Forum Moderators: coopster
I've created a login page, members page, and checklogin page.
the code for login.php is:
<html>
<head>
<title>Login</title>
<head>
<body>
<?PHP
//Connect to database
include_once "connection.php";
if(isset($_POST['Login']))
{
if($_POST['username']!='' && $_POST['password']!='')
{
//Use the input username and password and check against 'users' table
$username = mysql_real_escape_string($_POST['username']);
$password = md5($_POST['password']);
$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
if(mysql_num_rows($query) == 1)
{
$row = mysql_fetch_assoc($query);
{
$_SESSION['username'] = $row['username'];
$_SESSION['logged_in'] = TRUE;
header("Location: members.php");
print("<h3>Welcome $username!</h3>");
include "members.php";
}
}
else {
$error = 'Login failed !';
}
}
else {
$error = 'Please user both your username and password to access your account';
}
}
?>
<?php if(isset($error)){ echo $error;}?>
</body>
</html>
***************************************************************************
after that, the members.php is:
<html><head><title>Feedbacks</title></head>
<body>
<?php
include_once "connection.php";
//this is where I check the access level
<?php
include "checklogin.php"
session_start();
checkLogin('0 1 2');
?>
?>
<?php
$query = "SELECT * FROM feedbacks";
.
.
.
"some codes that work well seperately..."
.
.
.
<br /><strong>
<?php print("$num") ?> feedback(s).</strong> <br/> <br />
<?php
mysql_close();
?>
</body>
</html>
***************************************************************************
and this is my checklogin.php:
<html>
<head />
<title />
<body>
<?php
include_once "connection.php";
function checkLogin($levels)
{
if(!$_SESSION['logged_in'])
{
$access = FALSE;
}
else {
$kt = split(' ', $levels);
$query = mysql_query('SELECT Access_lvl FROM users WHERE username = "'.mysql_real_escape_string($_SESSION['username']).'"');
$row = mysql_fetch_assoc($query);
$access = FALSE;
while(list($key,$val)=each($kt))
{
if($val==$row['Access_lvl'])
{//if the user level matches one of the allowed levels
$access = TRUE;
}
}
}
if($access==FALSE)
{
header("Location: login.php");
}
else {
//do nothing: continue
}
}
?>
</body>
</html>
anyone can tell me what is wrong in here...? :(
You are trying to use the header [uk.php.net] function after you have already sent data to the browser. This will cause the header function to fail. You can get around it using output buffering. Or by moving your processing code to before the HTML code.
From the PHP website:
<html>
<?php
/* This will give an error. Note the output
* above, which is before the header() call */
header('Location: http://www.example.com/');
?>
Another useful thing is to always set your error reporting to E_ALL for development, this will give you some debugging clues.
dc
you go to the login form
you enter correct user/pass
hit submit
what happens next?
what steps have you tried to try and diagnose the problem
does the url change? are we sure it is going to the next script or is it not submitting
have you dumped the $_POST data at the top of the login.php page like so
echo '<pre>';
print_r($_POST);
echo '</pre>';
what does it show?
i did what you just said, to echo the submittion
i got this:
Array
(
[username] => nanaz
[password] => nazanin
[submit] => Login
)
we don't know why though
to start with this line needs to go
header("Location: members.php");
as dc mentioned, it won't work, it is also redundant since the rest is built to not be a redirect, the other issue is if the script was getting to that point there would be an error, there isn't so let's assume it isn't getting there
still take that line out never to be seen again though :)
I went through the code now
your braces are wrecked, try this
<html>
<head>
<title>Login</title>
<head>
<body>
<?PHP
//Connect to database
include_once "connection.php";
if(isset($_POST['Login'])) {
if($_POST['username']!='' && $_POST['password']!='') {
//Use the input username and password and check against 'users' table
$username = mysql_real_escape_string($_POST['username']);
$password = md5($_POST['password']);
$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
if(mysql_num_rows($query) == 1) {
$row = mysql_fetch_assoc($query);
$_SESSION['username'] = $row['username'];
$_SESSION['logged_in'] = TRUE;
print("<h3>Welcome $username!</h3>");
include "members.php";
} else {
$error = 'Login failed !';
}
} else {
$error = 'Please user both your username and password to access your account';
}
}
if(isset($error)){ echo $error;}
?>
</body>
</html>
I really don't think your server is outputting errors because your first script should have thrown a couple parse errors
you should look at the value of display_errors [php.net] in your php.ini
you also aren't actually executing your query, you might want to add it
<html>
<head>
<title>Login</title>
<head>
<body>
<?PHP
//Connect to database
include_once "connection.php";
if(isset($_POST['Login'])) {
if($_POST['username']!='' && $_POST['password']!='') {
//Use the input username and password and check against 'users' table
$username = mysql_real_escape_string($_POST['username']);
$password = md5($_POST['password']);
$q = "SELECT * FROM users WHERE username='$username' AND password='$password'";
$query = mysql_query($q) or die("there was an error: " . mysql_error());
if(mysql_num_rows($query) == 1) {
$row = mysql_fetch_assoc($query);
$_SESSION['username'] = $row['username'];
$_SESSION['logged_in'] = TRUE;
print("<h3>Welcome $username!</h3>");
include "members.php";
} else {
$error = 'Login failed !';
}
} else {
$error = 'Please user both your username and password to access your account';
}
}
if(isset($error)){ echo $error;}
?>
</body>
</html>
I actually was thinking of executing query as well, I did change the query to $q and run it with mysql_query... but still the same damn blank page of login.php
to be much clearer, my login was working well before, all of this happened just when I started to add access level of users. and I really needed to add it...
<html>
<head>
<title>Login</title>
<head>
<body>
<?PHP
//Connect to database
include_once "connection.php";
session_start();
$username = mysql_real_escape_string($_POST['username']);
$password = md5($_POST['password']);
$query = "SELECT * FROM users WHERE username='$username' AND password='$password'";
if ($_POST[username]&&$_POST[password]) $result=mysql_query($query);
if (mysql_num_rows($result) != 1) {
$error = "Bad Login";
include "login.html";
} else {
$row = mysql_fetch_assoc($result);
$_SESSION['username'] = $row['username'];
$_SESSION['logged_in'] = TRUE;
print("<h3>Welcome $username!</h3>");
include "members.php";
}
?>
</body>
</html>
now I'm logging in, but with an error:
Welcome nanaz!
Parse error: syntax error, unexpected T_STRING in C:\wamp\www\members.php on line 12
this is my members.php code:
<html><head><title>Feedbacks</title></head>
<body>
<?php
include_once "connection.php";
9 include "checklogin.php"
10session_start();
11checkLogin('0 1 2');
?>
<h3>Feedbacks</h3>
<table border = "1">
<tr><strong>
<td align = "center"><strong>feedback id</strong></td>
<td align = "center"><strong>Subject Code</strong></td>
<td align = "center"><strong>Semester</strong></td>
<td align = "center"><strong>Year</strong></td>
<td align = "center"><strong>Comment</strong></td>
<td align = "center"><strong>Date</strong></td>
</tr>
<?php
$query = "SELECT * FROM feedbacks";
$result = mysql_query($query) or die (mysql_error());
$num=mysql_num_rows($result);
?>
<?php
/*
$row = mysql_fetch_assoc( $result );
echo "<pre>";
var_dump($row);
echo "</pre>"; */
while ($row = mysql_fetch_assoc( $result ))
{
$fid = $row['feedback_id'];
$sc = $row['subject_code'];
$sem = $row['Semester'];
$y = $row['Year_of_exam'];
$dtls = $row['details'];
$dat = $row['date'];
print("<tr>");
print("<td>$fid</td>");
print("<td>$sc</td>");
print("<td>$sem</td>");
print("<td>$y</td>");
print("<td>$dtls</td>");
print("<td>$dat</td>");
print("</tr>");
}
?>
</table>
<br /><strong>
<?php print("$num") ?> feedback(s).</strong> <br/> <br />
<?php
mysql_close();
?>
</table>
</body>
</html>
as you can see, line 10 is session_start(). Im using this to apply the access level. anything wrong?
include "checklogin.php"
I take it you would like to redirect certain users to certain welcome pages, depending on their level of authorisation, I run something similar on a site of mine, I run it over 3 different pages though, it seemed easier at the time, login.php sends the details to who.php which checks the db for A) a valid user (num_rows) then B) the page to send them to. Heres the code of who.php
if (mysql_num_rows($result) == '1')
{
if ($usertype == 'user')
{
header("Location: http://www.example.com/user_welcome.php?id=$user&passwd=$passwd");
exit;
}
if ($usertype == 'admin')
{
header("Location: http://www.example.com/boss_welcome.php?id=$user&passwd=$passwd");
exit;
}
if ($usertype == 'subadmin')
{
header("Location: http://www.example.com/subadmin_welcome.php?id=$user&passwd=$passwd");
exit;
}
}
else
{
header("Location: http://www.example.com/login.php");
exit;
}
HTH a bit
good luck..
