well, my usual practice on errors is to display all while in development and log real errors (but not warnings) on live.
Yes, you make a good point on like for password, that won't happen in my example due to the md5, but as a general practice, sure.
I have to admit I'm not terribly concerned about people who copy and paste, without trying to understand, but If you think that I should actually test out and ensure 100% accuracy on any tips/help I offer, I'll probably just not help anyone, I don't have the time for that. That is why I put the disclaimer on the top of my post.
Anyhows, special delivery for bradgrafelman - still never run or tested, however, but with the changes he recommended, and a couple of other items I missed:
<?php
session_start(); // must be called on every page in site, before any output (aside from headers) is sent
require 'connect_to_db_script.php'; // something to connect to the db
$error = '';
if ( $_POST && $_POST['login'] && $_POST['un'] && $_POST['pw'] ) // don't allow empty un or pw
{
/* Should have a table containing at least the following:
CREATE TABLE users
(
user_id int(11) NOT NULL auto_increment,
un varchar(32) NOT NULL, // allow up to 32 char long username
pw varchar(32) NOT NULL, // reccomend storing the pw as 6-16 chars in length, and MD5 it via either php or mysql upon insert.
PRIMARY KEY ( user_id )
);
If you use a different table structure (or have an existing one) modify the query below to suit it.
*/
$query = "SELECT user_id, un FROM users WHERE un = '".mysql_escape_string( $_POST['un'] )."' AND pw = '".mysql_escape_string( md5( $_POST['pw'] ) )."' LIMIT 1 ";
$result = mysql_query( $query ); // or die( mysql_error( ) ); // lets not show any errors
if ( $result )
{
if ( $user = mysql_fetch_assoc( $result ) )
{
$_SESSION['user'] = $user;
}
else
{
$error = "Invalid username or password.";
// you could also add a query here to check for if username exists, and if so just set "invalid password" as the error, but this would allow
// the verification of valid usernames by a hacker.
}
}
else
{
$error = "Login is unavilable as I messed up and messed with the db somehow";
}
}
else if ( isset( $_GET['logout'] ) )
{ // any page can have a link to this page (or any page with this script) with the get query: '?logout' (no value required) to log them out.
if ( isset( $_SESSION['user'] ) )
{
unset( $_SESSION['user'] );
}
}
if ( $_SESSION['user'] ) // could also check $_SESSION['user']['user_id'] if you plan to retain this array within session after user logs out for other data.
{
header( 'Location:logged_in.php' ); // send them to their logged in location page
// you could also just show the 'logged in content' here, if this is on a regular page.
// alternativly, if this is a function, then you could return the user array, or 'true' or similar to indicate the user is logged in
}
else
{
// if this is a function you could return 'false', or this form to be displayed, or even just display the form and return false both. depends on your structure.
// show login form
// this should be nested somewhere inside valid html > body tag
if ( !empty( $error ) )
{
?>
<p class='error'>ERROR: <?php echo $error?></p>
<?php
}
?>
<!-- pretty this up any way you want. tables are common, I prefer css -->
<form method='post' action='<?php echo $_SERVER['PHP_SELF']?>'>
<legend>Login</legend>
<label for='un'>Username:</label>
<input type='text' id='un' name='un' value='<?php echo htmlentities( $_POST['un'], ENT_QUOTES )?>' /><br />
<label for='pw'>Password</label>
<input type='password' id='pw' name='pw' /><br />
<input type='submit' name='login' value='Login' />
</form>
<?php
}
?>
