Forum Moderators: coopster
basically on every single page i have a header.php include file and i would like this page to always reflect the login status. ie Login or logout and also
just another include file that checks if user is logged in and if is not then redirect to login page.
But when they login on this page i would like them to be directed to the previous page.
i already have a login script but it is very long and seems complicated. Can any one help with the general layout of the script etc. thanks everyone
For example:
somepage.php
<?php
if (!$authenticated)
{
header("Location: /login.php?return=".$_SERVER["PHP_SELF"]);exit();
}// rest of page - above part can be in a common include file like you say
?>
login.php:
<?phpif ($_POST["username"])
{
// authenticate user here, set cookies etc
if ($authenticated)
{
if ($_POST["return"])
{
$return = $_POST["return"];
}
else
{
$return = "/";
}header("Location: ".$return);
exit();
}
else
{
echo("Authentication failed.");
}
}echo("<form method='post'>");
echo("<input type='hidden' name='return' value='".$_GET["return"]."'>");
// rest of login form, username, password, Login button etc.
echo("</form>");
?>
i just want my header file to do an if else user loged in then TEXT WOULD SAY login or logout
Is there a variable you can target as a 'logged in' value?
this is the script
<?php // accesscontrol.php
include_once 'common.php';
include_once 'db.php';
session_start();
$uid = isset($_POST['uid'])? $_POST['uid'] : $_SESSION['uid'];
$pwd = isset($_POST['pwd'])? $_POST['pwd'] : $_SESSION['pwd'];
if(!isset($uid)) {
?>
<!DOCTYPE html PUBLIC "-//W3C/DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title> Please Log In for Access </title>
<meta http-equiv="Content-Type"
content="text/html; charset=iso-8859-1" />
</head>
<body>
<h1> Login Required </h1>
<p>You must log in to access this area of the site. If you are
not a registered user, <a href="signup.php">click here</a>
to sign up for instant access!</p>
<p><form method="post" action="<?=$_SERVER['PHP_SELF']?>">
User ID: <input type="text" name="uid" size="8" /><br />
Password: <input type="password" name="pwd" SIZE="8" /><br />
<input type="submit" value="Log in" />
</form></p>
</body>
</html>
<?php
exit;
}
$_SESSION['uid'] = $uid;
$_SESSION['pwd'] = $pwd;
dbConnect("example");
$sql = "SELECT * FROM users WHERE username = '$uid' AND password = PASSWORD('$pwd')";
$result = mysql_query($sql);
if (!$result) {
error('A database error occurred while checking your '.
'login details.\\nIf this error persists, please '.
'contact you@example.com.');
}
if (mysql_num_rows($result) == 0) {
unset($_SESSION['uid']);
unset($_SESSION['pwd']);
?>
<!DOCTYPE html PUBLIC "-//W3C/DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title> Access Denied </title>
<meta http-equiv="Content-Type"
content="text/html; charset=iso-8859-1" />
</head>
<body>
<h1> Access Denied </h1>
<p>Your user ID or password is incorrect, or you are not a
registered user on this site. To try logging in again, click
<a href="<?=$_SERVER['PHP_SELF']?>">here</a>. To register for instant
access, click <a href="signup.php">here</a>.</p>
</body>
</html>
<?php
exit;
}
$username = mysql_result($result,0,'fullname');
?>
below is the include_once 'db.php';
<?php // db.php
$dbhost = 'localhost';
$dbuser = 'root';
$dbpass = 'admin';
function dbConnect($db='example') {
global $dbhost, $dbuser, $dbpass;
$dbcnx = @mysql_connect($dbhost, $dbuser, $dbpass)
or die('The site database appears to be down.');
if ($db!='' and!@mysql_select_db($db))
die('The site database is unavailable.');
return $dbcnx;
}
?>
My database is called example and table name is users
Also i reeivece these erros can someone help with this please
Notice: Undefined index: uid in C:\Inetpub\wwwroot\example\pass2\accesscontrol.php on line 7
Notice: Undefined index: pwd in C:\Inetpub\wwwroot\example\pass2\accesscontrol.php on line 8
[edited by: jatar_k at 6:49 pm (utc) on Feb. 8, 2005]
You have undefined indexes because neither $_POST['uid'] or $_SESSION['uid'] is defined. So you need something like
if (isset($_POST['uid']))
{
$uid = $_POST['uid'];
}
elseif (isset($_SESSION['uid']))
{
$uid = $_SESSION['uid'];
}
else
{
$uid = 0;
}
First get rid of the errors and then let's see how things run.
then seconds page turn these varibles in session varible. if correct pass to good.php If BAD LOGIN THEN PASS TO bad.php
But over all if user is logged in then i want header.php to contain a logout link please
has any one got a script for this that they wouldnt mind posting. Regards
if (authenticate($_POST['uid'], $_POST['pwd']))
{
header [php.net]("Location: good.php")
exit();
}
else
{
header [php.net]("Location: bad.php")
exit();
}
It seems like you know how to do the rest of it right?
BTW, the code I posted before was only to get rid of the warnings.
Tom
if
global varible contains something then
Link = Logout
else
Link = Login
can someone right the code i would need for this please i would be most grateful. thanks guys and girls and all have a great new year.
The question of user authentication (i.e. login) comes up fairly often, so for starters, you might try looking through some previous threads to see if you can get some insight:
From the Library [webmasterworld.com] check out
[webmasterworld.com...]
As well as other threads on the subject:
[webmasterworld.com...]
[webmasterworld.com...]
[webmasterworld.com...]
[webmasterworld.com...]
[webmasterworld.com...]
[webmasterworld.com...]
See if any of that helps you out.
There are also many fine tutorials on the web that will take you through it step-by-step. Search on "PHP user authentication"
Just don't try reading all that with too much champagne in your system - it's hard enough anyway!
im going to make some global varibles now so i can check them from my header.php
heres the code:
<?php
$username = $_POST['username'];
$password = $_POST['password'];
// Connect to MySQL
mysql_connect( 'localhost', username, password)
or die ( 'Unable to connect to server.' );
// Select database on MySQL server
mysql_select_db( database_name)
or die ( 'Unable to select database.' );
// Formulate the query
$sql = "SELECT * FROM users WHERE
username = '$username' AND
password = '$password'";
// Execute the query and put results in $result
$result = mysql_query( $sql )
or die ( 'Unable to execute query.' );
// Get number of rows in $result.
$num = mysql_numrows( $result );
if ( $num!= 0 ) {
// A matching row was found - the user is authenticated.
$auth = true;
header("Location: goodlogin.php");
} else {
$auth = false;
header("Location: badlogin.php");
}
?>
This doesn't really protect your user's data very much - if it gets intercepted, it's still being sent over the network unencrypted (you need to use a SSL to encrypt it for transmission), and if your DB gets hacked, the hacker still has access to all info there (e.g. credit cards, social security number, etc - you don't want any of that there unless you have fantastic security). So by itself it doesn't do much and you need good security all around if you have valuable information.
The small peace of mind it adds is that if the DB gets hacked despite all, users who reuse usernames and passwords elsewhere are still protected. So if my piddly site gets hacked, the hacker doesn't suddenly have the password to the bank acounts too.
[edited by: ergophobe at 8:27 pm (utc) on Jan. 1, 2005]
<?php
session_start();
if ($_SESSION['auth']== "false") {
$output='Login';
}
else {
$output='Logout';
}
?>
but i am recieving the error
Warning: session_start(): Cannot send session cache limiter - headers already sent (output started at C:\Inetpub\wwwroot\aa\index.php:13) in C:\Inetpub\wwwroot\aa\header.php on line 2
can you help please
Yes, you can use isset() to test whether or not variables are set, and then assign default values if not.
<?php session_start();
if (isset($_SESSION['username'])) {
echo ' Currently logged in as: '.$_SESSION['username'];
echo ' </div>';
}
?>
Warning: session_start(): Cannot send session cache limiter - headers already sent (output started at C:\Inetpub\wwwroot\aa\index.php:13) in C:\Inetpub\wwwroot\aa\header.php on line 2
This error message is telling you that output began at line 13 in the file index.php.
You cannot use session_start() after your script has started producing output; so you need to look at index.php and remove whatever it is doing that creates output before you can start your session within header.php.
This does not mean that line 13 of index.php contains an error; but you must change the layout of your script so that no output can occur until after you have included header.php.
