful
    header("Location: otherscript.php");
  } else {
?>
<html>
<head>
<title>Title</title>
</head>
<body>
<?PHP echo $error; ?>
<form method="post" action="<?PHP echo $_SERVER['PHP_SELF']; ?>">
Username: <input type="text" name="username" size="20" value="<?PHP echo $user; ?>">
Password: <input type="password" name="password" size="20">
<input type="submit" name="submit" value="Submit"> 
</form>
</body>
</html>
<?PHP
  }

  /*

in the pages that need authentication check if 
$_SESSION['sess_authenticated'] == 1;

  */
?>

I'd suggest not to use the names of session or post variables as variable names in PHP scripts. That could lead to problems if register_globals is set to on.

Thomas

[SeanKann]

Would this work with the password being MD5?

Thanks for helping me with this btw.. You don't know how much hair i have lost going through this 🙂

[tsinka]

Check if your PHP installation has the md5 function. You can create a md5 hash with

md5($pass)

btw. ... you should strip the submitted username and password to remove any whitespaces.

Besides that add some form validation to check if the user submitted a valid username and password.

Thomas

[tsinka]

Alternatively you can do something like:

.....
            ."' AND user_password=MD5('"
            .mysql_escape_string($pass)
            ."')"; 
.....

Thomas