Older versions works on both PHP4/5 with register_globals ON (If not, then used Emulating Register Globals code).
Recently, I decided that the script next version should be fully PHP5 compatible. Should have done that years ago.
I have mostly been able to re-code almost every php files.
Now I have a problem STAYING LOGGED IN. I can log-in to the account area BUT when I click on any link, I get the Unauthorized Page. This was not a problem with register globals ON.
I have tried several suggestions, tips, etc on many forums, websites relating to register globals being OFF.
It seem to me that the problem is $check or function authenticate unless I'm wrong.
index
$check = authenticate ($EMAIL,$PASSWORD);
if ($_GET['action'] == "")
{
$include = "main.php";
$view = "Welcome";
}
if($_GET['action'] == "login")
{
//if($_GET['check'] > 0)
if($check > 0)
{
$include = "members.php";
$view = "Advertiser Area";
}
else
{
$include = "login.php";
$view = "Login";
}
}
if($_GET['action'] == "members")
{
$include = "members.php";
$view = "Advertiser Area";
}
if($_GET['action'] == "failed")
{
$include = "failed.php";
$view = "Login Failed";
}
if($_GET['action'] == "unauthorized")
{
$include = "unauthorized.php";
$view = "Illegal Access";
}accountarea
if ($check == 0)
//if($_REQUEST['action'] = "check" == 0)
{
?><HEAD>
<SCRIPT language="JavaScript1.1">
<!--
location.replace("index.php?action=unauthorized");
//-->
</SCRIPT>
</HEAD>
<?
}
?>
forms
if ($_GET['action'] == "logout")
{
setcookie("EMAIL","", time() - 3600);
setcookie("PASSWORD","", time() - 3600);
$_GET['action'] = "";
}
if(isset($_POST['login']))
{
$user_email = mysql_escape_string($_POST['user_email']);
$pass = mysql_escape_string($_POST['pass']);
//setcookie ("EMAIL",$user_email);
//setcookie ("PASSWORD",$pass);
setcookie ("EMAIL",$user_email, time()+3600*24);
setcookie ("PASSWORD",$pass, time()+3600*24);
$check = authenticate($user_email,$pass);
if($check > 0)
//if($_REQUEST['action'] = "check" > 0)
{
$EMAIL = mysql_escape_string($_POST['user_email']);
$PASSWORD = mysql_escape_string($_POST['pass']);
$_GET['action'] = "members";
}
else
{
$_GET['action'] = "failed";
}
}functions
function authenticate($email,$pass)
{
$sql = "SELECT * FROM users WHERE email = '".sql_quote($email)."' AND pass = '".sql_quote($pass)."'";
$query = mysql_query($sql) or die (mysql_error());
$numrows = mysql_num_rows($query);
if ($numrows > 0)
{
return true;
}
else
{
return false;
}
}