Pledge Database Login

r2ks

Hello everyone ( I am a newbie ) here is my question I am createing a pledge tracking website. when the user Logs in they will see there pledges and no one elses this is where they will add or delete information.
When they login i need to use a query statment which i understand my problem is where in the Code would i place this query statment.

<?php require_once('Connections/myserver.php'); ?>
<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "") 
{
  $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;

  $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;    

    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  }
  return $theValue;
}
}
?>
<?php
// *** Validate request to login to this site.
if (!isset($_SESSION)) {
  session_start();
}

$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($_GET['accesscheck'])) {
  $_SESSION['PrevUrl'] = $_GET['accesscheck'];
}

if (isset($_POST['username'])) {
  $loginUsername=$_POST['username'];
  $password=$_POST['Password'];
  $MM_fldUserAuthorization = "login_id";
  $MM_redirectLoginSuccess = "sucess.php";
  $MM_redirectLoginFailed = "fail.html";
  $MM_redirecttoReferrer = false;
  mysql_select_db($database_myserver, $myserver);

  $LoginRS__query=sprintf("SELECT username, password, login_id FROM login WHERE username=%s AND password=%s",
  GetSQLValueString($loginUsername, "text"), GetSQLValueString($password, "text")); 

  $LoginRS = mysql_query($LoginRS__query, $myserver) or die(mysql_error());
  $loginFoundUser = mysql_num_rows($LoginRS);
  if ($loginFoundUser) {

$loginStrGroup  = mysql_result($LoginRS,0,'login_id');

//declare two session variables and assign them
$_SESSION['MM_Username'] = $loginUsername;
$_SESSION['MM_UserGroup'] = $loginStrGroup;	      

if (isset($_SESSION['PrevUrl']) && false) {
  $MM_redirectLoginSuccess = $_SESSION['PrevUrl'];	
}
header("Location: " . $MM_redirectLoginSuccess );
  }
  else {
    header("Location: ". $MM_redirectLoginFailed );
  }
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Untitled Document</title>
<link href="new.css" rel="stylesheet" type="text/css" />
</head>

<body>
<form ACTION="<?php echo $loginFormAction; ?>" id="form1" name="form1" method="POST">
  <p>&nbsp;</p>
  <p>&nbsp;</p>
  <div id="form">
    <p>Welcome to my login form</p>
    <p>Username:
      <input name="username" type="text" id="username" />
        </p>
    <p>Password:
      <input name="Password" type="text" id="Password" />
    </p>
    <p>
      <input type="submit" name="Submit" value="Submit" />
    </p>
    <p>&nbsp;</p>
  </div>
  <p>&nbsp;  </p>
</form>
</body>
</html>

Inkeye

I understand your question.

As a general rule, I always do all the processing up front, at the top of the code, and then I put the actual HTML at the end and insert variables as necessary.

<?php require_once('Connections/myserver.php'); ?>
<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "") 
{
  $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;

  $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;    

    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  }
  return $theValue;
}
}
?>
<?php
// *** Validate request to login to this site.
if (!isset($_SESSION)) {
  session_start();
}

$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($_GET['accesscheck'])) {
  $_SESSION['PrevUrl'] = $_GET['accesscheck'];
}

if (isset($_POST['username'])) {
  $loginUsername=$_POST['username'];
  $password=$_POST['Password'];
  $MM_fldUserAuthorization = "login_id";
  $MM_redirectLoginSuccess = "sucess.php";
  $MM_redirectLoginFailed = "fail.html";
  $MM_redirecttoReferrer = false;
  mysql_select_db($database_myserver, $myserver);

  $LoginRS__query=sprintf("SELECT username, password, login_id FROM login WHERE username=%s AND password=%s",
  GetSQLValueString($loginUsername, "text"), GetSQLValueString($password, "text")); 

  $LoginRS = mysql_query($LoginRS__query, $myserver) or die(mysql_error());
  $loginFoundUser = mysql_num_rows($LoginRS);
  if ($loginFoundUser) {

$loginStrGroup  = mysql_result($LoginRS,0,'login_id');

//declare two session variables and assign them
$_SESSION['MM_Username'] = $loginUsername;
$_SESSION['MM_UserGroup'] = $loginStrGroup;	      

if (isset($_SESSION['PrevUrl']) && false) {
  $MM_redirectLoginSuccess = $_SESSION['PrevUrl'];	
}
header("Location: " . $MM_redirectLoginSuccess );
  }
  else {
    header("Location: ". $MM_redirectLoginFailed );
  }
}


//PUT YOUR NEW QUERY HERE:
$PledgeSQL = sprintf("SELECT * FROM dbo.pledges WHERE USER = %s",
  GetSQLValueString($_SESSION['MM_Username'], "text"));

  $Pledges = mysql_query($PledgeSQL, $myserver) or die(mysql_error());
  $pledgesFound = mysql_num_rows($Pledges);
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Untitled Document</title>
<link href="new.css" rel="stylesheet" type="text/css" />
</head>

<body>
<form ACTION="<?php echo $loginFormAction; ?>" id="form1" name="form1" method="POST">
  <p>&nbsp;</p>
  <p>&nbsp;</p>
  <div id="form">
    <p>Welcome to my login form</p>
    <p>Username:
      <input name="username" type="text" id="username" />
        </p>
    <p>Password:
      <input name="Password" type="text" id="Password" />
    </p>
    <p>
      <input type="submit" name="Submit" value="Submit" />
    </p>
    <p>&nbsp;</p>
  </div>
  <p>&nbsp;  </p>
</form>

<table>
<tr>

<?php
//Now loop through your results here
?>

</tr>
</table>



</body>
</html>
<?php  //FREE the results and close your connection to the DB here ?>