Hi Mr Floyd,
Congrats on the jump into the deep so to speak.
The main problem I see is the use of brackets in your query; you do not need them:
$query = "SELECT pcidip,datetime FROM users WHERE username='".$_POST[username]."';
Furthermore, you already assume that
1) The input is 'safe'
2) The username & password are correct
1] => There are people who will try to break your code. When they insert a partial query in your username / password fields, you run the risk that they break your code,and hack your site. Look into sanitizing your code
2] => What happens if the incorrect combo is inserted? You will get some errors. Do it in an if-then-else statement.
An example of how the process could qork:
// If the current user is not logged in
if($loggedin == 0)
{
// note that I wrote a sanitzing function that will test variables for validity which grabs the info from the POST array, called getvar()
$username = getvar("username", '', 2); // Try to get pass & username from the post / get arrays
$password = getvar("access", '', 2);
$password = md5($password);
$security = getvar('security', "", 2);
$security = md5($security);
if($username <> "" and $password <> "" and $security == $_SESSION['hashtext']) // Data has been submitted
{
$DBH = db_connect();
$login_query = "Select * from "._USERS_T_."
where
(u_name = '$username')
and (u_pass = '$password')
and (u_disabled = 0)";
$result = mysql_query($login_query) or handle_errors('LOGIN',__line__, mysql_error(), $login_query);
// Username = correct, password correct & user not banned from system
$NumRows = mysql_numRows($result);
if ($NumRows > 0) // ****** Details are correct ******
{
// do stuff
$loginmessage = "<h1>login succesfull</h1><p>You are now logged in.</p>";
$this_page['topmenu'][300] = "<a href=\""._LOGOUT_U_."\">Logout</a>";
}
else
{ // ****** Details zijn incorrect ******
$this_page['webcontent'] .= "
<h1>Incorrect Login</h1>
<p>This is not a registered username / password combination. Please try again.
</p>
}
