PHP - Login Problem.. :(

Hello All,

I have this problem, no matter if I typed the wrong or right email and password, I always get Login failed message
here is my code

index.php

Code: [Select]
<td class="white-text">Email:
                      <form name="form1" method="post" action="/admin/Login.php">
                        <label for="user"></label>
                        <input type="text" name="email" />
                      </td>
                  </tr>
                  <tr>
                    <td><p><strong class="white-text">Password:</strong></p>  <label for="sdf"></label>
                        <input type="password" name="password" />
                     
                      <p class="sdf"><strong></strong><a href="#" class="white-link-underline"><strong></strong></a>
                        <input type="submit" name="submit" id="submit" value="Submit" />
                      </p>
                      </form>
                      </td>

Login.php

Code: [Select]
<?php

session_start();

$con = mysql_connect("localhost","123","123");
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db("123", $con);

if (isset($_POST['email']))
{
$email = mysql_real_escape_string($_POST['email']);
$password = mysql_real_escape_string($_POST['password']);

//Query

$results = mysql_query("SELECT * FROM users WHERE 'email' = '$email' AND password = '$password' ");

if(!$result) {
$_SESSION['error'] = '<span style="color: red">Login Failed. Email or Password is Incorrect <br/>';
} else {
         
$row = mysql_fetch_assoc($results);
$_SESSION['userid'] = $row['id'];
$_SESSION['email'] = $email;
$_SESSION['error'] = 'Login Successful<br/>. Welcome,'. $email;

}
mysql_close($con);

}

header('Location: ./index.php')
?>

Hello there,

The problem is that my login system isn't consistent. There's an option of staying logged in, and if you check that a cookie gets created with a hash. When you visit the site again, you should be logged in automatically. But the thing is, that when you load the page, you aren't! But after a refresh you are logged in. So I'm guessing a problem in the order of things that get done... Here's the script:

Code: [Select]
<?php
session_start();
if(isset($_COOKIE['LoginCookie']))
{
$hash = $_COOKIE['LoginCookie'];
mysql_select_db('database');
$sql = "SELECT all the info of the people FROM people WHERE cookie_hash = '".$hash."'";
if($result = mysql_query($sql))
{
$row = mysql_fetch_array($result);
if(empty($row))
{
setcookie('LoginCookie','',time()-3600);
}
if(mysql_num_rows($result) == 1)
{
$_SESSION['loggedin'] = true;
$_SESSION['loggedinnick'] = $row['nick'];
$_SESSION['loggedinvoornaam'] = $row['voornaam'];
$_SESSION['loggedinachternaam'] =  $row['achternaam'];
$_SESSION['loggedinid'] = $row['id'];
$_SESSION['loggedintype'] = $row['type'];
}
}
}


if(isset($_POST['login']))
{
if(empty($_POST['username']) || empty($_POST['wachtwoord']))
{
$_SESSION['melding'] = 'ERROR';
header('Location: index.php');
exit();
}
$username = CleanMyDirtyData($_POST['username']);
$wachtwoord = sha1(CleanMyDirtyData($_POST['wachtwoord']));
mysql_select_db('database');
$sqlmail = mysql_query("SELECT * FROM people WHERE email='$username' AND wachtwoord = '$wachtwoord'");
$sqlnaam = mysql_query("SELECT * FROM people WHERE nick='$username' AND wachtwoord = '$wachtwoord'");
if(mysql_num_rows($sqlmail) == 1 || mysql_num_rows($sqlnaam) == 1)
{
if(mysql_num_rows($sqlmail) == 1)
{
$row = mysql_fetch_array($sqlmail);
}
else
{
$row = mysql_fetch_array($sqlnaam);
}
if(isset($_POST['remember']))
{
$hash = sha1($username . 'Some secret thingys for your safety');
setcookie('LoginCookie',$hash,time()+30000000);
mysql_query("UPDATE leden SET cookie_hash='" . $hash . "' WHERE id='" . $row['id'] . "'")or die(mysql_error());
}
$_SESSION['loggedin'] = true;
$_SESSION['loggedinnick'] = $row['nick'];
$_SESSION['loggedinvoornaam'] = $row['voornaam'];
$_SESSION['loggedinachternaam'] = $row['achternaam'];
$_SESSION['loggedinid'] = $row['id'];
$_SESSION['loggedintype'] = $row['type'];
$_SESSION['melding'] = 'You are logged in now.';
}
else
{
$_SESSION['melding'] = 'ERROR';
header('Location: index.php');
exit();
}
}

So if the checkbox that you want to stay logged in, there is no cookie made but the $_SESSION['loggedin'] is set to true. Throughout the rest of the page, this parameter is used to show either content for guests of private content for people that are logged in.

BUT the problem is that if it is checked on the first page load the $_SESSION['loggedin'] doesn't seem to get set even though the cookie is set.


Another slight problem with my script is that when a user logs in on another pc, the hash get's changed in the database and the user gets logged out of the site on the previous page. What is the easiest way to do that?
And do you guys think this script is safe? Or do you see some holes?

Thanks in advance!
arbitter

login system. why wont it work? Did same thing @ school it worked. this is my action page:


<?php
ob_start();
$host="host"; // Host name
$username="user"; // Mysql username
$password="pass"; // Mysql password
$db_name="db"; // Database name
$tbl_name="members"; // Table name

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");

// Define $myusername and $mypassword
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];

// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);

$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if($count==1){
// Register $myusername, $mypassword and redirect to file "users/index.php"
session_register("myusername");
session_register("mypassword");
header("location:users/index.php");
}
else {
echo "Error. Username or password incorrect. Have you <a href='#' onclick='alert()'>registered?</a>";
}

ob_end_flush();
?>



It comes up with this error:

Warning: session_register() [function.session-register]: Cannot send session cookie - headers already sent by (output started at C:\xampp\htdocs\external\index.php:59) in C:\xampp\htdocs\external\action.php on line 32

Warning: session_register() [function.session-register]: Cannot send session cache limiter - headers already sent (output started at C:\xampp\htdocs\external\index.php:59) in C:\xampp\htdocs\external\action.php on line 32

Warning: Cannot modify header information - headers already sent by (output started at C:\xampp\htdocs\external\index.php:59) in C:\xampp\htdocs\external\action.php on line 34
 

If you have not registered, please click here
 

 


Warning: Unknown: Your script possibly relies on a session side-effect which existed until PHP 4.2.3. Please be advised that the session extension does not consider global variables as a source of data, unless register_globals is enabled. You can disable this functionality and this warning by setting session.bug_compat_42 or session.bug_compat_warn to off, respectively in Unknown on line 0

Good day!

I have an index.php or a login page.The scenario on my webpage is when i successfully login and i accidentally press the back button the login page appear again and when i try to login again i could login again, which is not good.
here is my code:

<?php  
session_start(); 
 if(isset($_SESSION['USER_ID'])){

exit("you can't login in again when your all ready logged!");

} 
//require_once 'conn.php';  
$db_name="dspi"; 

mysql_connect("localhost", "root", "") or die("Cannot connect to server");
mysql_select_db("$db_name")or die("Cannot select DB");   


        $department = mysql_real_escape_string($_POST['department']);   
        $username = mysql_real_escape_string($_POST['username']); 

        $sql=mysql_query("SELECT `Department`, `Username` FROM `tbllogin` WHERE `Department` = '{$department}' AND Username = '{$username}'") or die(mysql_error()); 
        $ct = mysql_num_rows($sql); 
     
        if($ct == 1) { 
            $row = mysql_fetch_assoc($sql);  
         
            if($row['Department']=='Accounting') { 
                header('location: Company.php'); 
            } elseif($row['Department']=='Engineering') { 
                header('location: Company.php'); 
            } elseif($row['Department']=='Finishing_Goods') { 
                header('location: Company.php'); 
            } elseif($row['Department']=='HRAD') { 
                header('location: Company.php'); 
            } elseif($row['Department']=='MIS') { 
                header('location:Company.php'); 
            } elseif($row['Department']=='Packaging_and_Design') { 
                header('location:Company.php'); 
            } elseif($row['Department']=='Production') { 
                header('location:Company.php'); 
            } elseif($row['Department']=='Purchasing_Logistic') { 
                header('location:Company.php'); 
            } elseif($row['Department']=='QA_and_Technical') { 
                header('location:Company.php'); 
            } elseif($row['Department']=='Supply_Chain') { 
                header('location:Company.php'); 
            } 
            else {
header('location:index.php');
echo"Incorrect Username or Department"; 

         }  
}
?> 

i want help as i cant find that the reason that why registered members cant login, when user pass entered it does not process any thing any help will be appreciated

Code: [Select]
<?php
  session_start();
  session_register("id_session");
  session_register("password_session");
include "header.php";
include "config.php";
$a="";
$b="";
if ($_POST) {
$a=trim($_POST["id"]);
$b=trim($_POST["password"]);
$a=str_replace("'","",$a);
$b=str_replace("'","",$b);
$a=str_replace("\"","",$a);
$b=str_replace("\"","",$b);
}
if ($a=="" || $b=="")
{

  if ($_SESSION["id_session"]=="" || $_SESSION["password_session"]=="")
  {

?>
<form action=members.php method=post>

<br><br><Center><table><tr><td colspan=2 align=center><h3>Members Login Area</h3></td></tr>
<tr><td>Member's ID</td><td><input type=text name=id></td></tr>
<tr><td>Password</td><td><input type=password name=password></td></tr>
<tr><td>&nbsp;</td><td>
<a href="forgot.php" onclick="doexit=false;"><font face="Verdana,Arial,Helvetica" size="1" color="#000000"><b>Forgot Your Password?</b></font></a></td></tr>
<tr><td colspan=2 align=center><input type=submit value="Log In"></td></tr>
</table></form>


<?
  }
  else
  {
  middle();
  }
}
else
{
$check=0;

$id=$_POST["id"];
$rs = mysql_query("select * from members where ID='$id'");

if ($rs) {
$arr=mysql_fetch_array($rs);
$n2=$arr['Password'];
if ($n2==$b) {
$check=1;
$_SESSION["id_session"]=$arr[0];
$_SESSION["password_session"]=$arr[9];
middle();
}
}
if ($check==0)
{
  print "<h2>Invalid User Id or Password</h2>";
?>
<form action=members.php method=post>

<br><br><Center><table><tr><td colspan=2 align=center><h3>Members Login Area</h3></td></tr>
<tr><td>Member's ID</td><td><input type=text name=id></td></tr>
<tr><td>Password</td><td><input type=password name=password></td></tr>
<tr><td>&nbsp;</td><td>
<a href="forgot.php" onclick="doexit=false;"><font face="Verdana,Arial,Helvetica" size="1" color="#000000"><b>Forgot Your Password?</b></font></a></td></tr>
<tr><td colspan=2 align=center><input type=submit value="Log In"></td></tr>
</table></form>
<?
}
}

function middle()
{
$id=$_SESSION["id_session"];
$rs = mysql_query("select * from members where ID=$id");
$arr=mysql_fetch_array($rs);
$check=1;
$id=$arr[0];
$password=$arr[9];
        $name=$arr[1];
        $address=$arr[2];
$city=$arr[3];
$state=$arr[4];
$zip=$arr[5];
$country=$arr[6];
$phone=$arr[7];
$email=$arr[8];
$password=$b;
$paymentoption=$arr[10];
$refby=$arr[11];
$l1=$arr[12];
$l2=$arr[13];
$l3=$arr[14];
$l4=$arr[15];
$l5=$arr[16];
$l6=$arr[17];
$l7=$arr[18];
$l8=$arr[19];
$l9=$arr[20];
$l10=$arr[21];
$leader=$arr[22];
$total=$arr[23];
$unpaid=$arr[24];
$paid=$arr[25];

?>
 <table border="0" width="650">
   <tr>
   <td width="150" valign="top">
     <table width="140">
     <tr>
       <td align="left"><br><br><br><br>
        <ul><font face="verdana" size="1">
<a href="stats.php">Statistics</a><br><br>
<a href="update_pf.php">Edit Personal Information</a><br><br>
<a href="sample_e.php">Referral Code & Links</a><br><br>
              <a href="logout.php">Logout</a><br><br>
</td></tr></table>
     </td>
     <td VALIGN="top">
     <table>
<tr>
<td>
<font face="verdana" size="3"><b>
<p>Account Center</b></font></p>
<br>
</td>
</tr>
<tr>
<td>

<div align="center">
<table border="0" cellpadding="3" cellspacing="0" width="400">
     
      <tr>
        <td colspan="2"><b>
         <hr><font face="Verdana, Arial, Helvetica, sans-serif" size="-1"><center>&nbsp;Account Details for <?echo $name;?></font></center></b><hr>
        </td>
      </tr>
      <tr>
        <td valign="center" align="left"><strong><font face="Verdana" size="-1">Total Commisions Earned: </font></strong><br></td>
        <td valign="center"> <font face="Verdana" size="-1">$<? echo $total;?></font><br></td>
      </tr>
      <tr>
        <td valign="center" align="left"><strong><font face="Verdana" size="-1">Commisions Due: </font></strong><br></td>
        <td valign="center"> <font face="Verdana" size="-1">$<? echo $unpaid;?></font><br></td>
      </tr>
      <tr>
        <td valign="center" align="left"><strong><font face="Verdana" size="-1">Commisions Paid: </font></strong><br></td>
        <td valign="center"> <font face="Verdana" size="-1">$<? echo $paid;?></font><br></td>
      </tr>
      <tr>
        <td valign="center" align="left" colspan=2>&nbsp;</td>
      </tr>
      <tr>
        <td valign="center" align="left"><strong><font face="Verdana" size="-1">Direct Referrals: </font></strong><br></td>
        <td valign="center"> <font face="Verdana" size="-1"><?
$rsd=mysql_query("select * from members where Leader=".$id);
 echo mysql_num_rows($rsd); ?></font><br></td>
      </tr>
      <tr>
        <td valign="center" align="left" colspan=2>&nbsp;</td>
      </tr>
      <tr>
        <td valign="center" align="left" colspan=2><strong><font face="Verdana" size="3">Downline Information </font></strong><br></td>
      </tr>

      <tr>
        <td valign="center" align="left"><strong><font face="Verdana" size="-1">Total Downline Size: </font></strong><br></td>
        <td valign="center"> <font face="Verdana" size="-1"><?     echo ($l1+$l2+$l3+$l4+$l5+$l6+$l7+$l8+$l9+$l10); ?></font><br></td>
      </tr>
<tr><td colspan=2>

<Table width=100%>
<tr><td bgcolor=#000000><strong><font face="Verdana" size="-1" color=#ffffff>Level</font></strong></td>
<td bgcolor=#000000><strong><font face="Verdana" size="-1" color=#ffffff>Number of Members</font></strong></td> </tr>
<? include "config.php"; ?>
<? for($i=1;$i<=$levels;$i++) { ?>
<tr><td><strong><font face="Verdana" size="-1"><? echo $i; ?></font></strong></td>
<td ><font face="Verdana" size="-1">
<?
if($i==1) {
echo $l1;
}
elseif($i==2) {
echo $l2;
}
elseif($i==3) {
echo $l3;
}
elseif($i==4) {
echo $l4;
}
elseif($i==5) {
echo $l5;
}
elseif($i==6) {
echo $l6;
}
elseif($i==7) {
echo $l7;
}
elseif($i==8) {
echo $l8;
}
elseif($i==9) {
echo $l9;
}
elseif($i==10) {
echo $l10;
}
?>
</font></td> </tr>
<? } ?>
</table>
</td></tr>
      <tr><td colspan=4><hr></td><tr>
     </table>
</div>

</td>
</tr>

</table>
<font face="verdana" size="3"><b>
<p>Download Center</b></font></p>

<?
include "download.php";
?>
  </td>
  </tr>
</table>
<br><br>
<?
}
include "footer.php";
?>

edit: added [code][/code] blocks