Intranet log in system

Dicko

Hello,

I am a student who has a Intranet site as my project to build, in fact I have been on with this for about a year :o
I originally built the site using html in Dreamweaver great no problem, but then came the bug bear to my problem. I found out to make a good secure log in system I needed to use php along with MySql, either of which I have never touched on and my tutor who gave me the project has never used either.
So I bought some books to try and teach myself used many websites that are out there and feel no further forward. In face got so fed up from August till January I didn't even touch it.
I have stripped it down and rebuilt it so many times. This is my current Index.php page.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>intranet</title>

<style type="text/css">
<!--
.style1 {
	font-size: 18px;
	font-weight: bold;
	color: #000000;
}
.style2 {font-size: 36px}
-->
</style>
<link href="*" rel="stylesheet" type="text/css" />
<link href="style1.css" rel="stylesheet" type="text/css" />
<style type="text/css">
<!--
.style3 {
	color: #FFFFFF
}
-->
</style>
<link href="*" rel="stylesheet" type="text/css" />
<link href="style1.css" rel="stylesheet" type="text/css" />
</head>
<body>
<div class="background"></div>
<div id="container">

<div id="Banner"></div>
<div id="navbar">Globel IT News
  <script language="JavaScript" src="http://www.feedbucket.com/js.php?src=http%3A%2F%2Fwww.theregister.co.uk%2Fscience%2Frotm%2Fheadlines.atom&chan=y&desc=1&date=y" type="text/javascript"></script></div>
   <div class="style3" id="announcement">College Announcments and Pupil Achievments</div>
<div id="text">

    <h3 align="center" class="style1 style2">Welcome To</h3>
    <p align="center" class="style1 style2">Darlington College and Teesside University</p>
    <p align="center" class="style1 style2">School of Computing</p>
    <h3 align="center" class="style1 style2">Our Future Is In Your Hands</h3>
    <p>&nbsp;</p>
    <p>&nbsp;</p>
    <p>&nbsp;</p>
    <link href="styles.css" rel="stylesheet" type="text/css">
    <?php
    //allow sessions to be passed so we can see if the user is logged in
    session_start();

   //connect to the database so we can check, edit, or insert data to our users table
       $dbname = 'a6346544_phplog';
       $con = mysql_connect("mysql13.**********.com","user","pass") or die(mysql_error());
       $db = mysql_select_db($dbname, $con) or die(mysql_error());

  //include out functions file giving us access to the protect() function
  include "./functions.php";


	//If the user has submitted the form
	if($_POST['submit']){
		//protect the posted value then store them to variables
		$username = protect($_POST['username']);
		$password = protect($_POST['password']);

		//Check if the username or password boxes were not filled in
		if(!$username || !$password){
			//if not display an error message
			echo "<center>You need to fill in a <b>Username</b> and a <b>Password</b>!</center>";
		}else{
			//if the were continue checking

			//select all rows from the table where the username matches the one entered by the user
			$res = mysql_query("SELECT * FROM `users` WHERE `username` = '".$username."'");
			$num = mysql_num_rows($res);

			//check if there was not a match
			if($num == 0){
				//if not display an error message
				echo "<center>The <b>Username</b> you supplied does not exist!</center>";
			}else{
				//if there was a match continue checking

				//select all rows where the username and password match the ones submitted by the user
				$res = mysql_query("SELECT * FROM `users` WHERE `username` = '".$username."' AND `password` = '".$password."'");
				$num = mysql_num_rows($res);

				//check if there was not a match
				if($num == 0){
					//if not display error message
					echo "<center>The <b>Password</b> you supplied does not match the one for that username!</center>";
				}else{
					//if there was continue checking
											//redirect them to the usersonline page
					if ($YearofStudy=="Year 1") 
                        { 
                         header("location: 1st Year.php"); 
                       } 

                   else 
                       { 
                         header("location: Year2Homepage.php");

					//split all fields fom the correct row into an associative array
					$row = mysql_fetch_assoc($res);

					//check to see if the user has not activated their account yet
					if($row['active'] != 1){
						//if not display error message
						echo "<center>You have not yet <b>Activated</b> your account!</center>";
					}else{
						//if they have log them in

						//set the login session storing there id - we use this to see if they are logged in or not
						$_SESSION['uid'] = $row['id'];
						//show message
						echo "<center>You have successfully logged in!</center>";

						//update the online field to 50 seconds into the future
						$time = date('U')+50;
						mysql_query("UPDATE `users` SET `online` = '".$time."' WHERE `id` = '".$_SESSION['uid']."'");


					}
				}
			}
		}
	}

	?>
	<form action="index.php" method="post">
		<div id="border">
			<table cellpadding="2" cellspacing="0" border="0" align="center">
				<tr>
					<td>Username:</td>
					<td><input type="text" name="username" /></td>
				</tr>
				<tr>
					<td>Password:</td>
					<td><input type="password" name="password" /></td>
				</tr>
				<tr>
					<td colspan="2" align="center"><input type="submit" name="submit" value="Login" /></td>
				</tr>
				<tr>
					<td align="center" colspan="2"><a href="register.php">Register</a> | <a href="forgot.php">Forgot Pass</a></td>
				</tr>
			</table>
           </div>
         </form>
       </div>
    </div>
</body>
</html>

I really don't no why this one won't even load up, in fact if somebody has a link to a built template I would love it.
This is the one I used to rebuild the site yesterday http://gigaspartan.com/2010/11/26/how-to-build-a-full-featured-login-system/

Dicko

I know its not a straight forward task but if anybody knows how to get this to work I would really appreciate it. In an ideal situation I wanted for the students to be logged into not only there year of study so they can see their modules, but also to be more personal so tutors can leave posts on the individual's module pages and so on. :bemused:

dagon

Dicko;10998631 wrote:
I really don't no why this one won't even load up

you will have to explain the problem better than that.

Dicko

Hi Dragon well it will not display the page when you go to it, I am using my own club address for my testing take a look for yourself www.northernmonkeyvwclub.co.uk

I have had builds that have worked better than this one but still have not been able to get a fully working php login system that redirects depending on student and year of study.

dagon

well you could of mentioned the error in the first place ...

you have no closing } for the

 if($_POST['submit']){

construct

Dicko

Thanks for that, the amount of times I have read over counting them { is unbelievable.
Ok I now have a working front page, registration only works sending me to the Year 2 page not Year 1?

here is the code on my login page for the redirection;

												//redirect them to the usersonline page
						if ($YearofStudy=="Year 1") 
                            { 
                             header("location: 1st Year.php"); 
                           } 

                   else 
                       { 
                         header("location: Year2Homepage.php");

					//split all fields fom the correct row into an associative array
					$row = mysql_fetch_assoc($res);

On the Year 2 home page I have the following error warning;

Warning: Wrong parameter count for strcmp() in /home/########/#####_html/Year2Homepage.php on line 50

This is the php for that section;

<?php

	//if the login session does not exist therefore meaning the user is not logged in
[B]"Line 50"[/B]	[COLOR="red"]if(strcmp($_SESSION['uid']."'") == 0){[/COLOR]
			//display and error message
			echo "<center>You need to be logged in to user this feature!</center>";
		}else{
			//otherwise continue the page

		//this is out update script which should be used in each page to update the users online time
		$time = date('U')+50;
		$update = mysql_query("UPDATE `users` SET `online` = '".$time."' WHERE `id` = '".$_SESSION['uid']."'");
		?>

I have wrote "Line 50" and coloured that line red to try and help you guys!

Dicko

whoops I did not expect it to put around where i put Line 50 or add the text color red so please ignore the
sorry about that

dagon

were is $YearofStudy defined?

Dicko

Hi
Its in my database and in the Registration form, just double checked database and the entry has been entered for Year 1 student, but some reason does not direct that user to there.
Thanks for the help by the way.

bradgrafelman

He's not talking about the data that's supposed to be associated with that variable, he's asking where you defined the PHP variable $YearofStudy itself.

dagon

sure its in the db, but its not in the variable $YearofStud

echo $YearofStudy;

will be blank

Dicko

I Get the feeling I am really missing the point here peeps. All I have on the log in page when it comes to checking the database for the year is;

//select all rows where the username and password match the ones submitted by the user
					$res = mysql_query("SELECT * FROM `users` WHERE `username` = '".$username."' AND `password` = '".$password."'");
					$num = mysql_num_rows($res);

				//check if there was not a match
				if($num == 0){
					//if not display error message
					echo "<center>The <b>Password</b> you supplied does not match the one for that username!</center>";
				}else{
					//if there was continue checking
											//redirect them to the usersonline page
					if ($YearofStudy=="Year 1") 
                        { 
                         header("location: 1st Year.php"); 
                       } 

                   else 
                       { 
                         header("location: Year2Homepage.php");

					//split all fields fom the correct row into an associative array
					$row = mysql_fetch_assoc($res);

					//check to see if the user has not activated their account yet
					if($row['active'] != 1){
						//if not display error message
						echo "<center>You have not yet <b>Activated</b> your account!</center>";
					}else{
						//if they have log them in

						//set the login session storing there id - we use this to see if they are logged in or not
						$_SESSION['uid'] = $row['id'];
						//show message
						echo "<center>You have successfully logged in!</center>";

dagon

you use the variable $YearofStudy, but you don't define it, may as well use the variable $rtjorvkijuwturchjrvecguwhrecmy, or any other random one you like.

Dicko

sorry I am coming across as random but I don't understand where I am supposed to put the Variable $YearofStudy ?

dagon

"if ($YearofStudy=="Year 1") "

where do you think you defined the value for $YearofStudy ?

Dicko

"if ($YearofStudy=="Year 1") "

where do you think you defined the value for $YearofStudy ?

I am very sorry but I don't understand if that is the defined your asking about is it wrong? do I need to replace it or move it?, I know I sound like I have not got a clue but its right I dont have a clue, that is why I joined to talk to people who do no what there talking about.
I really do appreciate your help

dagon

Dicko;10998832 wrote:
Its in my database and in the Registration form, just double checked database and the entry has been entered for Year 1 student, but some reason does not direct that user to there.

because $YearofStudy is never "year 1" or anything else, as its never defined.

Dicko;10998832 wrote:
"if ($YearofStudy=="Year 1") "

where do you think you defined the value for $YearofStudy ?

I am very sorry but I don't understand if that is the defined your asking about is it wrong? do I need to replace it or move it?, I know I sound like I have not got a clue but its right I dont have a clue, that is why I joined to talk to people who do no what there talking about.
I really do appreciate your help

wrong well it results in the error above; can you answer the question as to where you think it is defined?

bradgrafelman

If the data is supposed to be coming from the DB, then you've got two problems:

Your if() statement comes before this line:
```
$row = mysql_fetch_assoc($res); 
```
which appears to be the only place you actually fetch information from the DB. In other words, PHP isn't psychic and can't predict what the value is before you actually retrieve it.
You never define the variable $YearofStudy based on the associative array $row. For example, $row['YearofStudy'] may contain the information you need, but if that's the case then you'd need to define $YearofStudy based on that information.

Dicko

Should be added on this line so when it checks the db for username and password it also checks the year?
$res = mysql_query("SELECT * FROM users WHERE username = '".$username."' AND password = '".$password."'");

Dicko

I have done some alteration ;

//split all fields fom the correct row into an associative array
						$row = mysql_fetch_assoc($res);

					//direct them to the usersonline page
					($row['YearofStudy'] !="Year 1");

					if($YearofStudy=="Year 1");
                        { 
                         header("location: 1st Year.php"); 
                       }else{ 
                         header("location: Year2Homepage.php");
                       }

and I am now getting the following error;
Parse error: syntax error, unexpected T_ELSE in /#####/#####/######/index.php on line 105