ok here is my login page...
<html>
<head>
<title>Welcom to Carsales Warehouse</title>
</head>
<body bgcolor="black" style="color:white;">
<h2 align="center">Login</h2>
<?php
include ('connect.php');
error_reporting(0);
?>
<form Method="POST" ACTION="login.php">
<table border="2" align="center">
<tr>
<td>Username :</td><td><input name="username" type="text" maxlength="6"></input></td>
</tr>
<tr>
<td>Password :</td><td><input name="password" type="password" maxlength="6"></input></td>
</tr>
</table>
<p align="center">
<input type="submit" name="login" value="Log in">
</input>
</p>
</form>
<?php
$Login = $_POST['login'];
$username = $_POST['username'];
$password = $_POST['password'];
if (isset($_POST['login'])) {
$result = mysql_query("SELECT * FROM user WHERE username='$username' AND password='$password'");
if($result) {
if(mysql_num_rows($result) == 1) {
session_start();
$_SESSION['username'] = "$username";
header("location:insert.php");
}
else
echo "<p align = 'center'>Incorect login! Please try again, or proceed to <a href='Register.php'> Register </a></p>";
}
}
?>
</body>
</html>
Then I've changed my insert page to...
<html>
<head>
<title>Welcom to Carsales Warehouse</title>
</head>
<body bgcolor="black" style="color:white;">
<h2 align="center">Insert Vehicle</h2>
<?php
error_reporting(0);
if(!isset($_SESSION['username'])){
header("location:login.php");
}
include ('connect.php');//Includes database connection details
?>
<form Method="POST" ACTION="insert.php">
<table border="2" align="center">
<tr>
<td>Manufacturer</td><td><input name="manufacturer" type="text"></input></td>
</tr>
<tr>
<td>Make</td><td><input name="make" type="text"></input></td>
</tr>
<tr>
<td>Year:</td><td><input name="year" type="text"></input></td>
</tr>
<tr>
<td>Price</td><td><input name="price" type="text"></input></td>
</tr>
</table>
<p align="center">
<input type="submit" name="insert" value="Insert">
</input>
</p>
</form>
<?php
//Define variable submitted by the form
$Insert = $_POST['insert'];
$manufacturer = $_POST['manufacturer'];
$make = $_POST['make'];
$year = $_POST['year'];
$price = $_POST['price'];
if (isset($_POST['insert'])) {
$result = mysql_query("SELECT manufacturer FROM cars WHERE manufacturer='$manufacturer'");
$num_rows = mysql_num_rows($result);
if($num_rows > 0){ //if number of rows is more thatn 0, the below will execute
echo "<p align='center'>The vehicle $manufacturer already exists!</p>";
}
else{
$query = "INSERT INTO cars (manufacturer, make, year, price) VALUES ('$manufacturer', '$make', '$year', '$price')";
$result = mysql_query($query);
if($result){
echo "<p align='center'>The vehicle $manufacturer, $make, $year, with a price of R $price has been inserted into the database!</p>";
}
else{
echo "no luck";
}
}
}
?>
</body>
</html>
So now it is preventing the user from entering the site if he clicks on the insert link, but when the user now tries to login with his details, he is kept on the login page and not redirected the the insert page. I have taken out the php code from my connect.php page. So on my login page i start the session and then set $_SESSION['username'] = "$username";
