PHP - Php Login Class And One More Question

I have created this login class (In all honesty this is the most commented and well structured class I have ever written, I usualy just use random functions in a functions.php file, which works but this felt good when I finished it )

I just wanted some advice to how safe and whether the way I have done this is 'good practise', or if there is anything I should add to future proof it.

This is the class:
Code: [Select]
<?php
/* 
Author: Craig Dennis
File: user_session.class.php
Purpose: Flexible user login class that handles logging in, checking a user is logged in, and logging out.

NOTE TO USE THIS CLASS YOU MUST ALREADY HAVE ALREADY CONNECTED TO THE DATABASE

Include this file at the top of each page you wish to protect
 include("inc/user_session.class.php"); //(This could be put at the top of a global include file)
 
Use the following code to check the user is logged in:
 $user_session = new user_session; //(This could be put at the top of a global include file)
 $user_session->validate_user(); //(This should only be left on the pages you wish to check for user validation)
 
You will want to use the public redirect_if_logged_in() function instead of validate_user() on the login page like this:
 $user_session->redirect_if_logged_in(); //(This will redirect a user from the current page to the specified landing page)
*/
class user_session{
// Change these variables below if the table and fields in your database do not match
public $t_name = "admins";
public $t_user = "username";
public $t_pass = "password";
public $t_lastlogin = "last_login"; //set $t_lastlogin = NULL if you do not have this field in your database

//Change $login_page and $landing_page if your page names are different to this one
public $login_page = "login.php";
public $landing_page = "logged_in.php";

//Change $log_in_error_msg if you wish to change the general error message when the user is unable to log in
public $log_in_error_msg = "The username or password you have entered is incorrect or does not exist";

//Do not touch anything below unless you know what your doing

/*
 * logged_in_user()
 * Returns value of the current logged in username
 */
public function logged_in_user(){
return $_SESSION['user_username'];
}

/*
 * log_in()
 * Takes 2 parameters ($username, $password)
 * Attempts to log in with the provided credentials, on success, the username and password are saved in the session for future testing
 */
public function log_in($username, $password){
$username = stripslashes(mysql_real_escape_string($username));
$password = stripslashes(mysql_real_escape_string($password));

$query_login = mysql_query("SELECT * FROM ".$this->t_name."
  WHERE ".$this->t_user."='$username' AND ".$this->t_pass."='$password'");;

$login_accepted = mysql_num_rows($query_login);

if($login_accepted == 1){
if($t_lastlogin != NULL){
$query_update_last_login = mysql_query("UPDATE ".$this->t_name." SET ".$this->t_lastlogin."='".time()."'
WHERE ".$this->t_user."='$username'");
}
$_SESSION['user_username'] = $username;
$_SESSION['user_password'] = $password;
return true;
}else{
return false;
}
}

/*
 * check_user()
 * Returns true if the current session credentials can be found in the database, otherwise returns false
 */
public function check_user(){
$query_login = mysql_query("SELECT * FROM ".$this->t_name."
  WHERE ".$this->t_user."='".$_SESSION['user_username']."' 
AND ".$this->t_pass."='".$_SESSION['user_password']."'");

$login_accepted = mysql_num_rows($query_login);

if($login_accepted == 1){
return true;
}else{
return false;
}
}

/*
 * validate_user()
 * Returns true if the current session credentials can be found in the database, otherwise logs user out and returns false
 */
public function validate_user(){
$login_accepted = $this->check_user();

if($login_accepted == 1){
return true;
}else{
$this->log_out();
return false;
}
}

/*
 * redirect_if_logged_in()
 * Redirects the user to the specified landing page if the user is logged in
 */
public function redirect_if_logged_in(){
if($this->check_user()){
header("Location: ".$this->landing_page);
}
}

/*
 * log_out()
 * Logs the user out by setting the session credentials to an empty string and redirecting them to the specified login page
 */
public function log_out(){
$_SESSION['user_username'] = "";
$_SESSION['user_password'] = "";
header("Location: ".$this->login_page);
}
}
?>

Any comments or advice are appreciated.

(Main Objective)
I need this login class to encrypt the password before it sends it to the database for login verification.

(Alternative Solution)
Force a login with just the username and captcha no password..


This is the original working script..

<?
session_start();
include "config.php";
global $c;
include "data.php";
global $config;
require('funciones.php');
if ($_POST['username']) {


session_start(); 
if($_POST['code']!=$_SESSION['string']){ 
header("Location: login.php?error=1");
}


//Comprobacion del envio del nombre de usuario y password

$username=uc($_POST['username']);
$password=uc($_POST['password']);

if ($password==NULL) {
header("Location: login.php?error=2");
}else{


$query = mysql_query("SELECT username,password FROM tb_users WHERE username = '$username'") or die(mysql_error());
if(mysql_num_rows($query) == 0)
{
header("Location: login.php?error=3");
} else {
$data = mysql_fetch_array($query);
if($data['password'] != $password) {
header("Location: login.php?error=4");
}else{
$query = mysql_query("SELECT username,password FROM tb_users WHERE username = '$username'") or die(mysql_error());
$row = mysql_fetch_array($query);

$nicke=$row['username'];
$passe=$row['password'];

//90 day  cookie
setcookie("usNick",$nicke,time()+7776000);
setcookie("usPass",$passe,time()+7776000);


$lastlogdate=time();
$lastip = getRealIP();

$querybt = "UPDATE tb_users SET lastlogdate='$lastlogdate', lastiplog='$lastip' WHERE username='$nicke'";
mysql_query($querybt) or die(mysql_error());

header("Location: members.php");
// echo "Has sido logueado correctamente ".$_SESSION['s_username']." y puedes acceder al index.php.";
// echo "<script>location.href='index.php';</script>";
?>

<META HTTP-EQUIV="REFRESH" CONTENT="0;URL=members.php">

<?
}
}
}
}
?>

<div class="heading">Login</div><br />
<?
if($_GET['error'] == 1)
{
print "<b>Error</b> - Wrong Captcha Code<br /><br/>";
}
if($_GET['error'] == 2)
{
print "<b>Error</b> - Please supply a password<br /><br/>";
}
if($_GET['error'] == 3)
{
print "<b>Error</b> - Invalid Username<br><br>";
}
if($_GET['error'] == 4)
{
print "<b>Error</b> - Invalid Password<br /><br />";
}
?>

<form action="login.php" method="post">
    <table>
        <tr>
            <td class="midtext">Username:</td>
            <td>
            <input type="text" name="username" size="25" class="form" autocomplete="off"></td>
        </tr>
        <tr>
            <td class="midtext">Password:</td>
            <td>
            <input type="password" name="password" size="25" class="form" autocomplete="off"></td>
        </tr>
        <tr>
            <td class="midtext" valign="top">Security Code:</td>
            <td class="midtext">
            <img src="image.php" onclick="this.src='image.php?newtime=' + (new Date()).getTime();">(Click 
            to reload)<br />
            <input type="text" name="code" size="17" maxlength="17" autocomplete="off" class="form"></td>
        </tr>
        <tr>
            <td></td>
            <td align="right">
            <input type="submit" value="Login" name="loginsubmit" class="form"></td>
        </tr>
    </table>
</form>


Let me know if you need any files...

I'm starting to use a class to perform DB functions because I think it is more efficient. I found this class on the internet and understand pretty well what is going on. My problem is that I can't put the results on the screen when I use the class. (I can do it with out using the class but I'd like to learn to use it)

function fetch($info) {
        return mysql_fetch_array($info);

this is how I'm attempting to use it

$db = new mysql;
$db->connect();

while($row = $db->fetch($db->query("SELECT * FROM Attributes")))
{
echo $row['Attribute']."<br>";
}
This just echos the first row forever and I'm not sure how else to go about this. Any help would be appreciated.

Hi!

So I know that when redirecting to administrator pages after login is very often done like this: header(location:admin.php);

But what if I didnt want to use header? I'm asking because I would just like to include the admin section within the part of the website I'm currently residing, if that makes any sense. Also, I think using headers is a bit cumbersome.

I have just recently started learning PHP, so please excuse me if this is a dumb question

One major problem I want to fix is that as of right now any user who knows the link to my admin panel can go to it directly. What I want to do is see if the the user is logged in (session exists). And if they are not logged in meaning no session exists then to kick them back to the login.php script.

index.php(admin page only php coding)

<?php

session_start(); // Access the existing session

// Include the variables page
include ('inc/variables.php');

// If no session is present, redirect the user:
if(!isset($SESSION['id'])) {
    header("Location: login.php");
    exit();
}

?>


However on my login page after I log in its as if with the top code goes right back to it for some reason? Any fixes?