[RESOLVED] Sessions and Logins

mhodge87

I have some code on a login.php page. It is below: Keep in mind session_start() is at the top of the script page.

If ($rows > 0)
			{		
			//start session and put CID in session variable


		$_SESSION['scid'] = $cid; 

		//get users name
		$name = sprintf("SELECT firstn, lastn FROM userinfo WHERE cid='%s'", 
			mysql_real_escape_string($cid, $con));

		$_SESSION['sname'] = $name; 

		//get admin status

		$admin = sprintf("SELECT admin FROM status WHERE cid='%s'", 
			 mysql_real_escape_string($cid, $con));

		$_SESSION['sadmin'] = $admin; 

		//get visiting controller status

		$vc = sprintf("SELECT vc from  status where cid='%s'", 
		  mysql_real_escape_string($cid, $con));

		$_SESSION['svc'] = $vc; 

		mysql_close($con);

		echo("<p> Login Successful! Click <a href = 'index.php'> Here </a> to go back to the main page </p>");
		}
		else {
		echo("<p> Login Unsucessful! </p>"); }

Then on the index.php page. It says:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>

<body>
<center>
<?php 
if (!isset($_SESSION['sname']))
	{
	echo("Welcome " . $_SESSION['sname'] . $_SESSION['scid']);
}


?>
<a href="newatc.html"> New ATC click here! </a><br />
<A href="roster.php"> ATC Roster </A> <br />
<A href="login.html"> Click here to login </A>
</center>
</body>
</html>

I'm trying to get the users name and CID to display. It dosen't. On the index.php page it dosen't display anything except the links. Any tips?

benracer

<?php
if($rows == 1) // only one should be returned to have the correct username and password 
            {         

        $name = "SELECT * FROM userinfo WHERE cid='$s' "; // $s should be exact to the username
		$result = mysql_query($name) or die(mysql_error()); // run the query and set in to $resut
		$row=mysql_fetch_array($result); // split the results 

        $_SESSION['sname'] = $row['sname']; // insert data into sessions
		$_SESSION['sadmin'] = $row['sadmin'];  // repeat for each one
		$_SESSION['svc'] = $row['svc'];
		$_SESSION['scid'] = $row['scid']; 


        mysql_close($con); // not needed as db will close its self 

        echo("<p> Login Successful! Click <a href = 'index.php'> Here </a> to go back to the main page </p>"); 
        } 
        else { 

        echo("<p> Login Unsucessful! </p>"); } 

?>

also make sure that session_start() is on every page you use a session, i say this as i cannot see it on the index page.

Not tested but i believe should work

mhodge87

<?Php session_start() ?>

is at the very top of index.php. However, it still does not pass any session variables. Could it be a config issue with apache?

benracer

where have you had the script from, try the one i created as that uses a better way of returning data from the db instead of 3 seperate querys for the same row.
This will not return a value...

 $admin = sprintf("SELECT admin FROM status WHERE cid='%s'", 
                 mysql_real_escape_string($cid, $con));

as it will not even send the query to the database. all that does is set the variable ADMIN to the string (which is the query) and then escape any ".

For a query to be passed to the db something along the lines this

mysql_query($admin)

mysql_query("SELECT admin FROM status WHERE cid='%s'" )

is needed.

mhodge87

benracer wrote:
where have you had the script from, try the one i created as that uses a better way of returning data from the db instead of 3 seperate querys for the same row.
This will not return a value...
 $admin = sprintf("SELECT admin FROM status WHERE cid='%s'", 
                 mysql_real_escape_string($cid, $con));
as it will not even send the query to the database. all that does is set the variable ADMIN to the string (which is the query) and then escape any ".

For a query to be passed to the db something along the lines this
mysql_query($admin) 
or
mysql_query("SELECT admin FROM status WHERE cid='%s'" )
is needed.

Thanks ben. I keep forgetting to do that! I think I can figure it out from here. I still get an error, but i think i got it covered 🙂

benracer

What error are you getting?

benracer

My mistake sorry!

mhodge87

it won't display my name from my query. This is what I have for the name

//get users name
			$query = sprintf("SELECT firstn, lastn FROM userinfo WHERE cid='%s'", 
				mysql_real_escape_string($cid, $con));
			$name = mysql_query($query, $con) or die("There was an error in your name query: " . mysql_error());
			$_SESSION['sname'] = $name;

On the output page it just displays Welcome 0961044. 961044 is the example CID, and 0 is where the first and last name should be. It should be, in this example.

Michael Hodge 961044

benracer

why are you using mysql_real_escape_string ?

bradgrafelman

benracer wrote:
look at cid='%s', this will return any row where cid contains a value where the first letter is s.

isnt it supposed to be cid='$s' ?

No; '%s' tells [man]sprintf/man to insert a string value at that point.

mhodge87: [man]mysql_query/man doesn't return data from a MySQL result set. As you'll note in the manual, it returns a resource (to be used with [man]mysql_result/man, for example, which would give you the data from a row).

mhodge87

$query = sprintf("SELECT firstn, lastn FROM userinfo WHERE cid='%s'", 
				mysql_real_escape_string($cid, $con));
			$result = mysql_query($query, $con) or die("There was an error in your name query: " . mysql_error());
			$name = mysql_result($result, 0);

It works, but it only outputs the firstn not the last one

bradgrafelman

Right; you're storing the name in two separate columns, so you'll need to call mysql_result() twice, specifying the third parameter so that you can get the data from both columns.

Alternatively, you can use [man]mysql_fetch_assoc/man to fetch both columns at once (into an associative array).

Also, since you're only expecting one row, you could add a "LIMIT 1" onto the end of your query (and don't use a while() loop as is common when using the mysql_fetch_assoc() function).

mhodge87

Brad, I did this and it works. Don't know if its the most "preferred" way, but it did work

//get users name
			$query = sprintf("SELECT firstn, lastn FROM userinfo WHERE cid='%s'", 
					 mysql_real_escape_string($cid, $con));
			$result = mysql_query($query, $con) or die("There was an error in your name query: " . mysql_error());
			$row = mysql_fetch_row($result);
			$name = $row[0] . " " . $row[1];

bradgrafelman

That'll work, just make sure if you edit the SQL query that the column indexes (0 and 1) don't change. I usually use [man]mysql_fetch_assoc/man so I don't have to worry about the column indexes and can simply use $row['firstn'], etc.

So, does that resolve your issue? If so, don't forget to mark this thread resolved.

mhodge87

yep, thanks!