PHP - Help With Basic Login/create Account Pages

I'm trying to set up a very simple (WIP) members page that you can click registered users to see their profile page that will display basic information.

I'm having trouble with the sessions and retrieving this info from my database. I'm very new to this so it's all pretty amateur.

I've been looking at this code for several hours trying to fix things but I start to make some progress, then change stuff, and go backwards. I had a members page that displayed the registered users in my database, but after a while of altering to try to get the profiles to work, I messed it up :mad:. I have basic login and register pages.

I need some seperate eyes to take a look. Any help is so much appreciated. Thanks!


members.php
Code: [Select]
<?php
session_start();
require 'mysql-connect.php';
$auser=$_SESSION['user'];


if(isset($auser)){
$Members = mysql_query("SELECT * FROM user WHERE username='$username'") or die(mysql_error());
$numRowsMembers = mysql_num_rows($Members);

?>

<table border="1">

<?php
for($count = 1; $count <= $numRowsMembers; $count++)
{
    $name = mysql_fetch_array($Members);
    ?>
   
    <tr>
    <?php
    echo '<td><a href="member_profile.php?username=' . $name['username'] . '">' . $name['username'] . '</a></td>';
}
}
   ?>
 
    </tr>
</table>

member_profile.php
Code: [Select]
<?php
session_start();
require 'mysql-connect.php';
$auser=$_SESSION['user'];

if(isset($auser)){

$username = $_GET['username'];
$user = mysql_query("SELECT * FROM user WHERE username = '$username'");
echo $user;
$user=mysql_fetch_assoc($user);


echo "<h1>User Info</h1>";

echo "<b>Username:".$user['username']."<br>";

echo "<br>";
  echo '<form name="backlistfrm" method="post" action="members.php">';
echo '<input type="submit" value="Back to The List">';
echo '</form>';
echo "<br>";
}
?>

my login handler
Code: [Select]
<?php
include 'mysql-connect.php';

$username = $_POST['user'];
$password = $_POST['pass'];
$query1 = mysql_query("SELECT * FROM user WHERE username='$username'");
$result = mysql_num_rows($query1);
if($result == 0)
{
echo '<h1>Error!</h1>The username you specified does not exist!';
}
else
{

$checkuser = mysql_query("SELECT * FROM user WHERE username='$username'");

                        $row = mysql_fetch_array($checkuser);
                                                        $password2 = $row['password'];
                                                        //$status = $row['status'];
                                if ($password == $password2)
                                        {
                                 echo "Hi $username.";
 include("index.php"); 
                                        }
                                else
                                        {
                                        echo '<h1>Error!</h1>The username and password combination you entered does not match the ones we have in the database.';
                                        }

}
?>
mysql-connect.php
Code: [Select]
<?php

$host = "localhost";
    $username = "root";
    $password = "";
    $database = "ug54";
    $link = mysql_connect($host, $username, $password);//Connects to database with host, username, and password
    $select = mysql_select_db($database);
?>
and my simple database
Code: [Select]
CREATE TABLE IF NOT EXISTS `user` (
  `id` int(4) unsigned NOT NULL AUTO_INCREMENT,
  `username` varchar(32) NOT NULL,
  `password` varchar(32) NOT NULL,
  `firstname` varchar(20) NOT NULL,
  `lastname` varchar(20) NOT NULL,
  `email` varchar(30) NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=InnoDB  DEFAULT CHARSET=latin1 AUTO_INCREMENT=7 ;

--
-- Dumping data for table `user`
--

INSERT INTO `user` (`id`, `username`, `password`, `firstname`, `lastname`, `email`) VALUES
(1, '', '', '', '', '0'),
(2, 'abc', '123', '', '', '0'),
(3, 'a', 'b', 'c', 'd', '0'),
(4, 'hfg', 'rgfdg', 'gdfg', 'dfgdf', '0'),
(5, '999', '999', '999', '999', '999');

i have downloaded a basic php site from "http://www.basiclogin.com/"
when i deploy it i get a lot of errors...
can you help me out???

Basically, I'm still trying to wrap my head around OOP. What I'm trying to do here is a simple OOP user login script.  But when I submit the form, all that happens is that the text fields reset them selves and nothing that I feel should be happening, happens.

ie: I submit login data, and either it displays an error or reirects to index page. Neither happen, the form merely resets.  Where am I going wrong?

Code: [Select]
<form name="loginform" id="loginform" action="<?php $_SERVER['PHP_SELF']; ?>" method="post">
<p>
<label>Username<br>
  <input name="user" id="user_login" class="input" size="20" tabindex="10" type="text" />
</label>
</p>
<p>
<label>Password<br>
<input name="pass" id="user_pass" class="input" value="" size="20" tabindex="20" type="password"></label>
</p>
<p class="forgetmenot"><label><input name="rememberme" id="rememberme" value="forever" tabindex="90" type="checkbox"> Remember Me</label></p>
<p class="submit">
<input name="login" id="submit" class="button-primary" value="Log In" tabindex="100" type="submit">
<input name="redirect_to" value="/users.php" type="hidden">
</p>
</form>

Code: [Select]
<?php
if(isset($_POST['login']))
{
$username = $_POST['user'];
$password = $_POST['pass'];

include("./classes/class.users.php");
USERS::login($username, $password);

}
?>

Code: [Select]
<?php
// Yes, my DATABAASE::DoIT(1) // (0) is working as intended (from a different include file)
class USERS
{
var $user;
var $pass;
var $email;

//////////////////////////////////////////////////////////////////////////////////////////////
function login($user, $pass) {

include("/var/www/config.php");
DATABASE::DoIt('1');

$hashword = sha1($CONFIG['salt1']."$pass".$CONFIG['salt2']);
$sql      = "SElECT * FROM users WHERE username='$user' AND hashword='$hashword'";
$result   = mysql_query($sql);
$count    = mysql_num_rows($result);

if($count==1) {
while ($row = mysql_fetch_assoc($result)) {
define('USERS_AUTHENTICATED', true);
$_SESSION['USERS_username'] = $row['username'];
$_SESSION['USERS_userid'] = $row['userid'];
DATABASE::DoIt('0');
header("Location: index.php");
}

} else {

$_SESSION['loginError'] = true;
DATABASE::DoIt('0');
return $_SESSION['loginError'];
}

DATABASE::DoIt('0');
}
}
?>

Hello all;
I have a client that has a members area.  He asked me to password protect it, which I did simply by assigning one static password.  Now he wants a full username/login system where the member can set their own password, which I have never done before.  I assume I'd just set up a Table with three fields, (one for name, one for password, one for the type of access they have) then check against it for access, but experience has taught me that whenever something seems simple, it's actually very complex. 

Do any of you know of any good premade templates for this kind of thing?  Ideally it'd be session-based (obviously).  I found one system he http://frozenade.wordpress.com/2007/11/24/how-to-create-login-page-in-php-and-mysql-with-session/  but it's several years old, and the misspellings in the comments tend to scare me away a bit. 

Thanks for any help you might be able to provide.

I have created a login page, but i want the users to be directed to another page only if the login details are correct. How would i do this?any help is appreciate. Coding for the PHP is below: thank you.

Code: [Select]

<?php

$username = $_POST["username"];
$password = $_POST["password"];
//This if statement asks if the $username variable is set. If it is it executes the php script. Otherwise it echoes the login form.
if(isset($username)){

if (!($username == " " && $password == " "))

{

$connect = mysql_connect("","","") or die("Couldn't connect!");
mysql_select_db("") or die("Couldn't find db");

$query = mysql_query("SELECT * FROM users WHERE username='$username'");

$row = mysql_fetch_array($query);

$numrows = mysql_num_rows($query);

   $dbusername = $row['username']; 
   $dbpassword = $row['password'];
}
else {
echo ('<div id="username">
   <form action="" method="post"/>
<font color="red"> Please enter a username and password </font>
      <table><tr><td>
      <img src="imgs/Log In/username.png" alt=""/>
      </td><td>
      <input type="text" size="30" name="username" style="background-color:transparent;" />
      </td></tr></table>

      <table><tr><td>
      <img src="imgs/Log In/password.png" alt=""/>
      </td><td>
      <input type="password" name="password" size="30" />
      </td></tr></table>

      <form id="submitb" action="">
      <input type="submit" value="Log in" />
      </form>

      <p class="register">Not yet a member? <a href="Form.html">Register Here</a>, its Free!</p>
</div>');
}
//check to see if they match
if ($username == $dbusername && $password == $dbpassword) {
echo "You Are Now Logged In, Welcome To AdobeTuts!";
}
else
   echo ('<div id="username">
   <form action="" method="post"/>
<div id="new">
<font color="red"> Wrong Username Or Password, Please Try Again </font> </div> 
      <table><tr><td>
      <img src="imgs/Log In/username.png" alt=""/>
      </td><td>
      <input type="text" size="30" name="username" style="background-color:transparent;" />
      </td></tr></table>

      <table><tr><td>
      <img src="imgs/Log In/password.png" alt=""/>
      </td><td>
      <input type="password" name="password" size="30" />
      </td></tr></table>

      <form id="submitb" action="">
      <input type="submit" value="Log in" />
      </form>

      <p class="register">Not yet a member? <a href="Form.html">Register Here</a>, its Free!</p>
</div>');

}

//This next bit echoes the login form unless the $username variable is set.
else {
echo ('<div id="username">
   <form action="" method="post"/>
    
      <table><tr><td>
      <img src="imgs/Log In/username.png" alt=""/>
      </td><td>
      <input type="text" size="30" name="username" style="background-color:transparent;" />
      </td></tr></table>
      
      <table><tr><td>
      <img src="imgs/Log In/password.png" alt=""/>
      </td><td>
      <input type="password" name="password" size="30" />
      </td></tr></table>
      
      <form id="submitb" action="">
      <input type="submit" value="Log in" />
      </form>
      
      <p class="register">Not yet a member? <a href="imgs/Homepage tuts/Form.php">Register Here</a>, its Free!</p>
</div>');
}

?>

Hi, i coded a very simple forum "website" with registration, login, and a place where everyone posts comments.  I wanted to make some sort of profile page for each user so they would each have their own URL too (e.i. test/barney or test/simpsons).  each of these pages would have different content, depending on what barney or simpsons puts on that page.

i've been looking everywhere trying to find documentation but i don't think i know how to search it correctly. I checked a lot of mod_rewrite documentation but i don't understand if i'm suppose to call a php function to create a profile page or something.

Any guidance would be greatly appreciated

Thanks!

Hello:

I wanted to see if I can make my password protected pages in my admin area, and the login form "more secure."
I was told I should use MD5 / SALTING / HASHING to do this.

I have tried some online tutorials, but am not understanding it, so I wanted to start from what I have and build upon it>

This is my database table storing the myAdmins data (when I initially insert it into the database):
Code: [Select]
CREATE TABLE `myAdmins` (
  `id` int(4) NOT NULL auto_increment,
  `myUserName` varchar(65) NOT NULL default '',
  `myPassword` varchar(65) NOT NULL default '',
  PRIMARY KEY  (`id`)
) ENGINE=MyISAM AUTO_INCREMENT=2 DEFAULT CHARSET=utf8;

INSERT INTO myAdmins VALUES("1","abc","123");

This is the login form I use:
Code: [Select]
<?php

include('../include/myConn.php');
include('include/myAdminNav.php');

session_start();
session_destroy();

$message="";

$Login=$_POST['Login'];
if($Login){
$myUserName=$_POST['myUserName'];
$myPassword=$_POST['myPassword'];

$result=mysql_query("select * from myAdmins where myUserName='$myUserName' and myPassword='$myPassword'");
if(mysql_num_rows($result)!='0'){
session_register("myUserName");
header("location:a_Home.php");
exit;
}else{
$message="<div class=\"myAdminLoginError\">Incorrect Username or Password</div>";
}

}
?>

<form id="form1" name="form1" method="post" action="<? echo $PHP_SELF; ?>">

<? echo $message; ?>

Username: <input name="myUserName" type="text" id="myUserName" size="40" />
Password: <input name="myPassword" type="password" id="myPassword" size="40" />

<input name="Login" type="submit" id="Login" value="Login" />

</form>



This is the code on top of each page I password protect:
Code: [Select]
<?
session_start();
if(!session_is_registered(myUserName)){
header("location:Login.php");
}
?>

Works well, but can it be "better"??

And, if I am allowing the admin to update his/her username or password, I do it this way:
Code: [Select]
<?php

include('../include/myConn.php');
include('include/myCheckLogin.php');

if ($_SERVER['REQUEST_METHOD'] == 'POST')
{
$myUserName = mysql_real_escape_string($_POST['myUserName']);
$myPassword = mysql_real_escape_string($_POST['myPassword']);

$sql = "

UPDATE myAdmins
   SET
      myUserName = '$myUserName',
      myPassword = '$myPassword'
  ";
mysql_query($sql) && mysql_affected_rows()

?>

<?php
}

$query=mysql_query("SELECT * FROM myAdmins") or die("Could not get data from db: ".mysql_error());

while($result=mysql_fetch_array($query))

{
  $myUserName=$result['myUserName'];
  $myPassword=$result['myPassword'];
}

?>


<form method="post" action="<?php echo $PHP_SELF;?>">
<input type="hidden" name="POSTBACK" value="EDIT">

Username: <input type="text" size="60" maxlength="60" name="myUserName" value="<?php echo $myUserName; ?>">
Password: <input type="password" size="60" maxlength="60" name="myPassword" value="<?php echo $myPassword; ?>">

<input type="submit" value="Submit" />
         
</form>


Should it be "better" .. ??

I don't seem to understand how to "encrypt" all of this to make it "stronger" ..

Ideas? Improvements?

I got a question  regarding a news website content that i want to make ! my question is how do i   call my contents without using a lot of page?   i explain   let's say i got 10 news how do i put this 10 news in different pages without using 10 pages ? ex: you can see some links having a number like this http://bbc.uk/news/murder_case-12 then the next page got http://bbc.uk/news/finance-13 the title and the number id change but the page news doesnt change    thanks for your answer.

Hello everyone:

I wanted to see how I can make a simple login page (user name and password) that redirects to a page(s) if the login is correct. Also, I wanted to put protection on the page(s) that will send the user back to the login page if the credentials are nor correct.

I would imagine the username/password would be stored in a database table (Admins), and the correct login info would be stored in a session ..?

I am use to doing this with ASP, but never PHP. I want to make sure I understand how to do this properly and securely so I can use this as a model for other systems.

In ASP I would do a protected page like this:
a_login_check.asp
Code: [Select]
<%
if session("admin_user_name") = "" then
session.abandon
response.redirect "login.asp"
end if
%>

Protected-Page.asp
Code: [Select]
<!-- #include file="include/a_check_login.asp" -->
<html>
...
CONTENT

...
</html>

And of course there is the login page itself ...
(I thought it would be nice to add a "Forgot Password" link on the login page, but if that is too complicated I can do that later .. or is it easy ??)

Anyway, can someone point-out to me how to do this.

I would appreciate it!

example: pulling a 5x5 array of data from a database   time differences: components (unbuilt):13400101661682 elements (built):13817119598389   How I'm stealing the elements from the PHP code: ob_start(); ... ob_end_clean();

Hey all,

I am trying to put a login form on the front pages (index, contact us, about us) of my site. I want the members to put in username and pass, and when they click submit, it takes them to the /members/ area of the site.

Right now this is how I have the form.

Code: [Select]
<form method="POST" action="login.php">
<input type="text" name="username">
<input type="password" name="password">
<input type="submit" value="Login">
</form>
I have this, but the members area consist of several pages and not just on location.

Code: [Select]
if ($_SESSION['authorized'] != true)
{
    header("Location: login_form.php");
    exit;
}
Finally, I am going to create a login.php page that has this in it.

Code: [Select]
$select_user =
mysql_query('select * from users where username = "' .
$_POST['username'] . '" and password = "' .
md5($_POST['password'] . '"'));

if (mysql_num_rows($select_user) != 0)
{
    session_start();
    session_register('authorized');
    $_SESSION['authorized'] = true;

    header("Location: protected_content.php");
    exit;
}
else
{
    header("Location: login_form.php");
    exit;
}


So My questions are, How can I make it so they can access the entire /members/ area (directory)

and what would I put in the database 'members' when I create it. All members are going to use the same username and pass. So there is only need for 1 query for username and 1 for password.

I appreciate anyone help in advance.

Hi,

Having completed a site migration this am everything went well aside from issues with logging into and out of our site where two files are used and appear as white pages.

When logging into our site, proc_login.php is used and when logging out proc_logout.php is used.

Both processes result in a white "blank" page instead of the php files forwarding on.

I've no idea about php generally and have been trying my best to find useful and similar information online to attempt to resolve the problem.  I am now stuck.

The site works perfectly on my local web server, and what is really baffling me is the site also works perfectly on Domain B on the exact same server I'm trying to get the site running under as Domain A.  In other words as both Domain A & B are configured on the same host server I'm thinking all the inherited php/apache/mysql settings should be identical (or pretty much thereabouts) and therefore am more confused than ever! 

I simply don't know where to start therefore in resolving this problem.  I've tried looking in the error log file and have also played around with turning on error enabling on those specific php files to try and follow any errors, however the "errors" generated are no different than the ones present on sites where the login/logout process works just fine.

I've hopefully attached both files and if anyone could assist in helping me narrow down my search for a solution I'd be very appreciative.

Thanks.

I've decided to "re-learn" PHP.

I've created a registration script which works well, however, the login script is not going to plan for me.

This is the script:

<?php include "./global/global.php"; ?>
<?php error_reporting (E_ALL ^ E_NOTICE); ?>

<?php

$username = $_POST['username'];
$password = $_POST['password'];

$submit = $_POST['submit'];

if($submit){
    $sql1 = "SELECT * FROM test2 WHERE username = '".$username."'";
    $res1 = mysql_query($sql1) or die(mysql_error());
    
    $numrows = mysql_num_rows($res1);
        
    if($numrows != 0){
        while($row = mysql_fetch_assoc($res1)){
            $dbusername = $row['username'];
            $dbpassword = $row['password'];
        }
        
        if($username==$dbusername && $password==$dbpassword){
            ob_start();
            $_SESSION['username']=$username;
            header("Location: index.php");
        }
    }else{
        echo("That user doesn't exist!");
    }               
}else{
    
    ?>
    <form action="login.php" method="POST">

    <input type="text" name="username" />
    <input type="password" name="password" />
    <input type="submit" name="submit" value="Login" />

    </form>
    
<?php

}

?>

The problem is that it isn't building the session, so when I go back to the homepage, which looks like this:

<?php include "./global/global.php"; session_start(); ?>
<?php error_reporting (E_ALL ^ E_NOTICE); ?>

<html>

<?php

if($_SESSION){
    echo("Welcome, ".$_SESSION['username']);
}else{
    echo("Please login <a href='login.php'>here</a>");
}

?>

</html>

It shows that I should login.

I can't seem to see what's wrong because I have a script very similar to it and it works fine, so if anyone could help, I'd appreciate it.

hi everyone i was wondering if anyone has any idea how i can make my php links look like this "wwwDOTmysiteDOTcom/xxx.php?s=account" right now they look like this   "wwwDOTmysiteDOTcom/account.php" thanks...