form with variable hidden values

[ahaze]

Hi there,

A warning up front: I'm trying to modify code written by someone else and I don't know PHP. Ha! Thank you in advance for any help you can offer.

I am editing a website where users login to download media files - audio files are kept in the audio directory, video files in the video directory. The site owner initially had it set up so that there was a form for each: users would enter the appropriate user/pass combo in the audio form to be taken to a php page that listed the contents of the audio directory. If they wanted the video directory, they had to login using the video form. (There is one user/pass combo for each.)

They were told that separate forms were unnecessary and redundant, and now they realize that's true. My job is to modify the code so there's only one form, and the user/pass entered determines which directory contents are displayed.

Here's what the code looks like now:

$page ="";
$login="";
$password="";
$dir="";
if (isset($_GET['page']))
{
      $page = $_GET['page'];
   }

if (isset($_POST['login']))
{
      $login = $_POST['login'];
      $password = $_POST['password'];
      $dir = $_POST['dir'];
   }

   include("header.inc");

If ($page =='pickup' AND $login == "video" AND $password == "bob" AND $dir =="video" ) 
{include "video.php";}

Elseif ($page =='pickup' AND $login == "audio" AND $password == "frank" AND $dir =="audio" ) 
{include "audio.php";}

Then the pickup page, where the user logs in, looks like this:

<FORM ACTION="form.php?page=pickup" METHOD="post">
<TABLE BORDER=0>
	<TR>
		<TD ALIGN="right">Login:</TD>
		<TD><INPUT TYPE="text" NAME="login"></INPUT></TD>
	</TR>

<TR>
	<TD ALIGN="right">Password:</TD>
	<TD><INPUT TYPE="password" NAME="password"></INPUT>
	<input type="hidden" name="page" value="pickup" />
	<input type="hidden" name="dir" value="audio" />
	</TD>
</TR>

<TR>
	<TD ALIGN="right"></TD>
	<TD><INPUT TYPE="submit" VALUE="Login"></INPUT>
		<INPUT TYPE="reset" VALUE="Reset"></INPUT>
	</TD>
</TR>
</TABLE>
</FORM>

Then the same form again, except the directory value is "video".

How do I "combine" these into one form, where the directory value is determined based upon the user/pass entered?

I hope that makes sense - thank you!!

MOD EDIT: bbcode tags added to make code easier to read and analyze; please use these tags in the future!

[niroshan]

Hi ahaze,

Is this system has only two users? 😕

Im saying this because all the user name and the password has hard coded in to the system it self. strange 😃

In this case what you need to do is,

$page =""; 
$login=""; 
$password=""; 
$dir=""; 
if (isset($_GET['page'])) 
{ 
	$page = $_GET['page']; 
} 

if (isset($_POST['login'])) 
{ 
	$login = $_POST['login']; 
    $password = $_POST['password'];  

} 

include("header.inc"); 

if($page =='pickup' && $login == "video" && $password == "bob") 
	include "video.php";
elseif ($page =='pickup' && $login == "audio" && $password == "frank") 
	include "audio.php";

by the way whats the use of $page variable because it uses in both the conditions?

as for the HTML code remove dir hidden field.

Regards,
niroshan

[ahaze]

Yes that's correct, there are only 2 users in the system (actually now there are four, which is part of the reason for switching to only one form - as they add more users it doesn't make sense to have to add new forms for each!)

I know this is not the most elegant way to do this - I want to have an external password file so they aren't hard coded into the system - but that's going to require additional learning on my part! 😃

And you're completely right about the $page variable - totally unnecessary, so I removed it!!

Thank you for your help, niroshan - worked perfectly.