I've found someone that my login script doesn't like

schwim

Hi there guys,

Someone who is trying to use my script is having problems trying to log into the admin section. I'm sure that the username & pass is correct, as I provided him the md5 to enter into the db, but it's not working.

When he tries to login with incorrect information, it states that his login was incorrect. If he uses the correct information, then it loops back to the login page. I think it's that a session is not getting started, but I don't know how to check, and I don't know how to troubleshoot it.

include("../config.php");



/*this query retrieves the config information*/

$query = "SELECT debug FROM ".$prefix."config";

$result = mysql_query($query) or die('MySQL error: ' . mysql_error() . '<hr/>' . $query);

while ($row = mysql_fetch_assoc($result)) {



$debug = $row['debug'];



if($debug==1){

	error_reporting(E_ALL);

}

}



echo("

<form name='login_form' method='post' action='checklogin.php'>



			<td width='78'>Username</td>

			<td width='6'>:</td>

			<td width='294'><input name='myusername' type='text' id='myusername'></td>

		</tr>

		<tr>

			<td>Password</td>

			<td>:</td>

			<td><input name='mypassword' type='password' id='mypassword'></td>

		</tr>

		<tr>

			<td>&nbsp;</td>

			<td>&nbsp;</td>

			<td><input type='submit' name='Submit' value='Login'></td>
");

This part seems to be working ok. It's the part that gets attached to each page that seems to be causing a problem:

Pagecheck:

/*Making sure you are supposed to be on this page*/

session_start();

if(!session_is_registered('myusername')){

header("location:login.php");

}

Any suggestions on how to get this guy going would be appreciated.

thanks,
json

sneakyimp

well the code that redirects a user to the login page apparently does so if you have not registered a variable named myusername.

did you call session_register('myusername') ? if not, that would be a logical starting point.

it's hard to tell without a little more understanding of what you are doing.

stolzyboy

instead of using session_register, use $_SESSION, as session_register will only work in environments where register_globals is ON...

and, when using$_SESSION, do not use session_register, session_is_registered, and session_unregister

so, basically if you are using session_start(); just set or check your variable with $_SESSION[''yourvariable'] and you can do checking on that

if($_SESSION['yourvariable'] == "whatever") //can obviously be database results/etc...
{
//do whatever for successful login
}
else
{
//do whatever for failed login
}