Oooo, I'll have to look into squishing my code down to one file. Right now I use 3 files. login.php, logout.php and a session.php that is required by each page.
Here's the code if you're curious....by all means...rip it apart and tell me what's wrong with it!
It also has a "previous page" functionality so that if the user tries a direct url request then they will be sent back to that page after login. Kinda convenient.
session.php:
<?
session_start();
function performQuery($query)
{
$status = mysql_query($query);
if ($status)
{
return $status;
}
else
{
$message = "The following error was encountered:" .
"<p>" . $query .
"<p>" . mysql_errno() . ": " . mysql_error();
die($message);
exit;
}
}
if ($_SESSION['userName'] && $_SESSION['passWord']){
$query = "SELECT * FROM users WHERE UserName='".$_SESSION['userName']."' AND Password='".$_SESSION['passWord']."'";
$result = performQuery($query);
if (mysql_num_rows($result) > 0) {
$userName = $_SESSION['userName'];
$password = $_SESSION['passWord'];
$userID = $_SESSION['userid'];
$userGroup = $_SESSION['group'];
$sessionID = $_SESSION['sessionID'];
} else {
$_SESSION['prevPage'] = $PHP_SELF;
header('location: login.php');
exit;
}
} else {
$_SESSION['prevPage'] = $PHP_SELF;
header('location: login.php');
exit;
}
?>
login.php:
<?php
session_start();
function performQuery($query)
{
$status = mysql_query($query);
if ($status)
{
return $status;
}
else
{
$message = "The following error was encountered:" .
"<p>" . $query .
"<p>" . mysql_errno() . ": " . mysql_error();
die($message);
exit;
}
}
//Check to see if user is already logged in. If so, send user to the main page
if ($_SESSION['userName'] && $_SESSION['passWord']){
$query = "SELECT * FROM users WHERE UserName='".$_SESSION['userName']."' AND Password='".$_SESSION['passWord']."'";
$result = performQuery($query);
if (mysql_num_rows($result) > 0) {
header("Location: index.php");
exit;
}
}
//If user has submitted the login form
if ($_POST['Submit']) {
//Initialize form vars
$userName = $_POST['userName'];
$password = md5($_POST['password']);
//Check for completed form
if (!($userName) || !($password)){
$___m = "Please complete the form.";
} else {
//Check db for user
$query = "SELECT * FROM users WHERE UserName='$userName' AND Password='$password'";
$result = performQuery($query);
$row = mysql_fetch_assoc($result);
if (mysql_num_rows($result) > 0) {
$_SESSION['userName'] = $userName;
$_SESSION['passWord'] = $password;
$_SESSION['userid'] = $row['ID'];
$_SESSION['group'] = $row['UserGroup'];
$_SESSION['sessionID'] = session_id();
//Did the user get redirected from a direct url request?
if ($_SESSION['prevPage']){
$location = $_SESSION['prevPage'];
} else {
$location = "index.php";
}
//Send user to main page or a previous page (if applicable)
header("Location: ".$location);
exit;
} else {
$___m = "No user matches that information.";
}
}
}
?>
logout.php:
<?php
include ('session.php');
//End Session
session_unset();
session_destroy();
$___m = "You have been logged out."
?>
Like I said...let me know how awful it is everyone! It's my first attempt at a login, so I know there's bound to be a better way!
If it's tight, then scrupul0us, it's all yours, bud! 🙂
Thanks!
Matt
