Error MSG: Undefined index: username

[jwhitbeck]

I am a relative newbie to PHP, and am working on a project that combines existing PHP code (login.php) with newly added random image zenphoto PHP code. When both are installed I three error msgs appear when the page loads. Since each of the two codes work fine by themselves, there must be a conflict between the two.

It appears the zenphoto code is causing the login.php code to run as if the user has submitted the login form. I’m not really sure what to change to address the issue. I will include the error msgs, the login.php, and the zenphoto php for the random image placement.

Any help with troubleshooting the issue would be greatly appreciated.

Thanks in advance,

Jon

Error msgs:

Notice: Undefined index: username in /mnt/local/home/mikeysatira/url_address/login.php on line 5

Notice: Undefined index: action in /mnt/local/home/mikeysatira/ url_address /login.php on line 26

Notice: Undefined index: username in /mnt/local/home/mikeysatira/ url_address /login.php on line 32

Login.php (minus table tags):

<?
$loginmessage = "";
if($_REQUEST['username'] != "")
{

if($filterloaded == false)
{
	include('inputfilter.php');
}

$TheFilter = new InputFilter(); 

$validUser = validateUser($TheFilter->process($_REQUEST['username']), $TheFilter->process($_REQUEST['password']));
if($validUser != '')
{
	$_SESSION['username'] = $TheFilter->process($_REQUEST['username']);
}
else
{
	$loginmessage = "logerror";
}
}
elseif($_REQUEST['action'] == 'logout')
{
	session_destroy();
	$_SESSION['username'] = "";
}
if($_SESSION['username'] == "" || $loginmessage != "" ) { ?>

<form action="<?= $thisform ?>" method="post">

<? if($loginmessage == "logerror") 
		  {
			echo("<p class=\"logbox\"><b>Your User name or password could not be verified. Please try again.</b></p>");
		  }
		?>

<?= $_SESSION['username'] ?></p>

	<?
		if($_SESSION['admin'] == 1)
		{
			echo("<p class=\"logbox\">You have logged in under an administrator's account.<br><a href=\"admin.php\">Click here</a> to enter the <b>D2W</b> administration section.</p>");
		}
	?>

<? } ?>

Top of page:

<? 

include('topinclude.php');

$thisform = "home2.php"; 

?>

Within page:

<? include('login.php'); ?>

Zenphoto

Top of page:

<?php define('ZENFOLDER', 'zp-core');
define('WEBPATH', 'zenphoto');
require_once(WEBPATH . "/" . ZENFOLDER . "/template-functions.php");
?>

Within page:

<?php $randomImage = getRandomImages();
$randomImageURL = getURL($randomImage);
echo "<a href='".$randomImageURL."' title='Random Picture...'>
<img src='". $randomImage->getSizedImage(getOption('image_size')) . "'
alt=\"random image\"\n" . $randomImage->getTitle() . '" /></a>'; 
?>

[big_nerd]

Notice's are basically just picky 'issues' from PHP.

You can do one of the following:

error_reporting(E_ALL & ~E_NOTICE);

You are getting the undefined index when a variable is not properly initialized.

Try something like:

if(isset($_REQUEST['username']))

This is the preferred method of checking if there was a POST/GET.

Also, I would recommend against using $REQUEST, as $REQUEST can and will pull cookies of the same name which is a major security risk.

I would use $GET and $POST instead.

Best of luck.

[jwhitbeck]

Thanks for your prompt reply. I guess one of the things I'm struggling with is how much effort to put into this. I want to learn php, but feel I'm doing a favor for someone that is beyond my skill set.

The login does appear to function even with the "pesky" error messages. I don't like the fact that the php code compromises the safety of the site/database. However, I'm wondering if the filter "inputfilter.php" is offering any protection.

I did some research & the inputfilter.php script seems to come from a mambo api site. It doesn't seem all that elegant, but perhaps that's my programming ignorance.
http://mambo-developer.org/api/nav.html?includes/pageNavigation.php.source.html

Could you offer any advice? Should I suggest to my friend that he scrap the current set up for something different? I'm concerned changes I make are going to muck up what currently exists.

Thanks very much!

-Jon