PHP - Users !
im new , and ...
i hate tutorials .. books .. anything that does not make u part of the deal - .. thats why i started by creating something and learning from my mistakes at the same time .. i like this way of learning .. soo , while im building and trying things out .. i started thinking how the server know the person with this link is really U ? .. when u start just linking pages to each other its just a matter of finding out what is the link to do what ever u want with the users personal pages ! .. i know my questions r stupid but i just hate to go and write lessons without any effort im confused with the concept of SESSIONS and COOKIES , r they the unswer to this security problem ? how u can work with them .. ? im not asking for codes .. just general ideas about users and how they control their profiles and stuff with full security ? ill be very thankful if i get any answer ^^ Similar TutorialsHello
I am trying to work out how many regular users I have to my site and how long those users tend to be users..
So, I have a table that logs every time a user visits my site and logs in, it stores the date / time as a unix timestamp and it logs their user id.
I started by getting the id's of any user who logs in more than 5 times in a specified period, but now I want to extend that...
SELECT userID as user, count(userID) as logins FROM login_history where timestamp > UNIX_TIMESTAMP('2014-06-01 00:00:00') and timestamp < UNIX_TIMESTAMP('2014-07-01 00:00:00') group by user having logins > 5; I just discovered that I have a major security flaw with my website. Anyone who logs in to the website can easily access other users information as well as delete and edit other users information just by changing the ID variable in the address bar. I have user ID Session started on these pages but still people can do anything they like with other users information just by editing the address bar. For example if your logged in in the address bar of www.mywebsite.com/delete_mystuff.php?id=5 and change the "5" say to a "9" then you will have access to user#9 information. Every important page that I have has this code: Code: [Select] session_start(); if (!isset($_SESSION['user_id'])) { // Start defining the URL. $url = 'http://' . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']); // Check for a trailing slash. if ((substr($url, -1) == '/') OR (substr($url, -1) == '\\') ) { $url = substr ($url, 0, -1); // Chop off the slash. } // Add the page. $url .= '/index.php'; ob_end_clean(); // Delete the buffer. header("Location: $url"); exit(); // Quit the script. } else { //Else If Logged In Run The Script if((isset($_GET['id'])) && (is_numeric($_GET['id']))) { $id = (int) $_GET['id']; } elseif ((isset($_POST['id'])) && (is_numeric($_POST['id']))) { $id = (int) $_POST['id']; } else { echo ' No valid ID found, passed in url or form element'; exit(); } What am I doing wrong? Please help if you know how to correct this. Many thanks in advance. Hi guys, I am trying to get a admin panel, which when the user is logged in, it will check if there user access is(say for this post) 9... If there access is 9 in the database then direct to admin panel if not return them home. Thanks guys how can I list a user from a table and show the results in a grid with different color eg frist in blue color second on white , 3rd on blue 4th in with etc
I do need to set select command and I have db name and ip on a file called dbconfig.php from wd calendar so I just need to read the info
ps: I cant post links so search for wd calendar and see the dbconfig.php in php folder
I would get the ip address of the user that is on the site. I used $ip = $_SERVER['REMOTE_ADDR']; and it doesn't show my actual ip. Is it because im using an apache server on my computer. Hi, I am having serious issues with compatibility with IE7 and below (and even 8 but they should be rectified). There is no way I can have these problems finished before the site is online, so I want to redirect users to a page apologizing and recommending alternative browsers. Is this possible? *Please don't reply just to tell me that banning an entire browser is bad, I know it is - I plan to sort it out. But this is an extra curricular project and I'm halfway through my penultimate year of uni, so IE and it's utterly shambolic rendering of CSS is not my priority. Thankyou* I have used
$sql = "SELECT id, username FROM $tbl_name ORDER BY username"; $result = $con->query($sql); while ($row = $result->fetch_assoc()) { echo "<a href='editUser.php?id={$row['id']}'>{$row['username']}</a><br><br>\n"; echo "<style>a {color: blue; text-decoration: none;} a:hover {color: #ff0000} body {background-color: #000;} </style>"; }in euser.php which echo's out all the users in the database via an anchor tag and includes their id in the url. but when i click on their name i want to have options like: - change password - ban user e.t.c and i have tried $sql = "SELECT id FROM $tbl_name"; $result = $con->query($sql); while ($row = $result->fetch_assoc()) { echo "<a href='editUser.php?id={$row['id']}'> Change Password </a>in my other page editUser.php it posts Change Password Change Password Change Password and each change password has the 3 ids of the users this is confusing me. Hi. my browser ist telling me there are errors on line 3 and 4 for my code. It says summin like Notice: HTTP_CLIENT_IP and HTTP_X_FORWARDED_FOR are unidentified: below is the code see if you can spot anything btw i copied down the code from beginner php tutorial 66 if you type that into youtube . Code: [Select] <?php $http_client_ip = $_SERVER['HTTP_CLIENT_IP']; $http_x_forwarded_for = $_SERVER['HTTP_X_FORWARDED_FOR']; $remote_addr = $_SERVER['REMOTE_ADDR']; if (!empty($http_client_ip)){ $ip_addr = $http_client_ip; }else if(!empty($http_x_forwarded_for)){ $ip_addr = $http_x_forwarded_for; }else{ $ip_addr = $remote_addr; } echo $ip_addr; ?> Thanks MOD EDIT: code tags added. Hi guys, im just trying to work out an app in my head and on paper. im just wondering.. when a user registers they can choose an Avatar 100px by 100px jpg, when they upload one would i then grab the file and store all Avatars in a avatar image folder and rename it to something like.. avatar[user_id].jpg and keep them all in the same folder. or would i crate a folder called users, each user gets their own folder with files like avatar.jpg and it finds the [user_id] folder and pulls the avatar out from that, or is there a more prefered method? cheers Hi all I am having a nightmare coming up with something and I wonder if I could pick everyones brain. I am helping to setup a mini web system for a friends dads work, the server is held internally on a very old machine, the current system runs ok and I am just helping to add some new things in. One of the functions they have is a "job" tool, which allows people to submit a small form of data about the job they are currently doing, this is used by internal and external staff. There network is really old and slow as well as the server the scripts are on, and they have no money at the moment to upgrade it, one of the reasons for these enhancements is so they can free up some money, so i'm doing my best to help them. The problem I am having is that when more than 150 users are submitting the form at the same time, the PHP pages are just timing out and the user has to go back to stage 1, their peak has been 230 users, which caused everyone a problem. So I wonder, is there anyway to create a queue style system with a countdown timer? So for example, when the user logs in, if there are more than 60 active users currently submitting on that form, then it would place that user in a queue for X number of seconds\minutes, then when one of those 60 users finish with the form or their 10 minutes is up, the user logged in is then forwarded to the form allowing them to complete it. I was going to give each user a maximum of 10 mins to complete the form before they are chucked out the queue, if that's possible. I was thinking about maybe logging them into a new bigger server online, then when number of user sessions drops below 60 on the current internal server, then they are forward to it, which allows them to complete the form, so you only ever have 60 users on the internal server at once. But I have 0 clue where to start. Is this a totally custom hard job? Or is there something anyone can point me to? Thanks very much all Johnny boy What would the best way be to show when a user is online? Detecting when they close the browser/tab, not just log out? So, I'm designing a website (who isn't?) and I created the basic framework for a users page from a tutorial I found. Using some previous knowledge I managed to make it display a few custom fields that are defined by the user. Everything works fine as is, but now I want to do a few things to it that I have not the slightest clue how to even begin... Here is my user page code so far... and oh yes I'm using WordPress which is why I made it check manually for page status in my Page.php file. <?php if ( is_page('Users')) { echo "<ul id=\"UsersList\">"; /* First we set how we'll want to sort the user list. You could sort them by: ------------------------ * ID - User ID number. * user_login - User Login name. * user_nicename - User Nice name ( nice version of login name ). * user_email - User Email Address. * user_url - User Website URL. * user_registered - User Registration date. */ $szSort = "user_nicename"; /* Now we build the custom query to get the ID of the users. */ $aUsersID = $wpdb->get_col( $wpdb->prepare("SELECT $wpdb->users.ID FROM $wpdb->users ORDER BY %s ASC", $szSort )); /* Once we have the IDs we loop through them with a Foreach statement. */ foreach ( $aUsersID as $iUserID ) : /* We use get_userdata() function with each ID. */ $user = get_userdata( $iUserID ); /* Here we finally print the details wanted. Check the description of the database tables linked above to see all the fields you can retrieve. To echo a property simply call it with $user->name_of_the_column. */ if($user->user_login != "Unknown") // don't show the placeholder for [unknown] author { echo '<a href="">' . get_avatar( $iUserID, $size = '45', $border='0') . '</a>'; echo '<li>' . ucwords( strtolower( $user->user_login ) ) . '</li>'; if($user->favorite_player != "") { echo '<li>' . $user->favorite_player . '</li>'; } if($user->player_name != "") { echo '<li>' . $user->player_name . '</li>'; } } /* The strtolower and ucwords part is to be sure the full names will all be capitalized. */ endforeach; // end the users loop. echo "</ul>"; }; ?> Problem one: This does NOT sort my name, despite the tutorial's insistence that it will. I have not even a guess as to why this is. Problem two: I would like to either sort this list into two columns or paginate it or both but I am not sure how to do either. Problem three: I want to insert some static text between the echo '<li>' and the . $user->player_name . '</li>'; so that it reads: o Player Name: USER'S VARIABLE ' PLAYER NAME' HERE Yes that 'o' is supposed to be the list item dot. I know how strings work, I just can't get my attempts to work out syntax-wise. Any help would be greatly appreciated! Tutorials, answers, suggestions, examples, anything. The extent of my previous coding knowledge is several years of UnrealScript, so you can see why this simple thing is baffling me. Frankly I'm surprised this much of it works. I have a bunch of users in a database (id, name, etc).
I have a bunch of documents which belong to users (id, filename, users_id, etc), and expect 500 or less per user.
The documents will be renamed to the document_id, and X-Sendfile (since they are stored under the document root) will be used to retrieve them and a header will be used to return them to their original name.
Is it recommended to make a separate folder for each user and store each individual user's documents in that folder, or create one folder for all documents?
If I go with the one folder approach, I will need some method from keeping the total files per folder below some reasonable limit (1,000?). My thought is to estimate the maximum potential number of folders, and creating subfolders under the main document folder. I will likely hash the ID, and use the first character to create the first subfolder, the second character to create a second subfolder in the first subfolder, and continue as long as needed to accommodate the maximum potential documents (if there are 1,000,000 potential folders, then three levels will keep the maximum per folder under 244).
Please provide rational for one approach over the other.
Thank you
i need to know how i can check a users level in my login.php page it works i have
$sql = "SELECT * FROM $tbl_name WHERE username = '$username' AND password='$password'"; $result = mysql_query($sql); $count = mysql_num_rows($result); $row = mysql_fetch_assoc($result); $user_level = $row['user_level']; if($count == 1) { $_SESSION['loggedIn'] = true; session_write_close(); header("Location: index.php"); } else { echo "The username or password you entered is incorrect!"; } if($row['user_level'] == 1) { header("Location: admin.php"); } else if($row['user_level'] == -1) { header("Location: banned.php"); }but i need to know how to check it in another file because it is not working i am trying to add it to admin.php to check the users level & if they are not admin then echo you are not admin. <-- it says that although the user is an administrator it is saying they are not. This is what i have in admin.php <?php require 'connect.php'; session_start(); $sql = "SELECT * FROM $tbl_name WHERE username = '$username' AND password='$password'"; $result = mysql_query($sql); $row = mysql_fetch_assoc($result); $user_level = $row['user_level']; if(!isset($_SESSION['loggedIn'])) { echo "You are not currently logged in and to view this page you must be logged in to have access. <a href='login.php'> You can login here </a>"; die(); } if($row['user_level'] == 1) { //DO NOTHING } else { echo "Your not an administrator so you are denied access to this page."; die(); } ?> Edited by Tom8001, 24 November 2014 - 03:02 PM. I have a chatbox I am working on, and it has Username field, and it get the username from the user logged in. So I am trying to make it so that I can make it so staff have different colors/crowns by there name in the box. Here is my code <?php list($crowns) = mysql_fetch_row(mysql_query("SELECT * FROM users WHERE username="'chat'.'username'"")) or die (mysql_error()); while($crn = mysql_fetch_assoc($crowns)) { if($crn['rights'] == 2){ $crownon = 1; $crownurl = 'http://runelegend.com/crowns/admin.gif'; $coloron = 1; $color = '#0066CC'; } elseif ($crn['rights'] == 1) { $crownon = 1; $crownurl = 'http://runelegend.com/crowns/mod.gif'; $coloron = 1; $color = 'red'; } elseif ($crn['rights'] == 0) { $crownon = 0; } else { Die("Error with online list, please contact an administrator."); } } ?> I am trying to make it Select Username from users and then if the chat database has that username, it adds the crowns/colors. What are the different ways you can keep a User "logged in"? From what I *vaguely* recall from a year or two ago when I read a whole hoard of PHP books, you commonly use cookies and sessions. But I'm asking this more from an OOP standpoint than a PHP standpoint. Let's say I have a User record in my database, and a User comes along and attempts to log in. In OOP terms, I would think you'd call some class to help log them in, and upon successfully logging in, you would "load" the User object into memory and set the "LoggedIn" field to "True". Then as long as that field was set in their object, they could surf all over the place and do things like change their account and buy things. Is that how you would do it in OOP? TomTees I've seen countless forum software/cms which have such feature, I understand how they count the total users online (as theirs a row which says if a user is online or not (boolean), and then its all counted using mysql_num_rows() to get the total) However I don't get how they'd display the number of Guests? (as I don't think they'd log them woul'dnt that be messy/tedious?) Afternoon All. I wish to re-direct users to a 404 error page on my site if an article does not exist in my database. Here's my code: $SQL = "SELECT headline FROM news WHERE news_id=".mysql_real_escape_string($_GET['news_id']); $result = mysql_query($SQL) OR die(mysql_error()); $num = mysql_num_rows($result); //** Check that the entry exists otherwise send to error page if ($num > 0) { $row = mysql_fetch_array($result); $headline = $row['headline']; } else { echo "Why is this printed? - I should be leaving this page?"; header("Location: error.php"); exit; } Now the wierd thing is that when I enter a news_id for a value that does not exist it prints the message Why is this printed? - I should be leaving this page? so it's actually going to the ELSE statement which is good, but surely it should not do this as I ask the page to re-direct? Thank you I have a string which is a list of user id's like "44/5/6/67/7/88/56/76/9/90/65/74/8/68". I explode this string and put them into an array, but now I have a problem of getting the users first names from the database by using the id's and putting them in alphabetical order. How can I do this? Thanks Sites such as this one often show the logged on users and guests.
I have no reason to need to do so, but am curious on how this is accomplished.
For users, yes, you've authenticated them and logged them on regardless of IP address, but how do you know they didn't just close their browser?
For guests, are they just using IP address? And still, how do you know when they leave?
PS. How should I include an image in a post like I did? What I did was first attach a file, and then edit the post to include that file as an image. Couldn't seem to include an image off my local PC. Not a better way?
Attached Files
Capture.PNG 4.13KB
0 downloads |