Is this code example from the book?
I recommend NOT putting login information in a file that people can access via their browser. This is a major security risk, because if someone navigates to the file, they will have access to all the users' logins.
Secondly, wherever the passwords are stored, they should be encrypted via the sha1() or the md5() functions.
Here is a simple example that works with Hard-Coded username/password combos:
<?php
// start a session:
session_start();
// your secret page
$secret_page = 'http://www.domain.com/secret_page.php';
/* HARD CODED VALUES: passwords encrypted via sha1() function */
$logins[] = array('username'=>'bob', 'password'=>'5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8');
$logins[] = array('username'=>'john', 'password'=>'2aa60a8ff7fcd473d321e0146afd9e26df395147');
$logins[] = array('username'=>'diane', 'password'=>'1119cfd37ee247357e034a08d844eea25f6fd20f');
// if form submitted:
if (isset($_POST['_submit-check']))
{
$required = array('username'=>$_POST['user'], 'password'=>$_POST['pass']);
foreach($required as $key=>$value)
{
if(trim($value) == '' || empty($value))
{
$errors[] = 'The '.$key.' is still needed';
}
}
if(isset($errors))
{
$message = '<h2 class="error">Error!</h2>'."\n";
$message .= '<p>The following error occurred:</p>'."\n";
$message .= '<ul>'."\n";
foreach($errors as $value)
{
$message .= '<li>'.$value.'</li>'."\n";
}
$message .= '</ul>'."\n";
}
else
{
$user = trim($_POST['user']);
$pass = trim($_POST['pass']);
foreach($logins as $value)
{
// successful login
if($user == $value['username'] && sha1($pass) == $value['password'])
{
$login_success = true;
$_SESSION['logged_in'] = true;
$_SESSION['user'] = $user;
header('Location: ' . $secret_page);
exit;
}
}
// failed login attempt
if(!isset($login_success))
{
$message = '<h2 class="error">Error!</h2>'."\n";
$message .= '<p>The following error occurred:</p>'."\n";
$message .= '<ul>'."\n";
$message .= '<li>Your login failed!</li>'."\n";
$message .= '</ul>'."\n";
unset($_POST['user'], $_POST['pass']);
}
}
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html>
<head>
<title>Login Test (with hardcoded usernames/passswords)</title>
<style type="text/css" media="screen">
body {
font-family:Arial, Helvetica, sans-serif;
font-size:11px;
background-color:#fff;
color:#333;
margin:50px;
}
.error {
color: #FF0000;
background-color:#fff;
}
</style>
</head>
<body>
<h1>Login</h1>
<?php
if(isset($message)) echo '<p>' . $message . '</p>'. "\n";
?>
<form action="<?php echo htmlspecialchars($_SERVER['PHP_SELF'], ENT_QUOTES, 'UTF-8'); ?>" method="post">
<p><input type="text" name="user" size="50" value="<?php if(isset($_POST['user'])) echo $_POST['user']; ?>" /> Username</p>
<p><input type="password" name="pass" size="50" value="<?php if(isset($_POST['pass'])) echo $_POST['pass']; ?>" /> Password</p>
<p><input type="submit" value="Login" /></p>
<input type="hidden" name="_submit-check" value="1" />
</form>
</body>
</html>
If you can go through this and understand it, the next thing I suggest you try is using a MySQL database to store your usernames/passwords and other user information....
