capturing username

[ddtpmyra]

Hi I have a log-in script below that do the log-in validation, my question is how can I capture the username to for my next page reference so I can execute update command according to current log-in name?

<?php
session_start();

$errorMessage = '';
if (isset($_POST['txtUserId']) && isset($_POST['txtPassword'])) {
	include 'library/config.php';
	include 'connect.php';

	$userId   = $_POST['txtUserId'];
	$password = $_POST['txtPassword'];

	// check if the user id and password combination exist in database
	$sql = "SELECT * FROM members WHERE username='$userId' and password='$password' and user_level=1";



	$result = mysql_query($sql) or die('Query failed. ' . mysql_error());

	if (mysql_num_rows($result) == 1) {
		// the user id and password match,
		// set the session
		$_SESSION['db_is_logged_in'] = true;

		// after login we move to the main page
		session_register("txtUserId");
		session_register("txtPassword");
		header('Location: approvals_r.php');
		exit;
	} else {
		$errorMessage = 'Sorry, wrong user id / password';
	}

	include 'library/closedb.php';
}
?>

[Markus]

Store the username in a session, and then on any page that requires it, start the session and grab it from the array.

[ddtpmyra]

Markus,

can you give me example how to do it?

thanks,
DM

[Markus]

Ok, on the page where the user logs in, if the log is successful, do this:

$_SESSION['username'] = $username; // change this to reflect the database value

Then on a page that needs to 'capture' the user name, do this:

// at very beggining of page:
session_start();

// code

// get the username
echo $_SESSION['username'];

[ddtpmyra]

Here's my code but didn't work what am I missing here?

<?php
// we must never forget to start the session
session_start();

$errorMessage = '';
if (isset($_POST['txtUserId']) && isset($_POST['txtPassword'])) {
	include 'library/config.php';
	include 'connect.php';

	$userId   = $_POST['username'];
	$password = $_POST['txtPassword'];

	// check if the user id and password combination exist in database
	$sql = "SELECT * FROM members WHERE username='$username' and password='$txtPassword' and user_level=1";



	$result = mysql_query($sql) or die('Query failed. ' . mysql_error());

		if (mysql_num_rows($result) == 1) {
		// the user id and password match,
		// set the session
		$_SESSION['db_is_logged_in'] = true;
		$_SESSION['username'] = $username; // change this to reflect the database value 

		// after login  move to the target page
		session_register("username");
		session_register("txtPassword");
		header('Location: approvals_r.php');
		exit;
	} else {
		$errorMessage = 'Sorry, wrong user id / password';		
	}


}
?>

and for the target page after log-in

<?php
// start the session
session_start();
echo $_SESSION['username']; 
// is the one accessing this page logged in or not?
if (!isset($_SESSION['db_is_logged_in']) || $_SESSION['db_is_logged_in'] !== true) {
	// not logged in, move to login page
	header('Location: login_r.php');
	echo $_SESSION['username']; 


//more codes here....
?>

[Markus]

Line 24 needs to reflect the actual username.

        $_SESSION['username'] = $userId;

Also remove lines 27 & 28.