PHP - Login Using External Side Login System

Hi, im getting alot of errors like so Deprecated: Function session_is_registered() is deprecated

time to update some files, can you guys pls help im rubbish with PHP guess thats why I waited so long to update.

here is the code I need to change
checklogin.php

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if($count==1){
// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("myusername");
session_register("mypassword");
header("location:index.php");
}


index.php
<?
session_start();
/*if(!session_is_registered(myusername)){
header("location:main_login.php");
}*/
?>

index.php (display username stuff)
<?php if(session_is_registered(myusername)){ ?>&nbsp;&nbsp; Welcome: <?= $_SESSION['myusername'] ?><?php } ?>

index.php (edit content stuff)
<?php $file = file_get_contents('content/menu_header_a.txt', 'r');  if(session_is_registered(myusername)){ ?><a href="javascript:open4()"><?php echo $file ?></a><?php } else { echo $file; }?>

Many thanks for any and all your help with this one.

if you could keep it simple please like  ( replace this with this ) . thanks

I'm trying to build a login system and alot of the code is similar to what i used to make my news cms. basically all i wanna accomplish right now is to get the user input inserted into my database. I've already tested it out, and I get no errors, but like with the cms, the database isn't getting queryed.

Here's the code:
(process.php)
Code: [Select]
<?php
 $first_name=$_POST['first_name']; 
 $last_name=$_POST['last_name']; 
 $age=$_POST['age']; 
 $city=$_POST['city']; 
 $state=$_POST['state']; 
 $country=$_POST['country']; 
 $zip=$_POST['zip']; 
 $birthdate=$_POST['birthdate']; 
 $gender=$_POST['gender']; 
 $sexuality=$_POST['sexuality']; 
 $race=$_POST['race']; 
 $religion=$_POST['religion']; 
 $status=$_POST['status']; 
 $about=$_POST['about']; 
 $website=$_POST['website']; 
 $user_name=$_POST['user_name']; 
 $password=$_POST['password']; 
 $email=$_POST['email']; 
 mysql_connect("your hostname", "your database name", "your password") or die(mysql_error()); 
 mysql_select_db("your database name") or die(mysql_error()); 
 
 $sql = sprintf("INSERT INTO Users (first_name, last_name, age, city, state, country, zip, birthdate, gender, sexuality, race, religion, status, about, website, user_name, password, email)
VALUES ('%s', '%s', '%s', '%s', '%s')",
mysql_real_escape_string($first_name),
mysql_real_escape_string($last_name),
mysql_real_escape_string($age),
mysql_real_escape_string($city),
mysql_real_escape_string($state),
mysql_real_escape_string($country),
mysql_real_escape_string($zip),
mysql_real_escape_string($birthdate),
mysql_real_escape_string($gender),
mysql_real_escape_string($sexuality),
mysql_real_escape_string($race),
mysql_real_escape_string($religion),
mysql_real_escape_string($status),
mysql_real_escape_string($about),
mysql_real_escape_string($website),
mysql_real_escape_string($user_name),
mysql_real_escape_string($password),
mysql_real_escape_string($email));
$result = mysql_query($sql); 
 
 
 Print "Congratulations! You are now a registered member on yourwebsite.com!"; 
 ?>
(register/index.php)
Code: [Select]
<script language = "Javascript">
 
function Validate()
{
    if (document.register.first_name.value == '')
    {
        alert('You have not specified your first name!');
        return false;
    }
if (document.register.last_name.value == '')
    {
        alert('You have not specified your last name!');
        return false;
    }
if (document.register.age.value == '')
    {
        alert('You have not specified your age!');
        return false;
    }
if (document.register.country.value == '')
    {
        alert('You have not entered a country!');
        return false;
    }
if (document.register.birthdate.value == '')
    {
        alert('You have not entered your date of birth!');
        return false;
    }
if (document.register.gender.value == '')
    {
        alert('You have not specified your gender!');
        return false;
    }
if (document.register.user_name.value == '')
    {
        alert('You have not entered a username!');
        return false;
    }
if (document.register.email.value == '')
    {
        alert('You have not entered an email!');
        return false;
    }
if (document.register.password.value == '')
    {
        alert('You have not entered a password!');
        return false;
    }
    return true;
}
</script>
      <form name="register" method="post" action="http://www.djsmiley.net/register/process.php" onsubmit="return Validate();">
                    <table width="100%" border="0">
                      <tr>
                        <td>First Name:</td>
                        <td><label>
                          <input type="text" name="first_name" id="first_name" />
                        </label></td>
                      </tr>
                      <tr>
                        <td>Last Name:</td>
                        <td><input type="text" name="last_name" id="last_name" /></td>
                      </tr>
                      <tr>
                        <td>Age:</td>
                        <td><input type="text" name="age" id="age" /></td>
                      </tr>
                      <tr>
                        <td>City:</td>
                        <td><input type="text" name="city" id="city" /></td>
                      </tr>
                      <tr>
                        <td>State:</td>
                        <td><input type="text" name="state" id="state" /></td>
                      </tr>
                      <tr>
                        <td>Country:</td>
                        <td><input type="text" name="country" id="country" /></td>
                      </tr>
                      <tr>
                        <td>Zip:</td>
                        <td><input type="text" name="zip" id="zip" /></td>
                      </tr>
                      <tr>
                        <td>Birthdate:</td>
                        <td><input type="text" name="birthdate" id="birthdate" /></td>
                      </tr>
                      <tr>
                        <td>Gender:</td>
                        <td><input type="text" name="gender" id="gender" /></td>
                      </tr>
                      <tr>
                        <td>Sexuality:</td>
                        <td><input type="text" name="sexuality" id="sexuality" /></td>
                      </tr>
                      <tr>
                        <td>Race:</td>
                        <td><input type="text" name="race" id="race" /></td>
                      </tr>
                      <tr>
                        <td>Religion:</td>
                        <td><input type="text" name="religion" id="religion" /></td>
                      </tr>
                      <tr>
                        <td>Marital Status:</td>
                        <td><input type="text" name="status" id="status" /></td>
                      </tr>
                      <tr>
                        <td>About You:</td>
                        <td><label>
                          <textarea name="about" id="about" cols="45" rows="5"></textarea>
                        </label></td>
                      </tr>
                      <tr>
                        <td>Website:</td>
                        <td><input type="text" name="website" id="website" /></td>
                      </tr>
                      <tr>
                        <td width="13%">Username: </td>
                        <td width="87%"><input type="text" name="user_name" id="user_name" /></td>
                      </tr>
                      <tr>
                        <td>Email: </td>
                        <td><input type="text" name="email" id="email" /></td>
                      </tr>
                      <tr>
                        <td>Password: </td>
                        <td><input type="password" name="password" id="password" /></td>
                      </tr>
                      <tr>
                        <td>&nbsp;</td>
                        <td><input name="Register Button" type="submit" class="Button1" id="Register Button" value="Register" />
                        <input name="Reset Button" type="reset" class="Button1" id="Reset Button" value="Clear" /></td>
                      </tr>
                    </table>
                    <label></label>
      </form>

I've abandoned my old script and switched to this one: http://www.evolt.org/node/60384

I got it working on my site just fine (djsmiley.net/members/register - you can test it out if u want). i just want to know how i can put all of the code into the pages i created using my template.

It doesn't specify how this can be done in the tutorial, which is why im confused. I've tried everything but keep getting errors. Help?

Hey all.  I was curious what is the best practice when creating a user login system? I've seen them done in the following 2 ways.

First I've seen tutorials on logins where after the post data is verified against the database a username session is created and member pages are accessed if the user session is set.

Second I've seen tutorials on logins where the username session is verified against the database on every single page.

What is the best practice along these lines?

Cheers!

hi, I'm coding a website, after being away from php for a while, and there's this simple thing that's driving me crazy. I made a simple login system to test, and I have to refresh the page twice so it becomes active, and I can't figure out why. what's wrong with this code? (keep in mind that it's just a test, I plan to get username from database, send encrypted info to cookies, and all that, but after I get this working)

Code: [Select]
<?php
if (isset($_POST['submitlogin']))
{ if ((($_POST['username'])&&($_POST['password']))=="admin")
{ setcookie("user", "Administrator", time()+3600);
} else { $loginerror="1"; } }
if (isset($_GET['logout']))
{ setcookie("user", "", time()-3600); }
?>
<html>
<head>
</head>
<body>

<?php
if (isset($_COOKIE['user']))
{ echo "Hello, ".$_COOKIE['user'];
?>

<br /><a href="?logout=yes">Logout</a>

<?php }else{?>

<form action="" method="post">
<input name="username" type="text" /><br />
<input name="password" type="password" /><br />
<input name="submitlogin" type="submit" value="Login" />
</form>

<?php }?>

</body>
</html>

thanks for any help!

Hello everyone,

I'd like to make a small object oriented login system. The problem is that I'm not very good at oop and i have only written these scripts the procedural way.

So please, correct me if I'm wrong:

class database
- connect()
class user
- login()

My problem is when i make a database connection in connect(), I can't use it in login().

class Database{

public function connect(){
$mysqli = new mysqli('localhost','root','','login');
}
}

class User{

public function login(){
// how do i use connect() from above and make a query to log the user in?
}

i have already made the register page where their info goes into the database, and im not sure about the code that selects values from the database.
mysql_connect('', '', '');
mysql_select_db('');

$user = $_POST['user'];
$pass = $_POST['pass'];

echo "<font color='white'>You Need To Login</font>";
if($user == Username && $pass == Password) echo "Welcome $user";

mysql_query("SELECT ('Username', 'Password') FROM login");

?>

here is my part of the code which i am stuck on
<?php

$form = "<form action='login.php' method='post'>
<center>
<table>
<tr>
<td><input type='text' id='usernamebox' name='Username' value='Username' tabindex='1' class='textbox' onFocus='usernamebox_focus();' onBlur='usernamebox_blur();'></td>
    <td><a href='register.php'>Register</span></a></td>
</tr>
<tr>
<td><input type='password' id='passwordbox' name='Password' value='Password' tabindex='2' class='textbox' onFocus='passwordbox_focus();' onBlur='passwordbox_blur();'></td>
    <td><input type='submit' name='loginbutton' value='Login'></td>
</tr>
</table>
</center>
</form>";  ******(on the website the rest under thiss is missing)********

if ($_POST['loginbutton']){
$user = $_POST['username'];
$password = $_POST['password'];

if ($user && $password && $user != 'Username'){
require("Scripts/connect.php");
$password = md5($password);
$query = mysql_query("SELECT * FROM users WHERE username='$user' AND password='$password'");

$numrows = mysql_num_rows($query);

if ($numrows = 1){
$rows = mysql_fetch_assoc($query);
$dbuser = $rows['username'];

$_SESSION['user'] = $dbuser;
$_SESSION['id'] = $dbid;
echo "<a href='index.php'> You are now loged in Click here to go to our Homepage</a>";
}
else
echo '<center>You did not submit a correct username and/or password!</center>';
echo '$form';

}
else
echo '<center>You did not submit a correct username and/or password!</center>';
echo '$form';
}
else{
echo '$form';
}

?>

Hey all,
    I'm in the process of developing a PHP login system for the website of a team I'm involved with. I have a MySQL database already set up to hold user data, but I lack the knowledge to create a respectably secure login system. I tend to be a tad obsessive when it comes to security, and seeing different systems being implemented on various tutorials that cover this topic makes me cynical of the integrity of any of them. So, my question is: how can I create a secure login system that isn't too complex in implementation? Are there any reliable tutorials for this? Would some sort of system that uses session variables be what I'm looking for? I don't require excessive security, but privelidges gained if this system is compromised would be no small matter.

Thanks for any help.

I am using a login system in php and mySQL but only one page is potected.

pages i am using:
1. login.php // inputing details (user name, password)
2. checkloginDetails.php // connect to db and check login details
3. logged_in.php // successfully login

...i need more than the one page protected for example; once the user has logged in there will be the main logged in page with other links, remove topics, add, user, remove user all these pages i want protecting but with out the user inputing his details again.

Has anyone got an idear onhow i ould achive this?
 

This is my one page log in system. Using this on the header so guests can log in on ANY page. Let me know what you think needs improving for security. I'm also wondering if putting the include "disconnect.php"; where I have is correct. Thanks!

Code: [Select]
<?php
session_start();

$message = ""; //error message needs to be blank
$loginstatus = ""; //error message needs to be blank

//if $_POST "username" and "password" exist, check for consistency.
if (isset($_POST['username'])&&($_POST['password']))
{
include 'connect.php'; //connect
$username = mysql_real_escape_string($_POST['username']); //set variables from session
$password = mysql_real_escape_string($_POST['password']); //set variables from session

//remove slashes and HTML
$username = stripslashes($username);
$password = stripslashes($password);
$username = strip_tags($username);
$password = strip_tags($password);

$password = md5($password); //md5 encryption

$query = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'"); //checking if row exists that has $username and $password together.
$num = mysql_num_rows($query); //number of rows. if not equal to one login will fail.

if($num==1)
{
$_SESSION['username'] = $username; //store session data
$message = "$username, you are logged in!";
include "disconnect.php";
}
else
{
$message = "<font color='red'>Wrong Username or Password. Please try again.</font>";
}
}

//if $_SESSION "username" and "password" exist, check for consistency.
if (isset($_SESSION['username']))
{
$username = $_SESSION['username'];
$loginstatus = "
<table cellspacing='0' cellpadding='0'>
<tr>
<td align='right'><b>$message</b> <a href='logout.php'>[logout]</a></td>
</tr>
</table>
";
}
else
{
$loginstatus = "
<b>$message</b>
<table cellspacing='0' cellpadding='0'>
<form action='index.php' method='post'>
<tr>
<td><b>Username: </td>
<td><input type='text' name='username' class='inputbox'></td>
<td>   <b>Password: </td>
<td><input type='password' name='password' class='inputbox'></td>
<td>   <input type='submit' value='Log In' class='submitbutton'></td>
</tr>
</table>
</form>
";
}

echo $loginstatus;
?>

My main pages looks like this...

<?php
include "header.php";

CONTENT

include "footer.php";
?>

On the header will be my login script so on every page the script will be there so they can log in from anywhere on the site. Also, I want it all done on one page instead of being directed somewhere else. This is the code below.

<?php
session_start();

$message = ""; //error message needs to be blank
$loginstatus = ""; //error message needs to be blank

//if $_POST "username" and "password" exist, check for consistency.
if (isset($_POST['username'])&&($_POST['password']))
{
include 'connect.php'; //connect
$username = mysql_real_escape_string($_POST['username']); //set variables from session
$password = mysql_real_escape_string($_POST['password']); //set variables from session

//remove slashes and HTML
$username = stripslashes($username);
$password = stripslashes($password);
$username = strip_tags($username);
$password = strip_tags($password);

$password = md5($password); //md5 encryption

$query = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'"); //checking if row exists that has $username and $password together.
$num = mysql_num_rows($query); //number of rows. if not equal to one login will fail.

if($num==1)
{
$_SESSION['username'] = $username; //store session data
$message = "$username, you are logged in!";
}
else
{
$message = "<font color='red'>Wrong Username or Password. Please try again.</font>";
}
}

//if $_SESSION "username" and "password" exist, check for consistency.
if (isset($_SESSION['username']))
{
$username = $_SESSION['username'];
$loginstatus = "
<table cellspacing='0' cellpadding='0'>
<tr>
<td align='right'><b>$message</b> <a href='logout.php'>[logout]</a></td>
</tr>
</table>
";
}
else
{
$loginstatus = "
<b>$message</b>
<table cellspacing='0' cellpadding='0'>
<form action='CURRENTPAGE.php' method='post'>
<tr>
<td><b>Username: </td>
<td><input type='text' name='username' class='inputbox'></td>
<td>   <b>Password: </td>
<td><input type='password' name='password' class='inputbox'></td>
<td>   <input type='submit' value='Log In' class='submitbutton'></td>
</tr>
</table>
</form>
";
}

echo $loginstatus;

?>

I have two questions...

#1 How can I direct my page when entering the password to the current page the user is on? (look at CURRENTPAGE.php in the code for reference)

#2 Security is obviously an issue at all times. How does my security look? What can I do to make this login script more secure?

Thanks so much for all of those who help out. I'll be watching this forum all day everyday.

I tried Googling them and what not but all I could find was useless stuff that I couldn't get to work, so I thought I would give it a crack at making my own. I don't think its that secure though. Can someone have a geeza over it? I've pretty much made it up from bits and pieces I have seen and researched. Ignore the echoes they were just for testing.

Well the code was working, now it just keeps redirecting me to index. So I dunno what I fucked.

Heres all the code:
Index.php
Code: [Select]
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>

<body>
<?php 
include 'functions.php';
Connect();
?>
<form method="post" action="login.php">
<input type="text" name="Username" />
<input type="password" name="Password" />
<input type="hidden" name="ip" value="<?php ipget(); ?>" />
<input type="submit" />
</form>
</body>
</html>
Login.php
<?php
require_once 'standalone\HTMLPurifier.standalone.php';
include "functions.php";
Connect();
$purifier = new HTMLPurifier();
$result = mysql_query("SELECT Username, Password FROM login ") or die(mysql_error());
$sorted = mysql_fetch_array($result);
$name = $purifier->purify(strtolower($_POST['Username']));
$pass = $purifier->purify(md5(strtolower($_POST['Password'])));
$ip = md5($_POST['ip']);
$stamp = date("Ymdhis");

 

if ( $name == $sorted['Username'] ){
Echo "Username Correct";
if ( $pass == $sorted['Password'] ) {
echo "Password is correct";
session_start();
$_SESSION['ip'] = $ip;
$_SESSION['Username'] = $name;
$_SESSION['Password'] = $pass;
setcookie('ip', $ip, time()+3600);
setcookie('name', $name, time()+3600); 
$ipb = $_SERVER['REMOTE_ADDR'];
$orderid = "$stamp-$ipb";
$orderid = str_replace(".", "", "$orderid");
$GUID = md5(orderid);
setcookie('GUID', $GUID, time()+3600);
mysql_query("UPDATE login SET GUID = $GUID WHERE Username = '$name'");
header("location: admin.php");
} else {
echo "password is wrong";
}
} else {
Echo "wrong name";
}

?>


Functions.php
<?php
function connect(){
mysql_connect("localhost", "test", "password") or die(mysql_error());
mysql_select_db("db344475103") or die(mysql_error());
echo "Connected";
}
function ipget(){
$ip = $_SERVER['REMOTE_ADDR'];
echo $ip;
}
function check(){
session_start();
if (md5($_SERVER['REMOTE_ADDR']) == $_SESSION['ip'])
{
if (md5($_SERVER['REMOTE_ADDR']) == $_COOKIE['ip'])
{
if ($_SESSION['Username'] == $_COOKIE['name'])
{
if ($_COOKIE['GUID'] == mysql_query("SELECT GUID FROM login")) {
} else {
header("location: index.php");
session_destroy();
}
} else {
header("location: index.php");
session_destroy();
}
} else {
header("location: index.php");
session_destroy();
}
} else {
header("location: index.php");
session_destroy();
}
}
function clean(){
}
?>

Admin.php
Code: [Select]
<?php
include 'functions.php';
check();
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>

<body>
Admin Area
</body>
</html>
Yeah its a lot of code, probably most of it useless as well knowing me.

Hi, I made a login/register system and it was working fine, but now I seem to have broken it and I'm scratching my head as to why. I think it's something to do with the $_SESSION array, the error happens from going from the login.php page to members.php, I log in successfully, but when I get to the members page it says "you must be logged in".

index.php has the form to login or a link to register.php to make an account
Code: [Select]
<?php session_start(); ?>
<html>
<head>
<title>Lincs Crusade | Login page.</title>
</head>
<body>
<form action="login.php" method="POST">
Username:
<input type="text" name="username"><br />
Password:
<input type="password" name="password"><br />
<input type="submit" value="Login">
</form>
<a href="register.php">Click here to register!</a>
</body>
</html>

The register.php page
Code: [Select]
<?php
session_start();
echo "<h2>Register</h2>";
$submit = $_POST['submit'];
$username = strip_tags($_POST['username']); 
$password = strip_tags($_POST['password']);
$repeatpassword = strip_tags($_POST['repeatpassword']);
$email = $_POST['email'];
$date = date("Y-m-d");

if ($submit) { 
if ($username&&$password&&$repeatpassword&&$email) {
if ($password==$repeatpassword) {
if (strlen($username)>65) { 
echo "Length of username is too long!"; 
} elseif (strlen($email)>100) { 
echo "Length of email is too long!";
} elseif (strlen($password)>65||strlen($password)<8) {
echo "Password must be between 8 and 65 characters long!"; 
} else {
include('functions.php'); 
echo "All fields were accepted! ";
$password = md5($password);
$repeatpassword = ($repeatpassword);
$email = md5($email);
connect(); 
mysql_query(" 
INSERT INTO users VALUES ('','$username','$password','$email','$date') 
") or die("Could not insert values into <em>users</em> table!");
mysql_query("
INSERT INTO stats VALUES ('$username',10,10,0,1)
") or die("Could not insert values into <em>stats</em> table!");
$_SESSION['username'] == $username;
die("You have been registered! Please return to <a href=\"index.php\">homepage</a> and login."); 
}
} else {
echo "Your passwords do not match!";
}
} else {
echo "Please fill in <em>all</em> fields!";
}
 
}
?>
<html>
<head>
<title>Lincs Crusade | Register an Account.</title>
</head>
<body>
<form action="register.php" method="POST">
<p>Your username:</p>
<p>Note: Do not use your real name.</p>
<input type="text" name="username" value="<?php echo $username ?>"/>=
<p>Choose a password:</p>

<input type="password" name="password" />
<p>Please repeat password:</p>
<input type="password" name="repeatpassword" />
<p>Your student email:</p>
<p>Note: This is only used for recovering a lost or forgotten password.</p>
<input type="text" name="email" /><br />
<input type="submit" value="Register" name="submit" />
<p>
Note: Your password and email are md5 encrypted. This means neither I (the author) or anyone else will be able to view your information<br />
in plain text. For example, your password or email will look something like this "534b44a19bf18d20b71ecc4eb77c572f" once it has been encrypted.
</p>
</form>
</body>
</html>

The login.php page that process the form data to access members.php page
Code: [Select]
<?php
session_start();
$username = $_POST['username'];
$password = $_POST['password'];
if ($username&&$password) {
include('functions.php');
connect();
$query = mysql_query("SELECT * FROM users WHERE username='$username'");
$numrow = mysql_num_rows($query); 
if ($numrow!=0) { 
while ($row = mysql_fetch_assoc($query)) {
$dbusername = $row['username'];
$dbpassword = $row['password'];
}
if ($username==$dbusername&&md5($password)==$dbpassword) { 
echo "You're in! - <a href=\"members.php\">Proceed to the members page</a>";
$_SESSION['username'] == $username; 
} else {
echo "Incorrect password!";
}
} else {
die ("That user doesn't exist,<a href=\"register.php\">please register an account</a>");
}
} else {
die("Please enter a username and password!");
} 
?>

The members.php page
Code: [Select]
<?php 
session_start();
?>
<html>
<head>
<title>Lincs Crusade | Members page.</title>
</head>
<body>
<?php
if ($_SESSION['username']) {
echo "Welcome," .$_SESSION['username']. "!<br />";
echo "<a href=\"stats.php\">View your stats.</a>";
} else {
die ("You must be logged in.");
}
?>
</body>
</html>

and this is what is in the functions.php file
Code: [Select]
<?php
function connect() {
    mysql_connect("localhost","root","password") or die ("Unable to connect");
mysql_select_db("database") or die ("Unable to find database");
}
?>

Thanks for your help.