Hey there guys and girls.
I'm currently experiencing problems with a system i'm coding. Basically, it's a talent bank system. This allows radio presenters to register their details and upload their demo mp3's so that potential employers can find them.
Everything is working okay apart from the upload mp3 section.
When the user first logs in, a session is created and their username is checked against the database. After this they're directed to their profile page (secure.php).
This all works fine, and the sessions stay intact. BUT, there comes a problem when the user uploads the mp3. The session is lost.
Here are snippets of my code:
// auth.php
// start session
session_start();
// convert username and password from _POST or _SESSION
if($_POST){
$user = $_SESSION['user']=$_POST["user"];
$pass = $_SESSION['pass']=$_POST["pass"];
$mdpass = md5($pass);
}else{
if($_SESSION){
$user = $_POST['user']=$_SESSION['user'];
$pass = $_POST['pass']=$_SESSION['pass'];
$mdpass = md5($pass);
}
}
// query for a user/pass match
$sql = "SELECT * FROM `MY_DB_NAME`.`users` WHERE `users`.`user` = '$user' AND `users`.`pass` = '$mdpass' LIMIT 1;";
$result=mysql_query($sql) or die(mysql_error());
while ($row = mysql_fetch_array($result)){
$active = $row['active'];
$firstlogin = $row['firstlogin'];
$id = $row['id'];
}
// retrieve number of rows resulted
$num=mysql_num_rows($result);
// print login form and exit if failed.
if($num < 1){
header("location:default.php?msg=1"); // wrong user/password error
exit;
}
echo "38";
if ($active == "1"){
}else{
if($active == "0"){
header("location:default.php?msg=2"); // user not activated
}
}
if ($firstlogin == "0"){
$sql = "SELECT * FROM `MY_DB_NAME`.`users` WHERE `users`.`id` = '$id' LIMIT 1;";
$result = mysql_query($sql) or die(mysql_error());
while ($row = mysql_fetch_array($result)){
$id = $row['id'];
$email = $row['email'];
} // end of while block
// Define Variables
$about = "Write a little about yourself here. Do not include any HTML";
$demo = "users/demos/nodemo.mp3";
$paypal = $email;
$picture = "users/pictures/nopicture.jpg";
$testimonial = "No Testimonials Received";
$availability = "Write your availability here";
$ip = "No IP recorded. This is your first login";
// Build Query
$sql = "INSERT INTO `MY_DB_NAME`.`profileinfo` (`id`, `userid`, `email`, `aboutme`, `demourl`, `paypal`, `picture`, `testimonial`, `avail`, `lastip`) VALUES (NULL, '$id', '$email', '$about', '$demo', '$paypal', '$picture', '$testimonial', '$availability', '$ip');";
$result = mysql_query($sql) or die(mysql_error());
$sql = "UPDATE `MY_DB_NAME`.`users` SET `firstlogin` = '1' WHERE `users`.`id` = '$id' LIMIT 1;";
mysql_query($sql) or die (mysql_error());
echo '<div align="center"><b>Alert:</b>First Login.. New Profile Created!</div>';
}else{ // User has logged in before.
$ip = $_SERVER['REMOTE_ADDR'];
$sql = "UPDATE `MY_DB_NAME`.`profileinfo` SET `lastip` = '$ip' WHERE `profileinfo`.`userid` = '$id' LIMIT 1;";
mysql_query($sql);
}
<?
// ADDMP3.PHP
include('talent_connect.php'); // The DB Connect File
include('auth.php'); // The Above Auth File
include('gather_profile.php'); // An SQL query
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Untitled Document</title>
<style type="text/css">
<!--
body,td,th {
font-family: Arial, Helvetica, sans-serif;
font-size: 10px;
color: #666666;
}
.style1 {
font-size: 12;
font-weight: bold;
}
.style4 {
color: #000000;
font-style: italic;
font-weight: bold;
}
.style5 {color: #000000}
.style11 {color: #000000; font-weight: bold; }
-->
.dynamic{padding-left:3px;padding-right:3px;}
</style></head>
<body>
<div align="center">
<p><em><strong>You are logged in from: <? echo $lastip; ?></strong></em><br />
<br />
<? include('nav.php'); ?></p>
<p>Upload your MP3 Demo:</p>
<table width="278" border="0" cellspacing="0" cellpadding="0">
<tr>
<td colspan="2" valign="top" bgcolor="#CCCCCC"><div align="center"><form action="uploadmp3.php" method="post" enctype="multipart/form-data">
File:
<input type="file" name="file" />
<br />
<input type="submit" name="Submit" value="Upload" /></form>
</div></td>
</tr>
</table>
<p> <br />
</p>
</div>
</body>
</html>
<?
// UPLOADMP3.PHP
include('talent_connect.php');
include('auth.php');
include('gather_profile.php');
$wd = getcwd();
$nname = "$username-$userid.mp3";
echo "<br><br>";
if (move_uploaded_file($_FILES['file']['tmp_name'], ''.$wd.'/users/demos/'.$nname.'')) {
//move_uploaded_file ($_FILES['file'] ['tmp_name'],
//"".$wd."/users/demos/{$_FILES['file'] ['".$nname."']}") ){
echo "uploaded!";
}else{
switch ($_FILES['file'] ['error'])
{ case 1:
print '<p> The file is bigger than this PHP installation allows</p>';
break;
case 2:
print '<p> The file is bigger than this form allows</p>';
break;
case 3:
print '<p> Only part of the file was uploaded</p>';
break;
case 4:
print '<p> No file was uploaded</p>';
break;
}}
?>
So as you can see. The user gets to the addmp3.php page.. Then there, there's a form. They choose a file on their hard disc, and then "uploadmp3.php" uploads the mp3 file to the server... Only it doesn't. It re-directs me to the login form saying i have a wrong username and password ($msg=1).
Any sort of help or direction would be very much appreciated 🙂
Thanks,
Davey C
