here's your revised code, revised a lil by me:
<?php
session_start();
if ( isset( $_POST['submit'] ) ) // they have submitted a login attempt
{
// store the posted username and password for easy reference. - we should realyl check they were posted too before doing this, however.
$uname = $_POST['username'];
$pass = $_POST['password'];
// note: you're using mysqli here, but it looks like regular mysql (no i) usage - not sure, I just use the regular mysql myself, but worth checking into i think.
$DBConnect = mysqli_connect( "localhost", "root", "now i'll have to change my password as I posted it in the previous example" );
if ( !$DBConnect )
die( "<p>The XAMPP MySQL database server is not available.</p>" );
$DBSelect = mysqli_select_db( $DBConnect, "my secret db name the public shouldn't know about" );
// not sure why you don't check for password match in this query also
$SQLQuery = "select password from users where userName = '".mysqli_real_escape_string( $uname )."'"; // escaped so people can't inject nasty sql (especially as they might know my login info from a previous forum post :P)
$ResultSet = mysqli_query( $DBConnect, $SQLQuery );
if ( $ResultSet ) // a little ambiguous to me - does this mean the query ran ok, or that it has a number of results?
{
$Row = mysqli_fetch_assoc( $ResultSet );
if ( $pass == $Row['password'] )
{
$_SESSION['logged'] = 1;
$_SESSION['username'] = $uname;
// should really check there is a referer before you send them to it - what happens if they have this page bookmarked, and just start on it?
header( "Location:".$_SERVER['HTTP_REFERER'] );
}
else
{
// do something here for existing un, but wrong password
// this is what you arent handeling atm.
/*
** YEAH HERE!! **
*/
}
}
else // this is where not even the username exists, i think - the if ( $resultSet ) check above isn't one I'd use so not sure without checking the docs
{
if ( ++$_SESSION['logged'] >= 3 ) // increment login attempts (should probably rename this to something more indicative
{
echo "You have attempted and failed to log in 3 times.<br />";
echo "Your account is frozen for the next 24 hours."; // sounds cool - don't see it actually happening yet though :)
// probably overkill, why destroy the session?
session_destroy();
unset( $_SESSION['logged'] );
// this probably shouldn't exist to unset, right?
unset( $_SESSION['username'] );
// exiting without doing proper html tags will result in a badly formed page, then again, you didn't open the right html tags before sending the message either :)
exit;
}
else // no such username, so show the form.
{
?>
<html>
<head>
<title>Log In - Retry</title>
</head>
<body>
<p>
Invalid Username and/or Password<br />
Please attempt to log in again<br /><br />
<!-- odd to have a form inside a p tag -->
<form action="login.php" method="post">
Username: <input type="text" name="username" /><br />
Password: <input type="password" name="password" /><br />
<input type="submit" name="submit" value="Log In" />
</form>
</p>
<!-- missing the end of the page i think, unless it will be provided elsewhere - ahh it is at the very bottom -->
<?php
}
}
}
else
{ // form not posted
$_SESSION['logged'] = 0; // why reset this now? this means they can make 2 attempts, then refresh the page without posting to reset their attempts...
?>
<!-- odd to start with an end body tag -->
</body>
</html>
<html>
<head>
<title>Log In</title>
</head>
<body>
<p>
Please Log In<br /><br />
<form action="login.php" method="post">
Username: <input type="text" name="username" /><br />
Password <input type="password" name="password" /><br />
<input type="submit" name="submit" value="Log In" />
</form>
</p>
<?php
}
?>
</body>
</html>
