Hey Guys i have a problem with my site i'm coding.
I'm building a social community site which is catered to our business but i'm having a few snags.
There is a user panel where a user can view and check emails and so on but it in an iframe
what i want to achieve is that a user should log in and be able to work with the site using that panel to interface with the parts of the site that is spesific to that control panel. ( which works to a certain point )
my problem is i'm using a Logged.php file to verify that the user is logged in and his credentials is correct to use the userpanel and the user spesific pages.
i include this logged.php file into the pages i want to protect and if its not met it should redirect him to the main index and the login screen should display in the iframe.
what happens now is if the credential is not met it redirects me to the login.php file and only shows that content that was suppose to show in the iframe.
any ideas on how i can overcome this?
this is the logged.php i include on all my protected pages.
<?php
//Checks if cookies been set
if (isset($_COOKIE['nlgebruiker']) && isset($_COOKIE['nlwagwoord']) && isset($_COOKIE['nltoken'])){
$_SESSION['nlemail']=$_COOKIE['nlgebruiker'];
$_SESSION['nlpassword']=$_COOKIE['nlwagwoord'];
$_SESSION['nltoken']=$_COOKIE['nltoken'];
}
// test the if Session or cookie data is valid
if ((strlen($_SESSION['nlemail']) == 0) or (strlen($_SESSION['nlpassword']) == 0) or (strlen($_SESSION['nltoken']) == 0)){
header('location: login.php');
} else { if (isset($_SESSION['nlemail']) && isset($_SESSION['nlpassword']) && isset($_SESSION['nltoken'])){
$user=$_SESSION['nlemail'];
$pass=$_SESSION['nlpassword'];
$token=$_SESSION['nltoken'];
$query=("select * from useraccounts where email='$user' and password='$pass' and token='$token';");
$results=mysql_query($query);
if ( mysql_numrows($results) <> 1 ) { //test if data is valid
//unsets info and redirect back to the logon page.
unset($_SESSION['nlemail']);
unset($_SESSION['nlpassword']);
unset($_SESSION['nltoken']);
unset($_SESSION['nlsession']);
$_SESSION = array(); // reset session array
session_destroy(); // destroy session.
header('location: login.php');
} else {
$today=date("Y-m-d");
$update=("update useraccounts set last_login='$today' where email='$user';");
mysql_query($update);
$info=mysql_fetch_array($results);
$_SESSION['username']=$info['username'];
$_SESSION['viewed']=$info['viewed'];
$_SESSION['nlsession']=true;
}
}}
?>
