Session Problems

[PHPstarter]

Basicly we're at a navigation page with a lot of different links.

Clicking one of the links will lead you to a new index, but you would only be able to view the index if you are already logged in.

I tried to check that by using this code:
(i put this code on top of the index file's code)

<?
//check that the user is calling the page from the login form and not accessing it directly
//and redirect back to the login form if necessary
if (!isset($username) || !isset($password)) {
header( "Location: login.php" );
}
//check that the form fields are not empty, and redirect back to the login page if they are
elseif (empty($username) || empty($password)) {
header( "Location: login.php" );
}
else{
?>

It doesnt work at all and I go straight to index, instead of redirecting us to the login.php.

How do I make this work properly so that the site cannot be viewed directly unless already logged in and stored in a session.

My session code is:

<?php
// start the session
session_start();
//if the session is registered to a valid user then show content
if (session_is_registered("$username")) {

echo "Access granted.";
}
//not registered session
else {
header( "Location: login.php" );
}
?>

Which doesn't seem to be working either..

=(

Thank you for answers

[hoopy]

Hi,

First off, session_is_regi stered, is deprecated, so should not really be used.

You can use the $_SESSION variables to store if the user has authenticated. Consider this very basic example:

login.php

<form action="auth.php" method="post">
U: <input type="text" name="username"><br />
P: <input type="password" name="password"><br />
<input type="submit" name="submit">
</form>

auth.php

<?
session_start();
if( $_POST['username'] == "test" && $_POST['password'] == "test" )
{
  $_SESSION['authenticated'] = 1;
  header("Location: menu.php");
} else {
  header("Location: login.php");
}
?>

menu.php

<?
session_start();
if(!isset($_SESSION['authenticated']))
{
  // not authenticated redirect
  header("location: login.php");
  exit();
}
// get here we OK.
// display menu, etc. 
echo ("Hello, you are authenticated..");
?>

So login.php is pretty much just a form which points to auth.php. auth.php starts a session and then checks if the username and pass match that of "test". If not then it redirects back to login.php. If a match occurs it sets the session variable $_SESSION['authenticated'] to 1 and then redirects to what would be your menu page. On menu.php the session is started and a check is made to ensure the session variable $_SESSION['authenticated'] has been set. If not then the user has not authenticated so it redirects back to login.php. If it does exist you are good to display your menu.

This is a very basic example but playing around with it should point you in the right direction.

Best of luck.

[PHPstarter]

Thanks a lot for your answer, I will look more into it this way now that you pointed me in the right direction.

- -

[PHPstarter]

[sorry for double posting]

I tried to get my own login script that logs in the user via MySQL to link to the auth.php, but I was wondering how I could implement it into the mysql login script?

logincheck.php

<?php
ob_start();
$host="localhost"; 		// Host name
$username="--------"; 	// Mysql username
$password="---------"; 	// Mysql password
$db_name="-------------"; 	// Database name
$tbl_name="-----------"; 		// Table name

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");

// Define $username and $password
$username=$_POST['username'];
$password=$_POST['password'];

// To protect MySQL injection (more detail about MySQL injection)
$username = stripslashes($username);
$password = stripslashes($password);
$username = mysql_real_escape_string($username);
$password = mysql_real_escape_string($password);

$sql="SELECT * FROM $tbl_name WHERE username='$username' and password='$password'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $username and $password, table row must be 1 row

[I]if($count==1){
// Register $username, $password and redirect to file "menu.php"
session_register("username");
session_register("password");
header("location: menu.php");
}
else {
header( "Location: login.php" );
}[/I]

ob_end_flush();
?>

Now I tried to implement it where i marked the text in italics as:

if($count==1){
// Register $username, $password and redirect to file "boelogin=yes.html"
session_register("username");
session_register("password");
session_start();
$_SESSION['authenticated'] = 1;
header("location: boelogin=yes.html");
}
else {
header( "Location: badlogin=user.html" );
}

and also:

if($count==1){
// Register $username, $password and redirect to file "menu.php"
session_start();
session_register("username");
session_register("password");
$_SESSION['authenticated'] = 1;
header("location: menu.php");
}
else {
header( "Location: login.php" );
}

But nothing prevailed :/
So any ideas to this?

[Dormilich]

first, session_registe r() is also deprecated. you just need to implement the authentication as used in post #2 only that you have this time a slightly different if condition. everything else stays the same.