PHP Login and Redirection

This site is best viewed in a modern browser with JavaScript enabled.

Kirtangl

Hi Everyone

I have had a lot of help from this site with JavaScript questions, so I know you’re the right guys to ask about PHP.

Just been helping a friend with her dads, home business, website. Anyhow he has asked if its possible to make a login script for his clients. Now I can make a login easy, and have found many sample pages to help. But what he is asking is something different.

What is he asking for? Ok he wants a Client login, when the customer logs in, he is not redirected to the members page, where he can now access all site pages, but redirected to there own page, not accessible from any other client.

Now I have seen things like this, after you login you are directed to like a profile page. That’s sort of what I’m after, but with now profile options, Just info regarding that client.

Because I’m sure I have confused everyone with my ramblings, I made a lil diagram, to kind of show what I want the clients to do.

Thank You Very Much
- Kirt

EDIT: Sorry i just wanted to add, i relise this would probably be a big job, I don't want annyone to spend their hard earned time making this for me, rather pointing me in the direction of something similar i could use, i dont really know PHP, but im willing to learn as I go.

scragar

This would probably be best achieved with a single page, for the individual user, that is not hard, what may be hard is letting the users customise this page.

Kirtangl

Thats ok, The clients/user is not supposed to edit the page. He does tests for the customer and sends them out a book full of data, I want to put that "book" on a webpage for the cust to read, to save the trees and all lol...

You said one page, would that mean they cannot have multiple pages for each client? if so thats ok, just wondering.

scragar

You could do multiple pages, but for the sake of security it's better to keep the real pages to one, and use PHP to generate content for the requested pages, with htaccess you can make the urls look less restricted, maybe something like

mySite.com/myAccount/page2

which apache(or lighttp or IIS(I think)) can convert to mySite.com/myAccount.php?page=2
Then you can read in the username/userID from the cookie/session, and serve the right page, something like:

if( ! isset($_SESSION['user'])){
  header('Location: message.php?type=error&msg=Not+logged+in');
  exit;
}
$userId = $_SESSION['user'];
$page = mysql_real_escape_string($_GET['page']);
$rs = mysql_query("SELECT * FROM `pages` WHERE `user`={$userId}
  AND (`pageNo`='$page' OR `pageNo`='1' ORDER BY `pageNo` DESC LIMIT 1");

$info = mysql_fetch_assoc($rs);
echo "<h3>Page number: {$info['pageNo']}</h3>
{$info['content']}";

Kirtangl

reads franticly through PHP help books

hehe, sorry I have only ever really done client side. trashy stuff basicly, so that code will recognise the userID, and generate a single page for that user, with their data on it.

Im going to have to read up on my_sql data bases aswell arnt I?...

scragar

I assumed you would have a database, it's by far the easiest way to manage such a thing. You won't need to learn much of MySQL, phpMyAdmin will guide you through everything you will need, as well as showing the query you can copy paste into PHP if you want to duplicate the effect.

And I am assuming you have set a session for the ID, it's not all that hard to understand http://php.net/sessions

Kirtangl

I think I can figure out mySQL, I have looked at the mysqladmin like you said, and I think I sort of understand it. The PHP session thing I’m not so sure about, but that link you added should sort that out. I was wrong to think this was an easy task when i took it on lol, since i know almost nothing about PHP.

scragar

OK, how about a comment heavy version:

if( ! isset($_SESSION['user'])){
// $_SESSION       is an array, containing all the session information for this user
// ['user']       repesents the 'user' element of said array.
// isset()      is a function that returns true or false, dependant on if the argument is set or not.
// !        means not, and inverts the true/false bit
// if(){}   if the content evaluates to true do the bit between the braces
  header('Location: message.php?type=error&msg=Not+logged+in');
// header()      sends a header to the browser, this one tells the browser to redirect to message.php?type=error&msg=Not+logged+in
  exit;
// abort the rest of the page so the browser redirects.
}
// end the if section.
$userId = $_SESSION['user'];
// take the userID out of the session so we can use it easier.
$page = mysql_real_escape_string($_GET['page']);
// get the current page, and make it safe to use with MySQL
$rs = mysql_query("SELECT * FROM `pages` WHERE `user`={$userId}
  AND (`pageNo`='$page' OR `pageNo`='1' ORDER BY `pageNo` DESC LIMIT 1");
// a mysql query, it's not too hard to understand, but I'll do that later.

$info = mysql_fetch_assoc($rs);
// get the result from the query.
echo "<h3>Page number: {$info['pageNo']}</h3>
{$info['content']}";
// write out some text, it looks like this:
/*

<h3>Page number: 2</h3>
This is the content we wanted to put on page 3 and stored in the database.

*/

As for the MySQL:

SELECT *    [b]get everything[/b]
FROM `pages`   [b]from a table called pages[/b]
WHERE `user`={$userId} [b] where the user matches up[/b]
AND(            [b] and[/b]
`pageNo`='$page'  [b] the page number matches what we found in the query string[/b]
OR `pageNo`='1' [b] or the page number is one.[/b]
ORDER BY `pageNo` [b] order the results by the page number[/b]
DESC        [b] descending(highest first)[/b]
LIMIT 1     [b]only return the first result after it has been sorted[/b]

This whole thing works out to mean that if the page ID is invalid or not found then we default back to the page 1, otherwise we load the page requested.

With a little bit of experience and practice this will all become second nature.

Kirtangl

WOW!... as i said, i know almost nothing about PHP, but this is somthing els, I should have almost no trouble working this one out, thank you so much.

Is there a credit system in place on this forum or somthing? cos u need a Thumbs up hehe

EDIT: this is gonna sound really dumb, how many fields on my table?

Kirtangl

Im so sorry guys, I know what scragar has done is great, and exactly what i want, but i cant seem to work this out, I need to check a few things with u guys,

I made a SQL database, called it, POD, (i didn't think the name mattered), in that, made a table called 'pages' and added 2 fields 'userId' and 'pageNo'. now im not sure how to add the users and the page number, or the password for that matter lol... fail

and the php, im not to sure how this works, but i add the <?php ?> tags right?.

thanx
kirt

EDIT: I think i worked out the SQL now

userId PassW pageNo

POD01 password 2

thats what the table looks like...

scragar

I would use two tables, one for users, one for pages, a structure something like this:

[B]users[/B]
+--------+-------------+------+-----+---------+----------------+
| Field  | Type        | Null | Key | Default | Extra          |
+--------+-------------+------+-----+---------+----------------+
| userId | int(11)     | NO   | PRI | NULL    | auto_increment | 
| uname  | varchar(63) | NO   |     |         |                | 
| pword  | char(32)    | NO   |     |         |                | 
+--------+-------------+------+-----+---------+----------------+
[B]pages[/B]
+---------+-------------+------+-----+---------+----------------+
| Field   | Type        | Null | Key | Default | Extra          |
+---------+-------------+------+-----+---------+----------------+
| pageId  | int(11)     | NO   | PRI | NULL    | auto_increment | 
| owner   | int(11)     | NO   |     |         |                | 
| pageNo  | int(7)      | NO   |     |         |                |
| content | text        | YES  |     |         |                |
+---------+-------------+------+-----+---------+----------------+

The idea for the system is simple, you store a hash of the users password in the users field, something like:

$username = mysql_real_escape_string($_POST['username']);
$password = md5($_POST['password']);
$rs = mysql_query("SELECT * FROM `users` WHERE `uname`='{$uname}' AND `pword`='{$password}'");
if(mysql_num_rows($rs)){// one or more rows
  $userInfo = mysql_fetch_assoc($rs);
  $_SESSION['user'] = $userInfo['userId'];// get the users ID
  echo "now logged in as {$userInfo['uname']}";
}else{// no rows
  echo "Username or password incorrect.";
}

Kirtangl

Sweet your stil on...

i got this lovley message.

Access denied for user 'thegould'@'localhost' (using password: NO)

I gather its somthing i have done wrong, my guess, i have to add somthing like mySQL_connect or somthing first dont I? before i can even see the database...

scragar

mysql_connect([B]HOST[/B], [B]username[/B], [B]password[/B]);

Your host will probably be 'localhost', the username and password you would have set during install(at least for the root account, I recommend adding another user as soon as you can http://dev.mysql.com/doc/refman/5.1/en/adding-users.html )

Kirtangl

I just had a thought, and if im right, i think im doing this all wrong from the start lol...

If I add my User and PWD for the data base in the PHP code, wont everyone be able to read the source code from my site and see it, or am i putting this code in the complete wrong area. I have just been making a .php page and navigating to that... dammit.

scragar

I would not put the code into the page, put it in an include.

And your password will be safe as long as your server doesn't act up, PHP is processed on the server, not the browser.

If you can put the file above your web root (normally something like /home/public_html (red hat servers like that)or /var/www (which debian defaults to)).

Kirtangl

can i put a .php include in a .html file, or do they both have to be .php... oh and i did get some success lol...

I used this to login

$link = mysql_connect('localhost', 'USER', 'PWD');
if (!$link) {
    die('Could not connect: ' . mysql_error());
}
echo 'Connected successfully';

and it came up with - Connected successfully on my page. so thats good.(i changed UN and PWD obviously)

so i added your code.. i got this

<?php

$link = mysql_connect('localhost', 'USER', 'PWD');
if (!$link) {
    die('Could not connect: ' . mysql_error());
}
echo 'Connected successfully';


$username = mysql_real_escape_string($_POST['username']); 
$password = md5($_POST['password']); 
$rs = mysql_query("SELECT * FROM `users` WHERE `uname`='{$uname}' AND `pword`='{$password}'"); 
if(mysql_num_rows($rs)){// one or more rows 
  $userInfo = mysql_fetch_assoc($rs); 
  $_SESSION['user'] = $userInfo['userId'];// get the users ID 
  echo "now logged in as {$userInfo['uname']}"; 
}else{// no rows 
  echo "Username or password incorrect."; 
} 

mysql_close($link);

?>

and that dosn't work. I need some learner stickers /!\

scragar

OK, going to bed soon, but I'll be on again in a few hours.

For now I'll say you need a form:

<form action='?' method='post'>
<p>Username <input type='text' name='username' value=''></p>
<p>Password <input type='password' name='password' value=''></p>
<p><input type='submit' value='log in'></p>
</form>

And add this around your code so it doesn't bother connecting to the database unless there is a username or password to test:

if(isset($_POST['username']) && isset($_POST['password'])){
//.....
}

Kirtangl

you deserve your sleep lol...

It looks good, a login screen, click login and it connects to the database, just getting the second issue,

Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in /home/BLA/public_html/PODs/password_protect.php on line 15
Username or password incorrect.

But i think this is because i have not added the first bit of code you gave me.. working on it.

NN Mate

scragar

// after this:
$rs = mysql_query("SELECT * FROM `users` WHERE `uname`='{$uname}' AND `pword`='{$password}'");
// add this:
echo mysql_error();

Just to help us find the error.

Kirtangl

hmm.. weird, ok it said, database was not selected, so I chose the database i wanted using this code:

// Select Database
$db_selected = mysql_select_db('PODa', $link);
if (!$db_selected) {
    die ('Can\'t use PODa : ' . mysql_error());
}
echo 'Connected To PODa';

Which i found and edited from another one of my pages. so now when I log in, i get the following message:

Connected To Database
Can't use PODa : Access denied for user 'thegould_pod'@'localhost' to database 'PODa'

which is weird, as pod is added as a user for database PODa, this time Im really stumped lol...