PHP - Question On How To Check If A User Is On A Certain Page

Hey guys,
How do I check to see if the user has been login on the page that they are on?
I have a login and I want users to login before then can go to other pages.
thanks guys,

hi, how can i check if a username exists? i tried this 

$usrsql = "SELECT * FROM $tbl_name WHERE username='$username' AND password='$password'";
        $usrres = mysql_query($usrsql);
        $usrcount = mysql_num_rows($usrres);

        if($usrres && mysql_num_rows($usrcount)>0) {

            die("Username is already taken!");
        } 

Hi there,   I've been searching the internet for the best way to check if the user has been logged in. Some codes have security breaches. So I'm not sure where to start.   Here's what I've come up with:   The user logs in and is checked whether he/she is a valid user, if not return false and if true carry on and create session, I read the post that Jacques1 made about session feedback and implemented what he said. After that the session variables are assigned and then the user id, session_id and a unique identifier to check against on each page load are inserted into a database and then the user is logged in.   Here's my code: (please note this is in a class and only shows the login function)

function Login($username, $password)
	{
		try
		{
			$db = new PDO("mysql:host=".DB_HOST.";dbname=".DB_NAME.";charset=utf8", DB_USERNAME, DB_PASSWORD);
			$db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
			$db->setAttribute(PDO::ATTR_EMULATE_PREPARES, false);
		}
		catch(PDOException $ex)
		{
			echo "Unable to connect to DB";
			error_log($ex->getMessage());
		}
		
		try
		{
			$User_Info = $db->prepare("SELECT * FROM users WHERE username=:username");
			$User_Info->bindValue(":username", $username, PDO::PARAM_STR);
			$User_Info->execute();
			$Info = $User_Info->fetchAll(PDO::FETCH_ASSOC);
			
			$salt = $Info['salt'];
			
			$password = $salt . $password;
			$password = $this->CreateHash($password);
			
			$unique_key = $this->GenerateRandom();
			$unique_key = $this->CreateHash($unique_key);		
			
			$Check_User = $db->prepare("SELECT * FROM users WHERE username=:username AND password=:password");
			$Check_User->bindValue(":username", $username, PDO::PARAM_STR);
			$Check_User->bindValue(":password", $password, PDO::PARAM_STR);
			$Check_User->execute();	
			
			if($Check_User->rowCount() > 0)
			{
				while($row = $Check_User->fetchAll(PDO::FETCH_ASSOC))
				{
					session_destroy();
					session_start();
					
					$_SESSION = array();
					
					session_regenerate_id(true);
					
					$_SESSION['username'] = $row['username'];
					$session_id = session_id();
					$user_id = $row['id'];
					
					$Check_Logged_In = $db->prepare("DELETE FROM logged_in_users WHERE user_id=:userid");
					$Check_Logged_In->bindValue(":user_id", $user_id, PDO::PARAM_STR);
					$Check_Logged_In->execute();
					$has_changed = $Check_Logged_In->rowCount();
					
					if($has_changed > 0)
					{
						$Logged_In = $db->prepare("INSERT INTO logged_in_users (id, user_id, session_id, unique_key) VALUES (NULL, :user_id, :session_id, :unique_key)");
						$Logged_In->bindValue(":user_id", $user_id, PDO::PARAM_STR);
						$Logged_In->bindValue(":session_id", $session_id, PDO::PARAM_STR);
						$Logged_In->bindValue(":unique_key", $unique_key, PDO::PARAM_STR);
						$Logged_In->execute();
						$affected_rows = $Logged_In->rowCount();
						
						if($affected_rows > 0)
						{
							return true;
						}
					}
					return false;
				}
			}

			return false;
		}
		catch(PDOException $ex)
		{
			echo "Unable to complete query";
			error_log($ex->getMessage());
		}
	}

Thanks

Hi, I want have this code (below), how would I check if a user is logged in?  I want to make it so they can only see 500 chars, or the full thing if they're logged in.  Thanks! 
Code: [Select]
  public function __construct( $data=array() ) {
    if ( isset( $data['id'] ) ) $this->id = (int) $data['id'];
    if ( isset( $data['publicationDate'] ) ) $this->publicationDate = (int) $data['publicationDate'];
    if ( isset( $data['title'] ) ) $this->title = preg_replace ( "/[^\.\,\-\_\'\"\@\?\!\:\$ a-zA-Z0-9()]/", "", $data['title'] );
    if ( isset( $data['summary'] ) ) $this->summary = preg_replace ( "/[^\.\,\-\_\'\"\@\?\!\:\$ a-zA-Z0-9()]/", "", $data['summary'] );
    if ( isset( $data['content'] ) ) $this->content = $data['content'];
if ( isset( $data['tags'] ) ) $this->tags = $data['tags'];
  }

Hi guys,

I am trying to put together a little system that allows users to log onto my website and access there own personal page. I am creating each page myself and uploading content specific to them which cannot be viewed by anyone else.

I have got the system to work up as far as:

1/ The user logs in
2/ Once logged in they are re-directed to their own page using 'theirusername.php'

Thats all good and working how I need it too. The problem I have is this. If I log onto the website using USER A details - I get taken to USER A's page like I should but - If I then go to my browser and type in USERBdetails.php I can then access USER B's page.

This cannot happen!! I need for USER A not to be able to access USER B profile - there is obviously no point in the login otherwise! If you are not logged in you obviously cannot access any secure page. That much is working!

Please find below the code I am using:


LOGIN

<?php
session_start();


function dbconnect()
{
    $link = mysql_connect("localhost", "username", "password") or die ("Error: ".mysql_error());

}
?>

<?php
if(isset($_SESSION['loggedin']))
{
    header("Location:" . strtolower($username) . ".php");
if(isset($_POST['submit']))
{
   $username = mysql_real_escape_string($_POST['username']);
   $password = mysql_real_escape_string($_POST['password']);
   $mysql = mysql_query("SELECT * FROM clients WHERE username = '{$username}' AND password = '{$password}'");
   if(mysql_num_rows($mysql) < 1)
   {
     die("Password or Username incorrect! Please <a href='login.php'>click here</a> to try again");
   }   $_SESSION['loggedin'] = "YES";
   $_SESSION['username'] = $username;
 $_SESSION['name']
   header("Location:" . strtolower($username) . ".php");
}
?> 

HEADER ON EACH PHP PAGE

<?php
session_start();
if(!isset($_SESSION['loggedin']))
{
    die(Access to this page is restricted without a valid username and password);
?>

---------------------------------------------------

Am I right in thinking it is something to do with the "loggedin" part?

The system I have here is adapted from a normal login system I have been using for years. The original just checks the details and then does a 'session start'. This one obviously has to re-direct to a user specific page. To do this I used the <<header("Location:" . strtolower($username) . ".php");>> line to redirect to a page such as "usera.php" or "userb.php"

Any help would be greatly appreciated! 

Ta

Hi

I have a live chat integrated into my website that uses Ajax, PHP and MySQL.

When two people have the chat window open they can chat and it works fine.

How can I send an alert to the person being requested to chat with, or for the chat.php page to popup automatically.

It prob needs to be some function constantly running in the background check the DB for new message entries.

Thanks
Jay

I would like to create a script to check wether a user has made a payment to access a members only area of my site, much like a check-login script that checks if the user has logged in, i need it do do a similar check only its not looking to see if the user is logged in but if they have ever paid and if not; send them to the payments page before the access is granted... What section(s) if any, do i need to modify from this check-login script to change it to check for their payments?

Code: [Select]
<?php
ob_start();

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB");

// Define $myusername and $mypassword 
$myusername=$_POST['myusername']; 
$mypassword=$_POST['mypassword']; 

// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);

$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if($count==1){
// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("myusername");
session_register("mypassword"); 
header("location:login_success.php");
}
else {
echo "Wrong Username or Password";
}

ob_end_flush();
?>

Hey, so I'm trying to check the database if the user and email already exists when registering.

<?php
include_once('includes/config.php');

if(isset($_POST['submit'])) {
	$username = $_POST['username'] ? trim($_POST['username']) : null;
	$password = md5($_POST['password']) ? trim($_POST['password']) : null;;
	$email = ($_POST['email']);
	$message = "";

	if(empty($username) || empty($password) || empty($email)) {
		$message = "All fields required";
	} else {
		$sql = "SELECT COUNT(username) AS userNum FROM users WHERE username = :username";
		$sql = "SELECT COUNT(email) AS emailNum FROM users WHERE email = :email";
		$stmt = $db->prepare($sql);

		$stmt->bindValue(':username', $username);
		$stmt->execute();

		$row = $stmt->fetch(PDO::FETCH_ASSOC);

		if($row['userNum'] >0) {
			die("That username already exists!");
		} elseif($row['emailNum'] > 0) {
			die("That email already exists!");
		}

		$sql = "INSERT INTO users (username, password, email) VALUES (:username, :password, :email)";
		$stmt = $db->prepare($sql);

		$stmt->bindValue(':username', $username);
		$stmt->bindValue(':password', $password);
		$stmt->bindValue(':email', $email);

		$result = $stmt->execute();

		if($result) {
			$message = "Registration was successful";
		}

	}
}
?>

If I remove this line "

$sql = "SELECT COUNT(email) AS emailNum FROM users WHERE email = :email";

the code works but only checks the username. How can I check both?

Hi Guys,

Just a quick introduction I am NOT a student I am a IT Technician in a School in the South of the United Kingdom.

I am trying to write a PHP Script with a Function that Checks if the user is logged in, if the user is logged in then it shows the user the content on the page but if they are not logged in then to show a blank page with a link to the Login Page. I need it to be simple. I just want it to check if a useer is logged in but if there not only show some content on a page.

Can anyone help? My Users login into a php Session.

Thanks for any help you can offer.

Best Regards
Thomas

on all my secured pages at the the very top the code is
Code: [Select]
<?php
require ("u_check_login.php");
?>
and then the u_check_login.php code is
Code: [Select]
<?php
require('database.php'); //Include DB connection information
$ip = mysql_real_escape_string($_SERVER["REMOTE_ADDR"]); //Get user's IP Address
$email = mysql_real_escape_string($_COOKIE['uemail']); //Get username stored in cookie
$pp = mysql_real_escape_string($_COOKIE['pp']);
if ($pp == 1){
$sessionid = mysql_real_escape_string($_COOKIE['sessionid']); //Get user's session ID
$check = mysql_query("SELECT * FROM `users` WHERE `email` = '$email' AND `session_id` = '$sessionid' AND `login_ip` = '$ip' AND `pp` = '1' ") or die(mysql_error()); //Check if all information provided from the user is valid by checking in the DB
$answer = mysql_num_rows($check); //Return number of results found. Equal to 0 if not logged in or 1 if logged in.
if ($answer == 0 || $sessionid == '') { //Check if login is valid. If not redirect user to login page
header('Location: ulogin.php');
exit();
}
$row = mysql_fetch_array($check);
$email = stripslashes($row['email']);
}else{
header('Location: ulogin.php');
}
?>
and this error is being displayed on my page that is supposed to not have let me on because i was not logged in
Code: [Select]
Warning: Cannot modify header information - headers already sent by (output started at /home/content/03/8587103/html/pinkpanthers/pinkpanthers.php:1) in /home/content/03/8587103/html/pinkpanthers/u_check_login.php on line 17

Can you see if a request (post/get) is from a curl request or an actual user? I am trying to defeat a little bit of fraud.

Hi all,

I've got a website for an event, each team have their details on a page which are recalled from a SQl database.

But I'm wanting to create a password input box for each team, so when they enter the correct password they are taken to a page containing forms where they can edit the team details.

Here is the page with the users details on where they anter the password: http://www.wharncliffenetwork.co.uk/wrc/entered/team.php?id=8

I'm not sure how to code it, Can an IF statement be used? Anyone got any pointers? I'f been unsuccessful in finding a tutorial or something similar.

Hope that makes sense :S Cheers.

Code what i made so far.

$inputText = 'This is testing http://www.youtube.com';

$allowedDomains = 'www.google.com
		   youtube.com/
		   http://www.test.org';

$array = preg_split('/[\s]+/', $allowedDomains);
$regex = '';//Need this line

if(preg_match($regex, $inputText)){
    print 'Domain match!';
}else{
    print 'Domain not match!';
}

Edited by jacob21, 16 October 2014 - 08:31 AM.

Hey all,

In my user registration system I'm trying to figure something out.

When the user puts in his information and hits submit it goes into a temporary user table while it waits for the user to click on the activation code in the email that is sent out. Once they click on it it's then transferred into the user table.

Now, I have a few questions:

1. Should the user check on the registration screen check both tables for a username match?

What if someone starts a registration but never activates it. That username, though not in use, is now taken up in the tempuser table.

2. Should the information in the temporary table be cleared after it is moved into the regular table?

Thanks guys!

Hi,
I know very little about binding PHP to AD. At the minute it is setup to Authenticate against AD (Via IIS), then from the that I have the following:

Declare's the Logon_Name variable, so that it can be used to 'print' buttons, and links i.e. if ($logon_name==("Administrator")); {echo admin link here'};

$logon_name = basename($_SERVER['AUTH_USER']);

What I would ideally like to do is be able to find the group the user is a member of, this way we can create custom AD groups like intra_admin and then if they are a member they will be able to see certain links to pages etc.

Any ideas, I hope this makes sence