Session problem

Ros

Hello,

I have written this code. In case the User is not alreaddy loggt in, he will be forwarded to a login form. Otherwise the system should welcome him back. But everytime I come back to this page, it asks for login. It doesn't work properly. What is wrong?

<?php

   session_start();

   // Has a session been initiated previously?
   if (! isset($_SESSION['name'])) {
      // If no previous session, has the user submitted the form?
      if (isset($_POST['username'])) {
         $username = $_POST['username'];
         $pswd = $_POST['pswd'];

     // Connect to the MySQL server and select the database
mysql_connect("localhost", "root", "");
mysql_select_db("test");

     // Look for the user in the users table.
     $query = "SELECT name FROM users WHERE username='$username' AND pswd='$pswd'";
     $result = mysql_query($query);

     // If the user was found, assign some session variables.
     if (mysql_numrows($result) == 1) {
        $_SESSION['name'] = mysql_result($result,0,"name");
        $_SESSION['username'] = mysql_result($result,0,"username");
        echo "You're logged in. Feel free to return at a later time.";
     }
     // If the user has not previously logged in, show the login form
     } else {
        include "login.html";
     }

  // The user has returned. Offer a welcoming note.
  } else {
     $name = $_SESSION['name'];
     echo "Welcome back, $name!";
  }
?>

Thank you for any comments,
Ros

paulnaj

Hi Ros,

This bit ...

if (mysql_numrows($result) == 1) { 
	$_SESSION['name'] = mysql_result($result,0,"name"); 
	$_SESSION['username'] = mysql_result($result,0,"username"); 
	echo "You're logged in. Feel free to return at a later time."; 
}

... looks like where the problem might be occurring.

Stick an else clause at the end and echo something to let you know what's going on.

$numrows = mysql_numrows($result);
if($numrows == 1) { 
	$_SESSION['name'] = mysql_result($result, 0, 0); 
	//$_SESSION['username'] = mysql_result($result,0,"username"); 
	echo "You're logged in. Feel free to return at a later time."; 
} else {
	echo "Details are wrong ... numrows = ".$numrows; 
}

Hope that helps.
Paul 🙂

PS ... I notice also that the username is not included in your select sql so the line ...

 $_SESSION['username'] = mysql_result($result,0,"username");

... won't work as expected. Don't think this is crucial to your problem, though.

Ros

Hi Paul,

Sorry for the late feedback. Mu Linux is bitching around since two days.

I just tested it. It starts with a login screen, if the details are correct, i get the welcome note otherwise the wrong detailed note.

Right now I have a design problem I guess. I do not have much experience in PHP. I have finished an Interface for adding, updating and deleting data from a MySQL database.

Everyone can use the main site with the select interface. However just the admin can use the extra functions above.

So I would like to have him staying logged in, while he can update/add stuff, but also use the public function.

Usually this is done by cookies. But could I do that with plain session based on database?

Thanks you for any idea...
Ros

paulnaj

OK Ros,

Just checking - is it ...

1) If people want to use the form for select queries, they have to login first. If the user is admin, he can also do insert, update.

... or ...

2) No login for selects. Login for admin.

Paul.

Ros

Its the second.

The public can use the select and access the information. But they shouldn't alter the data. No need for login.

While an admin can do both and need to login.

BTW it is kind of a dictionary. ;o)

Thanks
Ros

paulnaj

Ok, there are probably lots of ways and variations but here's a possibility.

Have a page separate from the main website, called admin.php, say, which has a login built into it.

Most users won't ever see it, but just in case they do stumble upon it, they'll still have to login.

Also, it doesn't matter how you have decided to build the main site.

Then the logic goes like this ...

session_start();

// Session allows you to not have to login more than once
if(isset($_SESSION['logged_in'])){ 
	$do_login = false;
} else {
	// Haven't logged in yet, but could be submitting the login form
    // Test for username AND pswd
    if(!isset($_POST['username']) || !isset($_POST['pswd'])){ 
        // We're gonna have to login 
        $do_login = true;
    } else { 
        // Both have been sent so test 
        $result = mysql_query("SELECT name FROM users WHERE username='".$username."' AND pswd='".$pswd."'");
		if(mysql_numrows($result) > 1)
            die('Problem with users database ... more than one user with identical username and pswd');
        } else if(mysql_numrows($result) == 1)
            $_SESSION['logged_in'] = true; // Any value will do
			$do_login = false;
        } else { 
            // We're gonna have to login again 
           $do_login = true;
        } 
    } 
} 

if($do_login){ 
    /* display the login form */ 
} else { 
	/*
	1. If variables have been sent, do the relevant mysql query
	2. Then display your mysql form with the action ...
		$_SERVER['PHP_SELF'] 
	... to send it back to current page
	*/ 
}

As it stands, / display the login form / means the whole login page, from <html> to </html> and similarly for the mysql form.

See how you get on with that.

Paul 🙂

Ros

Hello Paul,

Interessting idea working with boolean.

Well I have tried it, but it still doesn't work as it should.

Check it out online

username: paul
password: hello

WHen you are in, it seems ok. Click on first 'here' and to go to google.com. If you go back, it asks you again sending the post variables. It seems the session didn't work properly.

And if you click on the second 'here'; you go to the same page where you are. But everything is lost and you have to login again.

Kind of tricky...

Here ist my new code:

<?php

   session_start();

   if (isset($_SESSION['logged_in'])) {
	$do_login = false;
   } else {
	if(!isset($_POST['username']) || !isset($_POST['pswd'])){ 
		$do_login = true;
	} else {

         // Connect to the MySQL server and select the database
	 mysql_connect("...", "...", "...");
	 mysql_select_db("...");

         // Look for the user in the users table.
    	 $query = "SELECT username FROM user WHERE username='$username' AND pswd=MD5('$pswd')";
         $result = mysql_query($query);

         // If the user was found, assign some session variables.
    	 if (mysql_numrows($result) == 1) {
            $_SESSION['username'] = mysql_result($result,0,"username");
	    $_SESSION['logged_in'] = true;
	    $do_login = false;
    	    echo "You're logged in. Feel free to return at a later time.";
         }
}
}


if($do_login){
   include "login.html";
} else {
echo "hello, choose:
<a href=\"http://www.google.com\">here</a> or 
<a href=\"test3.php\">here<a>";
}
?>

Thanks for any comments,
Ros

paulnaj

Hi Ros,

There were a couple of glitches in my last post ... a couple of '{' missing on 'if' statements (I think you picked them up anyway). Also, I should've put $POST['username'] and $POST['pswd'] in the sql statement as opposed to $username and $pswd.

I'm not able to test the script at my end for a few reasons (can't connect to your database and don't know how your server is set up) so I can't debug for typo's etc either.

I really would leave the extra check for multiple entries in. This can be a real issue at the debugging stage.

I've tidied up the script a bit ... would you try it as it stands, just for the moment.

If there are errors, copy and paste the error text up to the forum.

<?php
session_start();

// Session allows you to not have to login more than once
if(isset($_SESSION['logged_in'])){ 
	$do_login = false;
} else {
	// Haven't logged in yet, but could be submitting the login form
    // Test for username AND pswd
    if(!isset($_POST['username']) || !isset($_POST['pswd'])){ 
        // We're gonna have to login 
        $do_login = 'Either first login attempt ... or haven`t filled out both username and password.';
    } else { 
        // Both have been sent so test 
		$result = mysql_query("SELECT name FROM users WHERE username='".$_POST['username']."' AND pswd=MD5('".$_POST['pswd']."')");
		// This next check is crucial for debugging
		if(mysql_numrows($result) > 1){
            die('Problem with users database ... more than one user with identical username and pswd');
        } else if(mysql_numrows($result) == 1){
            $_SESSION['logged_in'] = true; // Any value will do
        	$do_login = false;
        } else { 
            // We're gonna have to login again 
           $do_login = 'Username/password combination not valid. Try again.';
        }
    } 
} 
?>
<html>
<head>
<title>Test Login</title>
</head>
<body>
<?php
if($do_login != false){ 
?>
<strong><?php echo $do_login; ?></strong>
<hr>
<p>
	<form method="post" action"<?php echo $_SERVER['PHP_SELF']; ?>">
		Username: <input type="text" name="username" size="10"><br>
		Password: <input type="password" name="pswd" size="10"><br>
		<input type="submit" value"login">
	</form>
</p>
<?php
} else { 
?>
<p>Made it here ... if we refresh the page, we should get back here without having to login.</p>
<?php
}
?>
</body>
</html>

We'll get there in the end!!

Paul.

Ros

Hey Paul,

Thank you so much for your help. ;o) It works!!!

Check it out:

Username: paul
password: hello

here

Just the first time refresh is going to resend the POST variables. But then its fine. If you have opened more than 1 browser window. The session remains active after you even close the window. Great!!!

Soon I have to implement it for real and see if everything is still going to work fine.

😃

Ros