Well I started to just fix the one thing and I found I had to make a change that then required another change and then another. So basically I redid your entire block of code. Some of the changes were not necessary but as I was doing it I thought do it right and maybe you'll get something out of it.
<?php
error_reporting(E_ALL);
session_start();
if(isset($_POST['user']) {
$username=$_POST['user'];
$password=$_POST['pass'];
$con = mysql_connect("","","") or $message = 'Could not connect: ' . mysql_error();
mysql_select_db("", $con);
$ban_res = mysql_query("SELECT * FROM `ban` WHERE `ipban` = '" . $_SERVER['REMOTE_ADDR'] . "' AND `ban` = '" . $username . "'") or $message = 'Server Error: ' . mysql_error();
if(mysql_num_rows($ban_res) != 0) {
$message = "You are either ip banned or banned. If you are banned you will be unbanned within the next 5 days, but if you are ip banned you will need to email Sacred.";
}
else {
$user_res = mysql_query("SELECT * FROM `userslogin` WHERE `namesofusers` = '" . $username . "' AND `password` = '" . $password . "' LIMIT 1") or $error = 'Server Error: ' . mysql_error();
if (mysql_num_rows($user_res) == 0 ) {
$message = "We do not have that information in our database";
}
else {
$row = mysql_fetch_array($user_res)
// store session data
$_SESSION['user'] = $row['namesofusers'];
$_SESSION['hp'] = $row['hplevel'];
$_SESSION['coins'] = $row['coins'];
$_SESSION['tokens'] = $row['tokens'];
$_SESSION['attack'] = $row['attacklevel'];
$_SESSION['strength'] = $row['strengthlevel'];
$_SESSION['defense'] = $row['defenselevel'];
$_SESSION['range'] = $row['rangelevel'];
$_SESSION['magic'] = $row['magiclevel'];
$_SESSION['level'] = $row['cblevel'];
header('Location: town.php');
}
}
}
?>
First you will notice I set the error reporting for you. Leave it there till you're ready to put the site live then remove it. Or change "E_ALL" to "0" so the users do not see any error messages from the server.
Second, note that the above code does not echo any messages. I instead stored the messages in the "$message" variable that you can then echo where you need it in your HTML.
I removed one of the queries as there is no reason to query the same table twice like you had.
Also made the code check for banned ips and usernames before I runs the query on the "userlogin" table. No reason to run that query if the user is not allowed to access the data.
Hopefully you find that all to be a thought provoking rework.
Lastly I need to point out what looks to be another major error on your part
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Login</title>
</head>
<body>
<div class="leftmenu">
<?php include("links.php"); ?>
<?php include("session.php"); ?>
<!-- ect-->
and
<body bgcolor="#808080" ondblclick="showdb_alert()">
<table border="1" align="center">
<tr>
<th><a href="town.php">Town</a></th>
<th><a href="forum.php">Forums</a></th>
<th><a href="chatbox.php">Chat</a></th>
<th><a href="logout.php">Logout</a></th>
<?php include("session.php"); ?>
I assume that "session.php" has the [man]session_start[/man]. As such including it where you have in both those blocks of HTML is an absolute can not do. Read the manual on [man]session_start[/man] and you will find out you can not even output a single blank space before you call [man]session_start[/man] or it will fail. In your case you have a whole lot of html before [mansession_start[/man]. So get that "<?php include("session.php"); ?>" in line 1, before <!DOCTYPE>, and put absolutely nothing in front of it.
