Hello,
I have some code for a login form which verifies if both fields are completed (username and login) and checks the database to see if the fields match up with what's in the MySQL table and if so proceeds to the testing page. This part seems to work ok, but I am also trying to set a timestamp for when they login and this isn't working. Here is my code:
<?php
ini_set("display_errors","1");
ERROR_REPORTING(E_ALL);
session_start();
$con = mysql_connect("localhost","username","pw") or die('Could not connect: ' . mysql_error());
mysql_select_db("DBName") or die(mysql_error());
// Same checking stuff all over again.
if(isset($_POST['submit'])) {
if(empty($_POST['username']) || empty($_POST['password']) ) {
echo "<h2 style='color:#0080b2;font-weight:bold;font-family:arial, helvetica, sans-serif;font-size:'12px';>Please fill in both your username and password to access your exam results.</h2>";
echo "<meta http-equiv='refresh' content='5; url=ExamLogin.php'>";
exit;
}
// Create the variables again.
$username = mysql_real_escape_string($_POST['username']);
$password = $_POST['password'];
// Encrypt the password again with the md5 hash.
// This way the password is now the same as the password inside the database.
//$pwid = md5($pwid);
// Store the SQL query inside a variable.
// ONLY the username you have filled in is retrieved from the database.
$query = "SELECT username,password,name
FROM Editor_Candidates
WHERE
password = '$password'
AND
username='$username'";
$result = mysql_query($query) or die(mysql_error());
if(mysql_num_rows($result) == 0) {
// Gives an error if the username/pw given does not exist.
// or if something else is wrong.
echo "<h2 style='color:#0080b2;font-weight:bold;font-family:arial, helvetica, sans-serif;font-size:'12px';>You have entered a username or password that does not match our database records. please try again. You will be redirected back to the login screen in 5 seconds.</h2> " . mysql_error();
echo "<meta http-equiv='refresh' content='5; url=EditorLogin.php'>";
exit();
/*
this would benefit from a redirect to a page giving better information to
the user and maybe logging some errors.
*/
} else {
// Now create an object from the data you've retrieved.
$row = mysql_fetch_object($result);
// You've now created an object containing the data.
// You can call data by using -> after $row.
// For example now the password is checked if they're equal.
// By storing data inside the $_SESSION superglobal,
// you stay logged in until you close your browser.
$_SESSION['name'] = $row->name;
$_SESSION['username'] = $username;
$_SESSION['sid'] = session_id();
// Make it more secure by storing the user's IP address.
$_SESSION['ip'] = $_SERVER['REMOTE_ADDR'];
// Now give the success message.
// $_SESSION['username'] should print out your username.
//move this to after your redirect further below..
//Update record with current time IF the account has never logged in before
$query = "UPDATE `Editor_Candidates`
SET `login_timestamp` = NOW()
WHERE `username` = '$username'
AND `password` = '$password'
AND login_timestamp = ''";
$result = mysql_query($query);
//Check if query ran succesfully
}
}
// Start a session. If not logged in will be redirected back to login screen.
if(!isset($_SESSION['username'])){
header("Location:EditorLogin.php");
exit;
}
echo "<div id='welcome'><h3>Welcome! You are now logged in " . $_SESSION['name'] . "</h3>";
?>
and the MySQL structure for the table
CREATE TABLE `Editor_Candidates` (
`name` text,
`username` text,
`password` varchar(10) default NULL,
`login_timestamp` date NOT NULL default '0000-00-00',
`user_id` int(11) NOT NULL auto_increment,
PRIMARY KEY (`user_id`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8 AUTO_INCREMENT=3 ;
hoping someone can offer assistance as to why the timestamp isn't being set.
