I'm just gonna post the whole thing, but as it really isn't too complex, you shouldn't have any probs looking over it, as It's basically just a login routine with some sanitization and string length checking. If everything works out, the user is dumped at the last "if" near the bottom where the $GET is, and all four sections will be placed.
$loginform = "<form method='post' action='{$_SERVER['PHP_SELF']}'>
<fieldset>
<legend>LOG-IN</legend>
<p><label>Name:</label><input name='formusername' type='text' size='15' maxlength='20' /></p>
<p><label>Password:</label><input name='formpassword' type='password' size='15' maxlength='20' /></p>
<p><input class='submit' type='submit' value='Log-in' name='login' /></p>
</fieldset>
</form>";
if (isset($_POST['login']))
{
$formusername = mysql_real_escape_string(strip_tags(trim($_POST['formusername'])));
$formpassword = mysql_real_escape_string(strip_tags(trim($_POST['formpassword'])));
if (!preg_match('/[a-z]+/', $formusername) OR
!preg_match('/[A-Z]+/', $formusername) OR
!preg_match('/[0-9]+/', $formusername))
{
echo "<div class='applicationarea'>";
echo "<span class='warning'>FAILURE: Authentication failed. Username failed character criteria.</span>";
echo $loginform;
die("</div><!-- applicationarea end -->");
}
if (!preg_match('/[a-z]+/', $formpassword) OR
!preg_match('/[A-Z]+/', $formpassword) OR
!preg_match('/[0-9]+/', $formpassword))
{
echo "<div class='applicationarea'>";
echo "<span class='warning'>$formpassword FAILURE: Authentication failed. Password failed character criteria.</span>";
echo $loginform;
die("</div><!-- applicationarea end -->");
}
elseif (strlen($formusername) <5 OR strlen($formusername) >20)
{
echo "<div class='applicationarea'>";
echo "<span class='warning'>FAILURE: Authentication failed. Username illegal length.</span>";
echo $loginform;
die("</div><!-- applicationarea end -->");
}
elseif (strlen($formpassword) <8 OR strlen($formpassword) >20)
{
echo "<div class='applicationarea'>";
echo "<span class='warning'>FAILURE: Authentication failed. Password illegal length.</span>";
echo $loginform;
die("</div><!-- applicationarea end -->");
}
else
{
$formpassword = md5($formpassword);
$formusername = md5($formusername);
//
// DB stuff below and authorization if userdata validates and matches fetched DB values.
//
$query = mysql_query("SELECT name, param FROM parameter WHERE name='siteuser' OR name='siteuserpasswd'") OR die(mysql_error());
while($row = mysql_fetch_array($query))
{
$$row['name'] = $row['param'];
}
if ($siteuser !== $formusername)
{
echo "<div class='applicationarea'>";
echo "<span class='warning'>FAILURE: Authentication failed. Wrong username.</span>";
echo $loginform;
die("</div><!-- applicationarea end -->");
}
if ($siteuserpasswd !== $formpassword)
{
echo "<div class='applicationarea'>";
echo "<span class='warning'>FAILURE: Authentication failed. Wrong password.</span>";
echo $loginform;
die("</div><!-- applicationarea end -->");
}
if (($siteuser == $formusername) AND ($siteuserpasswd == $formpassword))
{
$_SESSION['allowed'] = TRUE;
echo "<div class='adminbox'>";
echo menu();
echo "</div><!-- adminbox end -->";
echo "<div class='applicationarea'>";
echo "<h1>Greetings 0' exalted one, my master!</h1>";
// Adminforms below...
$sectionid = (isset($_GET['sectionid']) && is_numeric($_GET['sectionid'])) ? $_GET['sectionid'] : "failure";
echo $sectionid;
if ($sectionid == 1)
{
echo "<div class='applicationarea'>";
echo "Welcome to section 1!";
die("</div><!-- applicationarea end -->");
}
die("</div><!-- applicationarea end -->");
}
}
}
else {
echo "<div class='applicationarea'>";
echo $loginform;
die("</div><!-- applicationarea end -->");
}
?>
When I arrive after log-in, I see the "failed" message. Fair enough as no links has been clicked. But when I click the second menulink from the top, it just tosses me straight out to the log-in prompt.
Why can't I get to the "Welcome to section 1" message? Why does $_GET not get set?
. The problem is elsewhere. The content of $$row itself becomes a variable then set to the content of the "param" field in the same row afterwards.