PHP - Moved: A Working Php Login System?

Hi Everyone,

Just a quick question before I take on this project.

Basically the client has a secure server set up with folders for different clients. So they can store excel files, PDFs etc, What the client use to do was send the client an email with the http address of that clients particular folder to be able to login.

What my job is to create a login system that redirects each client to their particular area on the secure system.

Is this going to be difficult,

What I was thinking of doing was when the administator is setting up the client details there would be an extra field saying address: they paste the address of the folder on the server. Then it will redirect them to their folder.

Is this the correct way to do this.

Any help or advice would be great.

Hi could you help me get this login page working? I made a form which posts to login.php the "user" and "pass".   Then this is my code for login.php:

<?php include("mysql_connect.inc.php"); ?>

<?php
$user = $_POST['user'];
$pass = $_POST['pass'];

session_start();
$query = mysqli_query("SELECT * FROM users WHERE username='$user'");
$results = mysqli_query($con, $query) or die(mysqli_error($con));
$resultsarray = mysql_fetch_array($userresults);

if (isset($_POST['user']) && $_POST['user'] == $query && isset($_POST['pass']) && $_POST['pass'] == $query) {
$_SESSION['username'] = $_POST['user'];
echo "<p>Login success. You are logged in as: " . $_SESSION['username'] . "</p>Return to mainpage, click <a href='index.php'>here</a>!";
} else {
echo "<p>Wrong username or password.</p>";

}
mysqli_close($con);
?>

I'm trying to build a login system and alot of the code is similar to what i used to make my news cms. basically all i wanna accomplish right now is to get the user input inserted into my database. I've already tested it out, and I get no errors, but like with the cms, the database isn't getting queryed.

Here's the code:
(process.php)
Code: [Select]
<?php
 $first_name=$_POST['first_name']; 
 $last_name=$_POST['last_name']; 
 $age=$_POST['age']; 
 $city=$_POST['city']; 
 $state=$_POST['state']; 
 $country=$_POST['country']; 
 $zip=$_POST['zip']; 
 $birthdate=$_POST['birthdate']; 
 $gender=$_POST['gender']; 
 $sexuality=$_POST['sexuality']; 
 $race=$_POST['race']; 
 $religion=$_POST['religion']; 
 $status=$_POST['status']; 
 $about=$_POST['about']; 
 $website=$_POST['website']; 
 $user_name=$_POST['user_name']; 
 $password=$_POST['password']; 
 $email=$_POST['email']; 
 mysql_connect("your hostname", "your database name", "your password") or die(mysql_error()); 
 mysql_select_db("your database name") or die(mysql_error()); 
 
 $sql = sprintf("INSERT INTO Users (first_name, last_name, age, city, state, country, zip, birthdate, gender, sexuality, race, religion, status, about, website, user_name, password, email)
VALUES ('%s', '%s', '%s', '%s', '%s')",
mysql_real_escape_string($first_name),
mysql_real_escape_string($last_name),
mysql_real_escape_string($age),
mysql_real_escape_string($city),
mysql_real_escape_string($state),
mysql_real_escape_string($country),
mysql_real_escape_string($zip),
mysql_real_escape_string($birthdate),
mysql_real_escape_string($gender),
mysql_real_escape_string($sexuality),
mysql_real_escape_string($race),
mysql_real_escape_string($religion),
mysql_real_escape_string($status),
mysql_real_escape_string($about),
mysql_real_escape_string($website),
mysql_real_escape_string($user_name),
mysql_real_escape_string($password),
mysql_real_escape_string($email));
$result = mysql_query($sql); 
 
 
 Print "Congratulations! You are now a registered member on yourwebsite.com!"; 
 ?>
(register/index.php)
Code: [Select]
<script language = "Javascript">
 
function Validate()
{
    if (document.register.first_name.value == '')
    {
        alert('You have not specified your first name!');
        return false;
    }
if (document.register.last_name.value == '')
    {
        alert('You have not specified your last name!');
        return false;
    }
if (document.register.age.value == '')
    {
        alert('You have not specified your age!');
        return false;
    }
if (document.register.country.value == '')
    {
        alert('You have not entered a country!');
        return false;
    }
if (document.register.birthdate.value == '')
    {
        alert('You have not entered your date of birth!');
        return false;
    }
if (document.register.gender.value == '')
    {
        alert('You have not specified your gender!');
        return false;
    }
if (document.register.user_name.value == '')
    {
        alert('You have not entered a username!');
        return false;
    }
if (document.register.email.value == '')
    {
        alert('You have not entered an email!');
        return false;
    }
if (document.register.password.value == '')
    {
        alert('You have not entered a password!');
        return false;
    }
    return true;
}
</script>
      <form name="register" method="post" action="http://www.djsmiley.net/register/process.php" onsubmit="return Validate();">
                    <table width="100%" border="0">
                      <tr>
                        <td>First Name:</td>
                        <td><label>
                          <input type="text" name="first_name" id="first_name" />
                        </label></td>
                      </tr>
                      <tr>
                        <td>Last Name:</td>
                        <td><input type="text" name="last_name" id="last_name" /></td>
                      </tr>
                      <tr>
                        <td>Age:</td>
                        <td><input type="text" name="age" id="age" /></td>
                      </tr>
                      <tr>
                        <td>City:</td>
                        <td><input type="text" name="city" id="city" /></td>
                      </tr>
                      <tr>
                        <td>State:</td>
                        <td><input type="text" name="state" id="state" /></td>
                      </tr>
                      <tr>
                        <td>Country:</td>
                        <td><input type="text" name="country" id="country" /></td>
                      </tr>
                      <tr>
                        <td>Zip:</td>
                        <td><input type="text" name="zip" id="zip" /></td>
                      </tr>
                      <tr>
                        <td>Birthdate:</td>
                        <td><input type="text" name="birthdate" id="birthdate" /></td>
                      </tr>
                      <tr>
                        <td>Gender:</td>
                        <td><input type="text" name="gender" id="gender" /></td>
                      </tr>
                      <tr>
                        <td>Sexuality:</td>
                        <td><input type="text" name="sexuality" id="sexuality" /></td>
                      </tr>
                      <tr>
                        <td>Race:</td>
                        <td><input type="text" name="race" id="race" /></td>
                      </tr>
                      <tr>
                        <td>Religion:</td>
                        <td><input type="text" name="religion" id="religion" /></td>
                      </tr>
                      <tr>
                        <td>Marital Status:</td>
                        <td><input type="text" name="status" id="status" /></td>
                      </tr>
                      <tr>
                        <td>About You:</td>
                        <td><label>
                          <textarea name="about" id="about" cols="45" rows="5"></textarea>
                        </label></td>
                      </tr>
                      <tr>
                        <td>Website:</td>
                        <td><input type="text" name="website" id="website" /></td>
                      </tr>
                      <tr>
                        <td width="13%">Username: </td>
                        <td width="87%"><input type="text" name="user_name" id="user_name" /></td>
                      </tr>
                      <tr>
                        <td>Email: </td>
                        <td><input type="text" name="email" id="email" /></td>
                      </tr>
                      <tr>
                        <td>Password: </td>
                        <td><input type="password" name="password" id="password" /></td>
                      </tr>
                      <tr>
                        <td>&nbsp;</td>
                        <td><input name="Register Button" type="submit" class="Button1" id="Register Button" value="Register" />
                        <input name="Reset Button" type="reset" class="Button1" id="Reset Button" value="Clear" /></td>
                      </tr>
                    </table>
                    <label></label>
      </form>

I've abandoned my old script and switched to this one: http://www.evolt.org/node/60384

I got it working on my site just fine (djsmiley.net/members/register - you can test it out if u want). i just want to know how i can put all of the code into the pages i created using my template.

It doesn't specify how this can be done in the tutorial, which is why im confused. I've tried everything but keep getting errors. Help?

ok i need directing to a tutorial, an easyish one that can help me do a secure login and registration system. Something that uses sessions and mysql. something with sql injection and other security. i need it very secure.


hope you can help.

Hi All!   This is my first post here, so if there are some things I miss or something more I need to do please let me know.   I tried searching the forum for the answer first but could not find anything.   So here is the thing; I followed a tutorial I found about building a login system for my website. The tutorial worked perfectly, except I needed it to redirect to a user specific page instead of a static page on login. I made the necessary changes to the script, and now it redirects to the user specific page, but does not recognize that I am logged in so it will not show me the content.   In the interest of full disclosure, I am not very good at PHP and lack a fundamental understanding of it. I am enrolled in some Udemy courses to try to rectify that, but I needed the login system ASAP, so copy and paste programming was my only option. I know, I know. I am a terrible human being and should be thrown into the sun. I agree. I am in counseling to try to deal with it.   The tutorial I used can be found he  http://www.wikihow.c...n-PHP-and-MySQL.   Here is the relevant code:   process_login.php:  

<?php


include_once 'db_connect.php';
include_once 'functions.php';


sec_session_start(); // Our custom secure way of starting a PHP session.


if (isset($_POST['email'], $_POST['p'])) {
    $email = $_POST['email'];
    $password = $_POST['p']; // The hashed password.


$page = login($email, $password, $mysqli);
if ($page == true) {
  // Login success        
  header('Location: '. $page);
   exit();


    } else {
        // Login failed 
        header('Location: ../error.php?error=1');
    }
} else {
    // The correct POST variables were not sent to this page. 
    echo 'Invalid Request';
}

First of all hello as I am new to this forum.

Ok so, I am have been trying for the past few days to create a login system in PHP for a website I am creating, and I am having serious problems. I have tryed so many tutorials and they all are not working, my conclusion is they are outdated or not fully understandable.

So what I want to create -
Registration
Forgot password
Login page
Email activation
Member page

My hosting has the latest php and mysql as far as I know so could someone please give me an up to date simple tutorial on creating this.

Lastly the program I am using is Dreamweaver CS5

Thankyou.

i have already made the register page where their info goes into the database, and im not sure about the code that selects values from the database.
mysql_connect('', '', '');
mysql_select_db('');

$user = $_POST['user'];
$pass = $_POST['pass'];

echo "<font color='white'>You Need To Login</font>";
if($user == Username && $pass == Password) echo "Welcome $user";

mysql_query("SELECT ('Username', 'Password') FROM login");

?>

Hi

What is the best way of handling a login system with sessions, I have read that you should never hold the password in a session, so what should you hold in the session in order to access a users data?

Hello:

I am using this tutorial to make a secure login system (if there is a "better" way, please let me know):

http://tinsology.net/2009/06/creating-a-secure-login-system-the-right-way/

I am having a problem with the login form - it keeps moving to the "a_Home.php" page (the one that is suppose to be password protected) without any login information being entered.

This is the mmLogin.php page:
Code: [Select]
<?php

include('../include/myConn.php');
include('include/myAdminCodeLib.php');

session_start();
$username = $_POST['username'];
$password = $_POST['password'];

$username = mysql_real_escape_string($username);
$query = "SELECT password, salt
        FROM users
        WHERE username = '$username';";
$result = mysql_query($query);
if(mysql_num_rows($result) < 1)
{
    header('Location: mmLogin.php');
    die();
}
$userData = mysql_fetch_array($result, MYSQL_ASSOC);
$hash = hash('sha256', $userData['salt'] . hash('sha256', $password) );
if($hash != $userData['password'])
{
    header('Location: mmLogin.php');
    die();
}
else
{
    validateUser();
    header('Location: a_Home.php');
}

?>

<html>

<head></head>

<body>
<form name="login" action="mmLogin.php" method="post">
    Username: <input type="text" name="username" />
    Password: <input type="password" name="password" />
    <input type="submit" value="Login" />
</form>
</body>

</html>


This is the a_Home.php page:
Code: [Select]
<?php

include('include/myAdminCodeLib.php');
include('include/myCheckLogin.php');

?>

<html>

<head></head>

<body>

<a href="mmLogin.php">Log Off</a>

</body>

</html>


This is the myCheckLogin.php page:
Code: [Select]
<?php
session_start();
if(!isLoggedIn())
{
    header('Location: mmLogin.php');
    die();
}
?>

This is the myAdminCodeLib.php page:
Code: [Select]
<?php

function validateUser()
{
    session_regenerate_id ();
    $_SESSION['valid'] = 1;
    $_SESSION['userid'] = $userid;
}

function isLoggedIn()
{
    if(isset($_SESSION['valid']) && $_SESSION['valid'])
        return true;
    return false;
}

function logout()
{
    $_SESSION = array();
    session_destroy();
}

?>


Can anyone tell me why this is not working?

And, am I calling the functions properly?

Thanks.

Hey all,
    I'm in the process of developing a PHP login system for the website of a team I'm involved with. I have a MySQL database already set up to hold user data, but I lack the knowledge to create a respectably secure login system. I tend to be a tad obsessive when it comes to security, and seeing different systems being implemented on various tutorials that cover this topic makes me cynical of the integrity of any of them. So, my question is: how can I create a secure login system that isn't too complex in implementation? Are there any reliable tutorials for this? Would some sort of system that uses session variables be what I'm looking for? I don't require excessive security, but privelidges gained if this system is compromised would be no small matter.

Thanks for any help.

hi, I'm coding a website, after being away from php for a while, and there's this simple thing that's driving me crazy. I made a simple login system to test, and I have to refresh the page twice so it becomes active, and I can't figure out why. what's wrong with this code? (keep in mind that it's just a test, I plan to get username from database, send encrypted info to cookies, and all that, but after I get this working)

Code: [Select]
<?php
if (isset($_POST['submitlogin']))
{ if ((($_POST['username'])&&($_POST['password']))=="admin")
{ setcookie("user", "Administrator", time()+3600);
} else { $loginerror="1"; } }
if (isset($_GET['logout']))
{ setcookie("user", "", time()-3600); }
?>
<html>
<head>
</head>
<body>

<?php
if (isset($_COOKIE['user']))
{ echo "Hello, ".$_COOKIE['user'];
?>

<br /><a href="?logout=yes">Logout</a>

<?php }else{?>

<form action="" method="post">
<input name="username" type="text" /><br />
<input name="password" type="password" /><br />
<input name="submitlogin" type="submit" value="Login" />
</form>

<?php }?>

</body>
</html>

thanks for any help!

My main pages looks like this...

<?php
include "header.php";

CONTENT

include "footer.php";
?>

On the header will be my login script so on every page the script will be there so they can log in from anywhere on the site. Also, I want it all done on one page instead of being directed somewhere else. This is the code below.

<?php
session_start();

$message = ""; //error message needs to be blank
$loginstatus = ""; //error message needs to be blank

//if $_POST "username" and "password" exist, check for consistency.
if (isset($_POST['username'])&&($_POST['password']))
{
include 'connect.php'; //connect
$username = mysql_real_escape_string($_POST['username']); //set variables from session
$password = mysql_real_escape_string($_POST['password']); //set variables from session

//remove slashes and HTML
$username = stripslashes($username);
$password = stripslashes($password);
$username = strip_tags($username);
$password = strip_tags($password);

$password = md5($password); //md5 encryption

$query = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'"); //checking if row exists that has $username and $password together.
$num = mysql_num_rows($query); //number of rows. if not equal to one login will fail.

if($num==1)
{
$_SESSION['username'] = $username; //store session data
$message = "$username, you are logged in!";
}
else
{
$message = "<font color='red'>Wrong Username or Password. Please try again.</font>";
}
}

//if $_SESSION "username" and "password" exist, check for consistency.
if (isset($_SESSION['username']))
{
$username = $_SESSION['username'];
$loginstatus = "
<table cellspacing='0' cellpadding='0'>
<tr>
<td align='right'><b>$message</b> <a href='logout.php'>[logout]</a></td>
</tr>
</table>
";
}
else
{
$loginstatus = "
<b>$message</b>
<table cellspacing='0' cellpadding='0'>
<form action='CURRENTPAGE.php' method='post'>
<tr>
<td><b>Username: </td>
<td><input type='text' name='username' class='inputbox'></td>
<td>   <b>Password: </td>
<td><input type='password' name='password' class='inputbox'></td>
<td>   <input type='submit' value='Log In' class='submitbutton'></td>
</tr>
</table>
</form>
";
}

echo $loginstatus;

?>

I have two questions...

#1 How can I direct my page when entering the password to the current page the user is on? (look at CURRENTPAGE.php in the code for reference)

#2 Security is obviously an issue at all times. How does my security look? What can I do to make this login script more secure?

Thanks so much for all of those who help out. I'll be watching this forum all day everyday.

Hey all.  I was curious what is the best practice when creating a user login system? I've seen them done in the following 2 ways.

First I've seen tutorials on logins where after the post data is verified against the database a username session is created and member pages are accessed if the user session is set.

Second I've seen tutorials on logins where the username session is verified against the database on every single page.

What is the best practice along these lines?

Cheers!