here's the whole login page...
<?php
if (isset($POST['submit'])) {
require_once('../mysql_connect.php');
function escape_data ($data) {
global $dbc;
if (ini_get('magic_quotes_gpc')) {
$data = stripslashes($data);
}
return mysql_real_escape_string($data, $dbc);
}
$message = NULL;
if (empty($POST['username'])) {
$u = FALSE;
$message .= '<p>You forgot to enter your username!</p>';
} else {
$u = escape_data($POST['username']);
}
if (empty($POST['password'])) {
$p = FALSE;
$message .= '<p>You forgot to enter your password!</p>';
} else {
$p = escape_data($_POST['password']);
}
if ($u && $p) {
$query = "SELECT user_id, first_name FROM users WHERE username='$u' AND password=PASSWORD('$p')";
$result = @ ($query);
$row = mysql_fetch_array ($result, MYSQL_NUM);
if ($row) {
setcookie ('first_name', $row[1]);
setcookie ('user_id', $row[0]);
header ("Location: [url]http://[/url]" . $SERVER['HTTP_HOST'] . dirname($SERVER['PHP_SELF']) . "/loggedin.php");
exit();
} else {
$message = '<p>The username and password entered do not match those on database.</p>';
}
mysql_close();
} else {
$message .= '<p>Please try again</p>';
}
}
$page_title = 'login';
include ('templates/header.inc');
if (isset($message)) {
echo '<font color="red">', $message, '</font>';
}
?>
<form action=<?php echo $SERVER['PHP_SELF']; ?> method="post">
<fieldset><legend>Enter your information in the form below:</legend>
<p><b>Username:</b> <input type="text" name="username" size="10" maxlength="20" value="<?php if (isset($POST['username'])) echo $_POST['username']; ?>" /></p>
<p><b>Password:</b> <input type="password" name="password" size="10" maxlength="20" /></p>
<div align="center"><input type="submit" name="submit" value="Login" /></div>
</fieldset>
</form>
<?php
include ('templates/footer.inc');
?>
