WOW! -- I have come so far in the last few days!!!
Spot the errors in my first code? - Nah! Just throw it away!!
Thanks for all your help there, I ended up just checking for the $trademeid in the details table to see if the customer already exists.
Heres an update on the code I posted above, re: check for session id. This is just to make sure the user has logged in on this session. One of the big problems I saw when I wrote this code, is they can manually enter '1' into their cookie!
What I did: create 'sessionid' column in the details table. When the user successfully logs in, they get 2 cookies:
// Pick a lucky number between 100 & 999 and assign it for this session.
// These cookies expire when the browser is closed.
$loggedin = rand(100,999);
setcookie ("trademeid","$trademeid");
setcookie("loggedin","$loggedin");
// Put the lucky number in the database to compare to the cookie
$sessionid="UPDATE details SET sessionid='$loggedin' WHERE trademeid='$trademeid'";
mysql_query($sessionid);
Then I call the checklogin() function at the top of every page AFTER connecting to the DB:
$trademeid = $HTTP_COOKIE_VARS['trademeid'];
$loggedin = $HTTP_COOKIE_VARS['loggedin'];
include 'connectdb.php';
connect(); selectdb();
include 'loggedincheck.php';
checklogin($trademeid,$loggedin);
Heres the function definition in loggedincheck.php:
<?php
function checklogin ($trademeid, $cookiecontents) {
$query = "SELECT sessionid FROM details WHERE trademeid = '$trademeid'";
$results = mysql_query($query);
list ($sessionid) = mysql_fetch_array($results);
if (($cookiecontents) == ($sessionid)) {
return (1);
} else {
echo "$trademeid, You need to log in to access this page. <A HREF=\"index.php\">Click Here.</A>";
mysql_close();
exit;
};};
?>
This forces the user to login via index.php and get their cookies every time they visit.
Just thought I'd leave it here in case someone else finds it useful.
Thanks for all your help everyone!! - I'll be back! 😉
Anthony