[RESOLVED] Sessions/Variables/Security --HELP Please

nrvptl

Hey Guys I am a newbie to PHP and MYSQL and I am trying to build a application. The first page I developed is the Login form where the user types in the user name and password and the database name and clicks on submit

The way I have the current design is when the user inputs the values in the above login form, I wrote code n PHP for it to check the values in a generic database to see if the user is valid or not.

If the user is valid then I have a common user name for the database the user will use behind the scene to actualy log in to the datbase of his choice.

This is what I have

Form 1. User enters the values

user name =test
password= test_password
database=test_db

when the user clicks on Submit this info...

The code actually logn into the database as

username= database1
username= database1_password
database =database1.

In this database there is a table called user that has the values for user name
and user password. It checks to see if it is valid and a row will be returned.

If the results are valid then the code will connect to the database as

username=database2
userpassword=database2_password
database=test_db (this is the initial database the user wanted to go to)

NOW I AM STUCK. I want to know how I can keep this connection troughout till the user is logged in and jump from one page to the other using MYSQL database connection and queriess. Also how to kick the user out after 30 minutes of no activity.

Please help and Thankyou to all in advance.

msound

what is the point of your application? should the user be able to administer the db of his/her choice? if so, then why not just use phpmyadmin?

If this is just some sort of elaborate login program, then the user shouldn't be able to manually type in the db name. when you create your users table (table with authorized users), there should be a linking db table that locks a user to the tables that he/she has access to.

so get the username and password, query the allowed_dbs table to get the list of db's that that user has access to, then prompt the user with a select menu to choose the db.

nrvptl

Thank you for your reply. What I am trying to do is avoid creating thousands of user on the instance each pointing to a different database and each one having a direct connect to the schema that they area authorised to. This will make the maintanence of the database very complicated.

That is why I created the initial user table where I check to see if Mr X is authorised for the database he has inputeed on the login form, If Yes then what privileges does he have.

So for example if Mr x has Insert privileges then I connect to that database using the id that has insert rights to that database behind the scenes . If Mr Y has select rights then he will use the select password.
Thus I only have to maintain one user table from a user stand point and may be 4 standard users userInsert, UserAdmin, userSelect, userAll for that schema.

Now since the user and the databases change all the time I cannot have a standard login php file included all the time because the connect string is derieved by using $post from the login screen. So If I am on the page after the login page I can connect using that script but after that the $post values get lost.

So if some you or some one can guide me as to how to carry variables from one page to the next I can continue to run the same login script and it will work fine for each form for each different user.

Thanks once again.

thepeccavi

What you need is sessions.

to initiate a session (MUST be done on every page that uses them) you use this code:

//Initialize the session
session_start();

You can use you login script to set some session variables, these are available on every page on the same domain which has the session initialized. They are stored in the $_SESSION array:

$_SESSION['username'] = $_POST['username'];
$_SESSION['uid'] = $array_that_is_taken_from_the_mysql_db['uid'];

and then you can use this to check that a user is logged in:

//init session
session_start();

if(isset($_SESSION['uid'])) {
//The user is logged in!
// Do some stuff!
}
else {
// User is not logged in
// either set a variable saying this and show less info or:
header("Location: login.php?message=You must login to access this page!");
}

to logout:

// init the session:
session_start();

// clear session variables:
$_SESSION = array();

// kill the session cookie:
if (isset($_COOKIE[session_name()])) {
   setcookie(session_name(), '', time()-42000, '/');
}

// destroy the session
session_destroy();

I have probably made a few code errors, so check this before you put it into action, but that is a very basic guide to sessions, I have written a full guide to PHP Sessions here (http://acespace.co.uk/smf/?topic=414.0)

Hope this helps!

nrvptl

thank you. I looked at your other post and figured out how to use the session variable. Thanks again.