PHP - Trouble With Login Scripting Using Php & Mysql

errors:

Deprecated: Function session_register() is deprecated in /Applications/XAMPP/xamppfiles/htdocs/login.php on line 18

Warning: session_register() [function.session-register]: Cannot send session cookie - headers already sent by (output started at /Applications/XAMPP/xamppfiles/htdocs/login.php:18) in /Applications/XAMPP/xamppfiles/htdocs/login.php on line 18

Warning: session_register() [function.session-register]: Cannot send session cache limiter - headers already sent (output started at /Applications/XAMPP/xamppfiles/htdocs/login.php:18) in /Applications/XAMPP/xamppfiles/htdocs/login.php on line 18

Deprecated: Function session_register() is deprecated in /Applications/XAMPP/xamppfiles/htdocs/login.php on line 22

Code:
Code: [Select]
<?php

if ($_POST['email']) {

include_once "connect_to_mysql.php";
$email = stripslashes($_POST['email']);
$email = strip_tags($email);
$email = mysql_real_escape_string($email);
$password = preg_replace("[^A-Za-z0-9]", "", $_POST['password']); 
$password = md5($password);

$sql = mysql_query("SELECT * FROM members WHERE email='$email' AND password='$password' AND emailactivated='1'"); 
$login_check = mysql_num_rows($sql);
if($login_check > 0){ 
    while($row = mysql_fetch_array($sql)){ 
        
        $id = $row["id"];   
        session_register('id'); 
        $_SESSION['id'] = $id;
  
    $username = $row["username"];   
        session_register('username'); 
        $_SESSION['username'] = $username;

        mysql_query("UPDATE members SET lastlogin=now() WHERE id='$id'"); 
        
header("location: member_profile.php?id=$id"); 
exit();
    } 
} else {

  print '<br /><br /><font color="#FF0000">No match in our records, try again </font><br />
<br /><a href="login.php">Click here</a> to go back to the login page.';
  exit();
}
}
?>

any help really appreciated...thanks!!

I am trying to create a login menu, but I keep getting the same errors.

Ok here is what I'm trying to do.

There is a link in a email that is sent out to the people who use this app.
When they click on the email link they are brought to this site which is password protected.
So they have to enter their username and password. What I want to below script to do is to log them in while checking to see if the $id variable is set. If it is, then the script is to take them to the page in the email link. If not take them to the submit job page.

<?php
$id=$_POST["id"];
$cmd = $_POST['cmd'];
$connection = mysql_connect("host", "user", "pass");
mysql_select_db("database", $connection) or die(mysql_error());


switch($cmd) {
case "login":
$u = $_POST['username'];
$p = $_POST['password'];
$query = "SELECT * FROM login WHERE username='$u' AND password='$p'";
$result = mysql_query($query);
$row = mysql_fetch_array($result);

if (isset($id))($row){

session_start();
$_SESSION['user_id'] = $row[0];
$_SESSION['residentname'] = $row[1];
$_SESSION['unit_num'] = $row[2];
setcookie("TestCookie", time()+3600);  /* expire in 1 hour */
$resite = "submitjob.php?do=viewone&id=$id";
header("Location:$resite");
exit();

} else if ($row){

session_start();
$_SESSION['user_id'] = $row[0];
$_SESSION['residentname'] = $row[1];
$_SESSION['unit_num'] = $row[2];
setcookie("TestCookie", time()+3600);  /* expire in 1 hour */
$resite = "submitjob.php";
header("Location:$resite");
exit();


} else {
echo "Sorry the app didn't find a match.";
}
break;



}
?>

I'm trying to implement sessions into my website. At the moment index.php contains a login form that posts to AccountManagement.php. AccountManagement.php then checks the database to see if they have entered a correct username/password combination. This all works fine, however I would like the site to remember that a user has logged in, and not tell them that they have entered an invalid password every time they come to this page by any means other than index.php's login form (e.g. a back button on a page that follows from AccountManagement). I have tried for days to get this to work using a for loop that checks if the session is started, but I can't seem to get the placement/syntax correct.
Any help would be greatly appreciated.


AccountManagement.php:
Code: [Select]
<?php
include ("Includes/database.php");
include ("Includes/htmlheader.php");
dbconnect ("localhost", "xxxxx", "xxxxx", "xxxxx");
$query=sprintf("SELECT wowUsername, Password, UserID FROM Users WHERE (((wowUsername)=\"%s\") AND ((Password)=\"%s\"));", $_POST['Username'], $_POST['Password']);
$result=mysql_query($query);
if (!$result) {
$message  = 'Invalid query: ' . mysql_error() . "\n";
    $message .= 'Whole query: ' . $query;
    die($message);}
if (mysql_num_rows($result) !=1) {
$errormessage= "Incorrect Username or Password, please try again.";
include ("Includes/error.php");
}
else { 
$row=mysql_fetch_assoc($result);
$CustomerID = $row['UserID'];
$query2=sprintf("SELECT CustomerID, FName FROM Customers WHERE CustomerID=$CustomerID");
$result2=mysql_query($query2);
$row2=mysql_fetch_assoc($result2);
$_SESSION['UserID']=$CustomerID;
?>
 <form action="index.php" id="home" name="home" style="width: 8em"></form>
<h1>   
  Account Management
</h1>
<p><h3 align="center">Welcome <?php echo $row2['FName'];?>, use the buttons below to manage your subscriptions.<h3><br />
<h2>
<form action="Subscription.php" id="subs" name="subs">
  <p>
    <input class="button5" name="Setup" type="submit" value="New Subscription" align="center" /></p>
  </form></h2>
<form action="AccountUpdate.php" id="remove" name="remove" style="width: 8em">
  <p>
    <input class="button5" name="NewDetails" type="submit" value="Update Details" />
    </p></form>
  </p>
  <p>
  <form action="AccountCancel.php" id="remove" name="remove" style="width: 8em">
    <input name="Logout3" type="submit" class="button5" value="Cancel Account" align="right" />
    </form>
  </p>
  <p>
  <br />
  <form action="index.php" id="remove" name="remove" style="width: 8em">
    <input class="button5" name="Logout" type="submit" value="Log Out" />
  </p>
  </p>
<?php
}
?>
</div>
</body>
</html>
</form>

htmlheader.php:
Code: [Select]
<?php
error_reporting(E_ERROR | E_WARNING | E_PARSE );
if(!isset($_SESSION))
{
session_start();
$_SESSION['UserID']=0;
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><link rel="stylesheet" type="text/css" href="CSS/Styles.css"/>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Account Management</title>
</head>

<body>
</form>
<div id="content">

I'm not sure where the issue really lies after the form submits it DOES perform the error messages if there is one, however if the username and password are atleast filled in and the user clicks Log In it doesn't do anything after that.   

login.php

<?php

/**
 * @author Jeff Davidson
 * @copyright 2010
 */

if (isset($_POST['submitted'])) {
    
    require_once ('inc/login_functions.php');
    require_once ('inc/dbconfig.php');
    list ($check, $data) = check_login($dbc, $_POST['username'], $_POST['password']);
    
    if ($check) { // OK!
    
    // Set the session data:.
    session_start();
    $_SESSION['id'] = $data['id'];
    $_SESSION['firstname'] = $data['firstname'];
    
    // Redirect:
    $url = absolute_url ('loggedin.php');
    header("Location: $url");
    exit();
    
    }else {
    // Unsuccessful!
    $errors = $data;
    }
    
    mysqli_close($dbc);
    
} // End of the main submit conditional.

include ('inc/login_page.php')

?>


login_functions.php

<?php

/**
 * @author Jeff Davidson
 * @copyright 2010
 */

// This page defines two functions used by the login/logout process.

/* This function determines and returns an absolute URL.
 * It takes one argument: the page that concludes the URL.
 * The argument defaults to index.php.

*/

function absolute_url($page = 'index.php') {
    // Start defining the URL...
    // URL is http://plus the host name plus the current directory:
    $url = 'http://' . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']);
    
    // Remove any trailing slashing:
    $url = rtrim($url, '/\\');
    
    // Add the page
    $url .= '/' . $page;
    
    // Return the URL:
    return $url;
    
} // End of absolute_url() function.


/* This function validates the form data (the username and password).
 * If both are present, teh database is queried.
 * The function requires a database connection.
 * The function returns an array of information, including:
 * - a TRUE/FALSE variable indicating success
 * - an array of either errors or the database result
 */
 
function check_login($dbc, $username = '', $password = '') {
    $errors = array(); // Initialize error array.
    
    // Validate the username
    if (empty($username)) {
        $errors[] = 'You forgot to enter your username.';
    } else {
        $u = mysqli_real_escape_string($dbc, trim($username));
    }
    
    // Validate the password:
    if (empty($password)) {
        $errors[] = 'You forgot to enter your password.';
    } else {
        $p = mysqli_real_escape_string($dbc, trim($password));
    }
    
    if (empty($errors)) { // If everythings OK.
        
        // Retrieve the firstname and lastname for the username/password combination:
        $q = "SELECT id, firstname FROM users WHERE username='$u' AND password=SHA('$p')";
        $r = @mysqli_query($dbc, $q); // Run teh query.
        
        // Check the result:
        if (mysqli_num_rows($r) == 1) {
            
            // Fetch the record:
            $row = mysqli_fetch_array($r, MYSQLI_ASSOC);
            
            // Return true and the record:
            return array(true, $row);
            
        }else { // Not a match!
        $errrors[] = 'The username and password entered do not match those on file.';
        }
    } // End of empty ($errrors) IF.
    
    // Return false and the errors:
    return array(false, $errors);
    
} //End of check_login() function.

?>


login_page.php

<?php

/**
 * @author Jeff Davidson
 * @copyright 2010
 */

// This page prints any errors associated with logging in and creates the login, including the form.

// Prints any error messages, if they exists:
if (!empty($errors)) {
    echo '<h1>Error!</h1>
    <p class="error">The following error(s) occured:<br />';
    foreach ($errors as $msg) {
        echo " - $msg<br />\n";
    }
    echo '</p><p>Please try again.</p>';
}

// Display the form:
?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="description" content="Caracole" />
<title>Titanium</title>
<link HREF="favicon.ico" type="image/x-icon" rel="icon" />
<link HREF="favicon.ico" type="image/x-icon" rel="shortcut icon" />
<link rel="stylesheet" type="text/css" href="css/tripoli.simple.css" media="screen, projection, print" />
<link rel="stylesheet" type="text/css" href="css/base.css" media="screen, projection, print" />
<link rel="stylesheet" type="text/css" href="css/layout.css" media="screen, projection, print" />
<link rel="stylesheet" type="text/css" href="css/style.css" media="screen, projection, print" />
<link rel="stylesheet" type="text/css" href="css/theme.css" media="screen, projection, print" />
<link rel="stylesheet" type="text/css" href="css/icons.css" media="screen, projection, print" />
<script type="text/javascript" SRC="http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>
<script type="text/javascript">
//<![CDATA[
document.write('<link rel="stylesheet" type="text/css" href="css/js/js.css" media="screen, projection, print" />');
//]]>

$(document).ready(function(){

$(".close").click(function(){
$(this).parents(".message").hide("puff");
});

});


</script>
<!--[if IE]>
<link rel="stylesheet" type="text/css" href="css/ie/ie.css" media="screen, projection, print" />
<![endif]-->
 <!--[if lt IE 7]>
<script src="js/DD_belatedPNG_0.0.7a-min.js" type="text/javascript"></script>
<script>

DD_belatedPNG.fix(' #header, h1, h1 a, .close, .field,.paginate .current, .icon, .required-icon');

</script>
  <link rel="stylesheet" href="css/ie/ie6.css" type="text/css" media="screen, projection"/>
<![endif]-->
</head>
<body>
<!-- Content -->
<div id="login" class="content">
<div class="roundedBorders login-box">
<!-- Title -->
<div id="title" class="b2">
<h2>Log In</h2>
<!-- TitleActions -->
<div id="titleActions">
<div class="actionBlock">
<a href="#">Forgot your password ?</a>
</div>
</div>
<!-- /TitleActions -->
</div>
<!-- Title -->

<!-- Inner Content -->
<div id="innerContent">
<form action="login.php" method="post">
<div class="field">
<label for="username">Username</label>
<input type="text" class="text" id="username" name="username" />
</div>
<div class="field">
<label for="password">Password</label>
<input type="password" class="text" id="password" name="password"/>
</div>
<div class="clearfix login-submit">
<span class="fleft">
<input type="checkbox" name="remember-me" id="remember-me" />
<label for="remember-me">Remember me</label>
</span>
<span class="fright">
<button class="button" type="submit" name="submit"><strong>Log In</strong></button>
</span>
</div>
                    <input type="hidden" value="TRUE" name="submitted" />
</form>
</div>
<!-- /Inner Content -->
<div class="bBottom"><div></div></div>
</div>
</div>

</body>
</html>


loggedin.php

<?php

/**
 * @author Jeff Davidson
 * @copyright 2010
 */

// The user is redirected here from login.php.

session_start(); // Star the session.

// If no session value is present, redirect the user:
if (!isset($_SESSION['id'])) {
    require_once('inc/login_functions.php');
    $url = absolute_url();
    header("Location: $url");
    exit();
}

$page_title = 'Logged In!';

// Print a customized message:
echo "<h1>Logged In!</h1>
<p>You are now logged in, {$_SESSION['firstname']}!</p>
<p><a href=\"logout.php\">Logout</a></p>";


?>


I thought I'd come back in and insert the file manager I have setup here.

root/loggedin.php
root/login.php

root/inc/login_page.php
root/inc/login_functions.php