Forum Moderators: coopster
header[Location:'owners_area.php']<?php
//error_reporting(E_ALL|E_STRICT);
session_start();
require_once("connections/connection.php"); // Connection to the server
//include("includes/security.php"); //Link to the security file
?>
<html>
<head>
</head>
<body>
<div id="wrapper">
<div id="container">
<div id="header">
<div id="user_box">
<?php
if(!isset($_SESSION['username']) || (trim($_SESSION['username']) == ''))
echo "<font color='white'>".'You are not logged in.'."</font>";
//header("location: access-denied.php");
else
{
if(isset($_SESSION['username']) && (!empty($_SESSION['username'])))
echo "<font color='white'>" . 'Logged in as '.$_SESSION['username'] . "</font><br>";
echo '<input type="button" name="logout" value="Logout" onclick="document.location.href=\'logout.php\'"/>';
}
?>
</div>
</div>
<div id="navigation">
<ul>
<li><a href="index.php">Home</a></li>
<li><a href="search_villas.php">Search</a></li>
</ul>
</div>
<div id="spacer_horizontal"></div>
<div id="left_panel"><img src="images/panel.jpg" width="180" height="790" /></div>
<div id="centre_panel">
<center>
<form name="login" method="POST" action="<?php $_SERVER['../PHP_SELP'];?>">
<table width="20%" border="1" align="center">
<tr>
<td bgcolor="#FFFFFF">Username</td>
<td bgcolor="#FFFFFF"><input type="text" name="username"></td>
</tr>
<tr>
<td bgcolor="#FFFFFF">Password</td>
<td bgcolor="#FFFFFF"><input type="password" name="password"></td>
</tr>
<tr>
<td bgcolor="#FFFFFF">
</td>
<td bgcolor="#FFFFFF"><label>
<input name="submitted" type="hidden" id="submitted" value="1" />
<input type="submit" name="button" id="button" value="Login" />
</label></td>
</tr>
</table>
</form>
</center>
<?php
$username = $_POST['username'];
$password = $_POST['password'];
if ($username&&$password)
{
//$connect = mysql_connect("localhost","root","password") or die ("Couldn't connect");
mysql_select_db("rentals") or die ("Couldn't find database");
$query = mysql_query("SELECT * FROM users WHERE username='$username'");
$numrows = mysql_num_rows($query);
if ($numrows!=0)
{
while ($row = mysql_fetch_assoc($query))
{
$dbusername = $row['username'];
$dbpassword = $row['password'];
}
// Check to see if they match!
if ($username==$dbusername&&$password==$dbpassword)
{
echo "<META HTTP-EQUIV=Refresh CONTENT='0'>";
$_SESSION['username']=$username;
}
else
echo "Incorrect password!";
}
else
die ("The user does not exist!");
}
else
die ("Please enter a username and password!");
?>
</div>
</div>
</body>
</html>
if ($username&&$password)
....
....
else
die ("Please enter a username and password!");
It seems to do exactly what you want, if there is no username / password, tell the user, I suggest to just remove it, since the average user knows that a login form means they need to insert a username / password.
...
...
elseif(isSet($_POST['submitted'])
&& ($_POST['username'] == '' || $_POST['password'] == '')) {
die("Please enter a username and password");
}
