PHP - Shift System

  Hi this is my login script i do have the html if you need to see it please ask & i was wondering if anyone would be kind enough to tell me how i can get my ban system to work Thanks

<?php

require 'connect.php';

if(isset($_POST['submit'])) {

	$username = $_POST['username'];
	$password = $_POST['password'];

	//Prevent hackers from using SQL Injection
	$username = stripslashes($username);
	$password = stripslashes($password);
	$username = mysql_real_escape_string($username);
	$password = mysql_real_escape_string($password);

	$sql = "SELECT * FROM $tbl_name WHERE username='$username' AND password='$password'";
	$result = mysql_query($sql);
	$count = mysql_num_rows($result);

	$user_level = $_GET['user_level'];

	$_SESSION['user_level'] = $user_level;

	if($count == 1) {

		$_SESSION['username'];
		$_SESSION['password'];
		header("Location: index.php");
	} else {

		echo "Please check the username and password you entered is correct.";
	} if($_SESSION['user_level'] == 0) {
		$_SESSION['username'];
		$_SESSION['password'];
		header("Location: index.php");
		
	} else if($_SESSION['user_level'] == -1) {

		die();
		header("Location: banned.php");

	} else if($_SESSION['user_level'] < -1) {
		die();
		echo "An error has occurred please contact your administrator.";

	} else if($_SESSION['user_level'] == 1) {
		$_SESSION['username'];
		$_SESSION['password'];
		header("Location: admin.php");

	}


}

?>

Edited by Tom8001, 23 November 2014 - 12:18 PM.

i am trying to add a like system to my forum similar to facebook where it shows how many people like a post.

this is my code so far:

$like_list = "";
            
            $likes = explode("|", $post_info['post_likes']);
            $amount_likes = count($likes);
            $ac_likes = ($amount_likes / 2);
            $slice = array_slice($likes, 0, 4, true);
            $remain = array_slice($likes, 4, $ac_likes, true);
            $remain_num = count($remain);
            
            if ($ac_likes >= 4)
            {
                for($i=0; $i<$ac_likes; $i+=2)
                {
                    $like_list .= $likes[$i].", ";
                }
                $like_list .= " and $remain_num others like this";
            }
            elseif ($amount_likes == 1    )
            {
                $like_list .= "0 people like this";
            }
            elseif ($ac_likes == 1)
            {
                $like_list = implode(", ", $likes);
                $like_list .= " likes this";
            }
            else
            {
                $like_list = implode(", ", $likes);
                $like_list .= " like this";
            }

$post_info['post_likes'] contains data like:

Code: [Select]
user1|123456789|user2|123456789
where the number is the timestamp.

unfortunatly $like_list prints the username and the timestamp when i would like it to only display the username. This means
printing every 2nd element in the array starting from 0. I have seen this done with for loops but i am not using one therefore i am stuck. Any ideas? and is this the best database setup for likes? the post_likes column is added on to the end of the post table.

Hi all

I have been looking though loads of tutorials regarding log in method for websites (not APIs), and cant help find that they are outdated.

So I am asking what is the correct way to create a log in system using php?

Modern websites use JavaScript for asynchronous web requests so this requirement should also be catered for. APIs and mobile apps use access tokens which is very secure if implemented correctly.

Can we use the token principle for websites? As the way I see it that most php log in systems use php sessions and they create a session and save some data in this session when the user successfully authenticates, however the session id is held in a cookie so if the cookie is stolen then they have access to your account.

API access tokens are expired and refreshed periodically so is there such a implementation method for web sites too?

Hey guys,
I'm starting to build a website and I was wondering wether I should use a library template engine such as smarty, or use pure php, such as this tutorial - http://www.massassi.com/php/articles/template_engines/

Basically the website will not expose any of the users/designers to the designer portion of the website. I am scratching my head wether I should use smarty or pure php, even Facebook uses smarty, from what I have heard. I need some answers.

Thank you all!

Hi,
I'm trying to code a very basic commenting system, my only worries is how I'm going on about disabling the user from putting any html php etc.. in the comment so it gets displayed on the page.. I have on idea of what to look for, any help is much appreciated

I considdered this: strip_tags() but what i want is to display the comment just without actually executing the code if you get me?

I already have a web based RPG game I am developing. Here is a small video to showcase the loot animation.     My problem is, I want to add combat. I will be using html 5 websockets. I already have a websockets server up so multiplayer isn't the issue.   A good combat system I found is on this game: http://treasurearena.clay.io/   I'm not going to dig out the source code, and try to extract the combat system from this game. Just trying to find something similar that I can use, does anyone have any recommendations?   Thanks!   Edit: It can be as simple as swinging a freaking sword and moving. That's all I really want, I just don't want the boring 'click', 'click', and 'click' bullshit.

Hi all
 
I am building a website for a restaurant where the registered user can do booking in the booking page where user finds the booking form. my problem is I created the log in system but cannot workout with the booking page.
 
I have this scenario -
 
Customer visits site & registers details (name, email etc) on a "registration page" (creating a username & password which goes into your database) - done that
 
Next day, customer visits site and logs in on a "log in page" using the username & password from the previous day which is now stored in your database. Can now make a booking based on this log in. (cannot do this)

Hi All!   This is my first post here, so if there are some things I miss or something more I need to do please let me know.   I tried searching the forum for the answer first but could not find anything.   So here is the thing; I followed a tutorial I found about building a login system for my website. The tutorial worked perfectly, except I needed it to redirect to a user specific page instead of a static page on login. I made the necessary changes to the script, and now it redirects to the user specific page, but does not recognize that I am logged in so it will not show me the content.   In the interest of full disclosure, I am not very good at PHP and lack a fundamental understanding of it. I am enrolled in some Udemy courses to try to rectify that, but I needed the login system ASAP, so copy and paste programming was my only option. I know, I know. I am a terrible human being and should be thrown into the sun. I agree. I am in counseling to try to deal with it.   The tutorial I used can be found he  http://www.wikihow.c...n-PHP-and-MySQL.   Here is the relevant code:   process_login.php:  

<?php


include_once 'db_connect.php';
include_once 'functions.php';


sec_session_start(); // Our custom secure way of starting a PHP session.


if (isset($_POST['email'], $_POST['p'])) {
    $email = $_POST['email'];
    $password = $_POST['p']; // The hashed password.


$page = login($email, $password, $mysqli);
if ($page == true) {
  // Login success        
  header('Location: '. $page);
   exit();


    } else {
        // Login failed 
        header('Location: ../error.php?error=1');
    }
} else {
    // The correct POST variables were not sent to this page. 
    echo 'Invalid Request';
}

Here are some script that i have been working on and i seems to not work so i want to make a select friend list that when they select the friend that they want to send the message to it sends it to them , that sounded stupid but ya. so here is my script , kinda big .
pm_inbox.php i did edit the code from its original state because its to big! so here is the sections where is most needed
Code: [Select]
<?php

// Start_session, check if user is logged in or not, and connect to the database all in one included file
include_once("scripts/checkuserlog.php");
?>
<?php
if (!isset($_SESSION['idx'])) {
echo  '<br /><br /><font color="#FF0000">Your session has timed out</font>
<p><a href="login.php">Please Click Here</a></p>';
exit(); 
}
//THIS IS WHERE I STARTED
$selecteduser = $_POST["selecteduser"];
$id = "";
$username = "";
$id = preg_replace('#[^0-9]#i', '', $id);
$sql = mysql_query("SELECT * FROM myMembers WHERE id='$id' LIMIT 1");
while($row = mysql_fetch_array($sql)){ 
    $username = $row["username"];
$friend_array = $row["friend_array"];
$check_pic = "members/$id/image01.jpg";
$default_pic = "members/0/image01.jpg";
if (file_exists($check_pic)) {
    $user_pic = "<img src=\"$check_pic?$cacheBuster\" width=\"218px\" />"; 
} else {
$user_pic = "<img src=\"$default_pic\" width=\"218px\" />"; 
}

$selecteduser .= "<option value='$friend_array'>Friends</option>";



}






// Decode the Session IDX variable and extract the user's ID from it
$decryptedID = base64_decode($_SESSION['idx']);
$id_array = explode("p3h9xfn8sq03hs2234", $decryptedID);
$my_id = $id_array[1];
$my_uname = $_SESSION['username']; // Put user's first name into a local variable
// ------- ESTABLISH THE INTERACTION TOKEN ---------
$thisRandNum = rand(9999999999999,999999999999999999);
$_SESSION['wipit'] = base64_encode($thisRandNum); // Will always overwrite itself each time this script runs
// ------- END ESTABLISH THE INTERACTION TOKEN ---------
?>
<?php
// Mailbox Parsing for deleting inbox messages
if (isset($_POST['deleteBtn'])) {
    foreach ($_POST as $key => $value) {
        $value = urlencode(stripslashes($value));
if ($key != "deleteBtn") {
   $sql = mysql_query("UPDATE private_messages SET recipientDelete='1', opened='1' WHERE id='$value' AND to_id='$my_id' LIMIT 1");
   // Check to see if sender also removed from sent box, then it is safe to remove completely from system
}
    }
header("location: pm_inbox.php");
}
?>

// Start Private Messaging stuff
$('#pmForm').submit(function(){$('input[type=submit]', this).attr('disabled', 'disabled');});
function sendPM ( ) {
      var pmSubject = $("#pmSubject");
  var pmTextArea = $("#pmTextArea");
  var sendername = $("#pm_sender_name");
  var senderid = $("#pm_sender_id");
  var recName = $("#pm_rec_name");
  var recID = $("#pm_rec_id");
  var pm_wipit = $("#pmWipit");
  var url = "scripts_for_profile/private_msg_parse.php";
      if (pmSubject.val() == "") {
           $("#interactionResults").html('<img src="images/round_error.png" alt="Error" width="31" height="30" /> &nbsp; Please type a subject.').show().fadeOut(6000);
      } else if (pmTextArea.val() == "") {
   $("#interactionResults").html('<img src="images/round_error.png" alt="Error" width="31" height="30" /> &nbsp; Please type in your message.').show().fadeOut(6000);
      } else {
   $("#pmFormProcessGif").show();
   $.post(url,{ subject: pmSubject.val(), message: pmTextArea.val(), senderName: sendername.val(), senderID: senderid.val(), rcpntName: recName.val(), rcpntID: recID.val(), thisWipit: pm_wipit.val() } ,           function(data) {
   $('#private_message').slideUp("medium");
   $("#interactionResults").html(data).show().fadeOut(10000);
   document.pmForm.pmTextArea.value='';
   document.pmForm.pmSubject.value='';
   $("#pmFormProcessGif").hide();
           });
  }
}function toggleViewAllFriends(x) {
if ($('#'+x).is(":hidden")) {
$('#'+x).fadeIn(200);
} else {
$('#'+x).fadeOut(200);
}
}
// End Private Messaging stuff</script>
<style type="text/css">
.hiddenDiv{display:none}
#pmFormProcessGif{display:none}
.msgDefault {font-weight:bold;}
.msgRead {font-weight:100;color:#666;}
</style>
</head>
<body>
<div id="bg" class="stage"></div>
<div id="container">
<div id="sun" class="stage"></div>
<div id="clouds" class="stage">
<div id="stage" class="stage">
<?php include_once "header_template.php"; ?>

        <a href="#" onclick="return false" onmousedown="javascript:toggleInteractContainers('private_message');">Compose Message</a></div><div class="interactContainers" id="private_message">

<form action="javascript:sendPM();" name="pmForm" id="pmForm" method="post" type="hidden">
<font size="+1">Send A Private Message to <strong><em><?php echo "$selecteduser"; ?></em></strong></font><br /><br />
Subject:
<input name="pmSubject" id="pmSubject" type="text" maxlength="64" style="width:98%;" />
Message:
<textarea name="pmTextArea" id="pmTextArea" rows="8" style="width:98%;"></textarea>
  <input name="pm_sender_id" id="pm_sender_id" type="hidden" value="<?php echo $_SESSION['id']; ?>" />
  <input name="pm_sender_name" id="pm_sender_name" type="hidden" value="<?php echo $_SESSION['username']; ?>" />
  <input name="pm_rec_id" id="pm_rec_id" type="hidden" value="<?php echo $id; ?>" />
  <input name="pm_rec_name" id="pm_rec_name" type="hidden" value="<?php echo $username; ?>" />
  <input name="pmWipit" id="pmWipit" type="hidden" value="<?php echo $thisRandNum; ?>" />
  <span id="PMStatus" style="color:#F00;"></span>
  <br /><input name="pmSubmit" type="submit" value="Submit" /> or <a href="#" onclick="return false" onmousedown="javascript:toggleInteractContainers('private_message');">Close</a>
<span id="pmFormProcessGif" style="display:none;"><img src="images/loading.gif" width="28" height="10" alt="Loading" /></span></form>
      </div>
              <span id="jsbox" style="display:none"></span>
            </td>
          </tr>
      </table>
       

Hello,
       Basically i am following this tutorial -: http://tutorialzine.com/2010/06/simple-ajax-commenting-system/ for a website I am creating. But in that tutorial when you write a comment you add a name, I was wondering is it possible instead for my website to use the users username as I have a login system that I created from folowing a tutorial on the same site. I am new to PHP and web creation so please keep the comments simple.

First of all hello as I am new to this forum.

Ok so, I am have been trying for the past few days to create a login system in PHP for a website I am creating, and I am having serious problems. I have tryed so many tutorials and they all are not working, my conclusion is they are outdated or not fully understandable.

So what I want to create -
Registration
Forgot password
Login page
Email activation
Member page

My hosting has the latest php and mysql as far as I know so could someone please give me an up to date simple tutorial on creating this.

Lastly the program I am using is Dreamweaver CS5

Thankyou.

I'm making a game where you earn points and lose points based on the actions that you take and the actions that your opponents take.  What's the best way to create this system.  Should I use mysql to store all the data and if so, should I set up the actions in a seperate table or should I just join the actions from all of my other tables.  I'm not quite sure what the best method is.

Looking for the best way to set-up the db of a messaging system. Here's what I have so far (basically pulled from another forum), don't know if Table1 is even really necessary:

Table1:
id
user_message_id
recepient_id
recepient_read

Table2:
user_message_id
sender_id
sender_read
subject
message
created_at
updated_at



Basically it needs to function where, someone submits a message to the admin or moderator, the admin/moderators can review and reply, and then the user can submit another reply, and keeps going indefinitely. I want each reply to show up almost like a forum thread.

How would I chain the reply messages to the original messages?

ok i need directing to a tutorial, an easyish one that can help me do a secure login and registration system. Something that uses sessions and mysql. something with sql injection and other security. i need it very secure.


hope you can help.