[RESOLVED] Protecting pages that require a login

anaitis4

I need to ensure that certain pages in my site can't be seen unless a user is logged in. I had written a script to do this and it's not working. Here's the script:

<?php
if(!$_SESSION['username'] 
{
header(Location:'attendancelogin.php');
exit;
}
?>

When I log in on the site and click a link to a page that uses the template I created for pages that require a user to be logged in (which has the code above inserted into the <head> tag) I get this error:

Parse error: syntax error, unexpected ';' in C:\xampp\htdocs\osumusic\checkstudentattendance.php on line 7

Also, I just found out that I'm going to have to further protect certain pages on the site so that only admins can see these pages and not just regular members.

So...can anyone help me edit my code to ensure that users have to be logged in to see the page and also how do I need to change the code to only allow admins onto certain pages?

(I have it set up so there are 2 seperate tables in my database to handle each set of users, if that helps to clarify).

NogDog

You are missing the closing ")" of your if condition.

bradgrafelman

You've also got a quoting issue; the entire header string must be inside quotes, not just the URI you're redirecting them to.

anaitis4

Thanks so much. I fixed it! Don't knowhow I missed those little things. Thanks.

anaitis4

Ok, I thought the issue was fixed, but now it's kicking me out of pages even if I AM logged in. Any thoughts as to why?

bpat1434

is the session actually started?

anaitis4

I thought that the session was started, but maybe I'm missing something.
Here's the code for the page that checks the login:

//At the very top of the page:
<?php 
	include "include/session.php";
	include "include/z_db.php"; 
?>
//In the <head>:
<?php
if($_SESSION['username']) {
	header( 'Location: adminlogin.php' ) ;
}
?>

//In the <body>:
<?php

$username=mysql_real_escape_string($_POST['username']);
$password=mysql_real_escape_string($_POST['password']);

echo $username . " " . $password;

if($rec=mysql_fetch_array(mysql_query("SELECT * FROM users WHERE username='$username' AND password = '$password'"))){
	if(($rec['username']==$username)&&($rec['password']==$password)){
	 include "include/newsession.php";
            echo "<p class=data> <center>Successfully,Logged in<br><br><a href='logout.php'> Log OUT </a><br><br><a href=adminwelcome.php>Click here if your browser is not redirecting automatically or you don't want to wait.</a><br></center>";
     print "<script>";
       print " self.location='adminwelcome.php';"; // Comment this line if you don't want to redirect
          print "</script>";

			} 
	}	
else {

	session_unset();
echo "<font face='Verdana' size='2' color=red>Wrong Login. Use your correct Username and Password and Try <br><center><input type='button' value='Retry' onClick='history.go(-1)'></center>";

}
?>

And then here's the code for the include files....

session.php:

<?php
session_start();
session_register("session");
?>

newsession.php:

<?php
//error_reporting(E_ERROR | E_PARSE | E_CORE_ERROR);
$_SESSION['id']=session_id();
$_SESSION['username']=$username;

//echo $session['userid'];
?>

Does anybody see something I'm missing here?

bpat1434

Instead of using a self.location javascript redirect, how about using a <meta http-equiv="refresh" content="5;welcome.php" /> tag instead?

anaitis4

That didn't work. 🙁 I'm starting to think that it must be a problem with the template that controls these pages. Here's the code for the template:

THis is in the <head> section:

<?php 
if(!($_SESSION['username'])) 
{ 
header('Location:attendancelogin.php'); 
exit; 
} 
?>

Is there something that should be in here, such as session_start()? Something along those lines to do with sessions?

NogDog

It needs a session_start() before the $_SESSION array is referenced (unless that script is being included by another script that has already done the session_start()).

anaitis4

I tried that and entered the following code:

<?php 
session_start();
if(!($_SESSION['username'])) 
{ 
header('Location:adminlogin.php'); 
exit; 
} 
?>

It didn't kick me out to the login this time and I got through to the correct page so THAT's working. But at the top of the page I got this error message:

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at C:\xampp\htdocs\osumusic\deleteuser.php:6) in C:\xampp\htdocs\osumusic\deleteuser.php on line 7

Line 7 contains 'session_start();'

What, if anything, should I do about that?

leatherback

You need to make sure you do not output anything before you start your session. No space, <html> or anything else.

anaitis4

Ok, that fixed it and it is now successfully booting you out if you're not logged in and allowing access if you are. Great.

But it's still spitting out this eror message at the top of the page:
Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at C:\xampp\htdocs\osumusic\logout.php:2) in C:\xampp\htdocs\osumusic\include\session.php on line 2

The code IS working and here's the actual code:

<?php
session_start(); 
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<?php 
require 'db.php';
if(!($_SESSION['username'])) 
{ 
header('Location:adminlogin.php'); 
exit; 
} 
?>

Why is it still spitting out an error message?

leatherback

hm.. Could it be that your pages are saves as UTF-8? If so: make sure you do this without the encoding string; this is sent to the client before the script is run

bpat1434

No, the issue is the header call.

The [man]header/man needs to be called prior to ANY output (including HTML). So in the code you just posted, move the session check stuff above the Doctype declaration.

leatherback

bpat1434 wrote:
No, the issue is the header call.

The [man]header/man needs to be called prior to ANY output (including HTML). So in the code you just posted, move the session check stuff above the Doctype declaration.

true, but the warning comes from line 2, the session_start()... 😕

bpat1434

Well, if he showed us both files (deleteuser.php and logout.php) in their entirety and labeled them as such, we could probably pick the issue out.

anaitis4

Code for logout.php:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<?
include "include/session.php";
session_unset();
session_destroy();
?>
<html xmlns="http://www.w3.org/1999/xhtml">

//A bunch of CSS stuff I've ommitted would have been here....
//And then here's the <body>:
<?

echo "<center><font face='Verdana' size='2' >Successfully logged out. <br><br> <a href=attendancelogin.php>Login</a></font></center>";

?>     

<p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
      <p>&nbsp;</p>
    <!-- InstanceEndEditable --></td>
    <td width="6%" align="center" bordercolor="#666666">&nbsp;</td>
  </tr>
  <tr>
    <td>&nbsp;</td>
    <td align="center" valign="top"><p class="style2">©2008 Oklahoma State University Department of Music<br />
      132 Seretean Center  Stillwater, OK 74078-4077<br />
      405.744.6133** Fax:  405.7449324<br />
    Web Design by <a href="mailto:ashley.cain08@yahoo.com">A. Wladysh</a></p></td>
    <td>&nbsp;</td>
  </tr>
</table>
<script type="text/javascript">
<!--
var MenuBar1 = new Spry.Widget.MenuBar("MenuBar1", {imgRight:"../SpryAssets/SpryMenuBarRightHover.gif"});
//-->
</script>
</body>
<!-- InstanceEnd --></html>

deleteuser.php:

<?php
session_start(); 
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><!-- InstanceBegin template="/Templates/OSU ADMIN pwprotect template.dwt.php" codeOutsideHTMLIsLocked="false" -->
<head>
<?php 
require 'db.php';
if(!($_SESSION['username'])) 
{ 
header('Location:adminlogin.php'); 
exit; 
} 
?> 
<!-- InstanceBeginEditable name="EditRegion5" --><!-- InstanceEndEditable -->

//A bunch of CSS ommitted here....
//And currently I have nothing in the body of this page yet because I have no idea how to write this script yet. So....that's it.

Does that help at all?

bpat1434

The include of session.php is after browser output in logout.php. You have to do session_start() prior to ANY output (HTML, white-space, etc) otherwise the errors show up.

So move that include line up to the top of the logout.php file and you should be fine.

anaitis4

I did that. It's fixed!!! Thank you all soooo much for your help!