[advanced search]
 

Go Back   NamePros.com > Discussion > Web Design & Development > Programming
Reload this Page problem with PHP Login script
Register Forum Rules FAQ Mark Forums Read

Programming PHP, Perl, Ruby on Rails, AJAX, HTML, XHTML, CSS, JavaScript, MySQL and any other coding topics.


Closed Thread
 
LinkBack Thread Tools
Old 05-18-2006, 06:52 AM   #1 (permalink)
NamePros Regular
 
Rudy's Avatar
 
Join Date: Jul 2005
Location: United States
Posts: 588
613.72 NP$ (Donate)

Rudy is just really niceRudy is just really niceRudy is just really niceRudy is just really nice

Save a Life
problem with PHP Login script
hey all,
I'm having a pretty big problem with a login script that I can't figure out.

The login page is here: www.areacodebook.com/login.php

Here's the issue: You you try to login to a personal account (first name & last name), the script works perfectly. If it is a valid login, where the names & passwords match up, the person logs in and goes to the control panel just fine. If it is invalid, the person is not able to get in.

Here's where it gets strange. If you try to login to a business account, if it is a valid login, then you are logged in just fine - BUT for some reason, you are directed to the personal control panel. (Actually, the business & personal control panel are on the same php script - I'm just using a lot of if/else statements to figure out what type of account the person is using).

If it is an INvalid login, the first time it fails. But if you try to login again with the same invalid login info, my script thinks that it is a valid login (and takes you to the personal control panel section of the script).

Of course, b/c it's an invalid login AND because it's taking you to the wrong section, when you try to login as a business, one of the tests that I'm running to try to narrow this down - outputting the User ID number - the ID is blank.

If this is confusing, maybe the following code will help you. I have copied the code for login.php as well as control.php.

Any help would be appreciated.

Thanks,
David

login.php:
PHP Code:
<?PHP
// ini_set('error_reporting', E_ALL);
// ini_set('display_errors', true);

require('library.php');
if (isset($_SESSION['fname']) && isset($_SESSION['bname'])) {

    unset($_SESSION['fname']);
    unset($_SESSION['bname']);
    $relogin = 'true';
}
else if (isset($_SESSION['fname']) || isset($_SESSION['bname'])) {
       header("Location: control.php");
    exit();
    }
else {
     $verlogin = isset($_POST['login']) ? $_POST['login'] : "";

     if ($verlogin == 'submitted') {


     if ($_POST['fname'] && $_POST['bname']) {
         $duplicate = 'yes';
     }
     else {
        if (!empty($_POST['fname'])) {
             $fname = $_POST['fname'];
             $lname = $_POST['lname'];
             $password = $_POST['password'];
             $qType = 'per';
            }
        else if (!empty($_POST['bname'])) {
            $bname = $_POST['bname'];
            $password = $_POST['password'];
            $qType = 'bus';
            }
        else {
            echo '<br /><b><center>We are sorry, but there seems to have been an error. Please contact us for assistance';
        }
       if ($qType=='per') {
            $password = md5($password);
            $sql = mysql_query("SELECT * FROM user WHERE fname='$fname' AND lname='$lname' AND password='$password'");
              if (!$sql) {
                echo 'Query failed. Error: ', mysql_error();
                exit();
                }
            }
        else if ($qType=='bus') {
            $password = md5($password);
            $sql = mysql_query("SELECT * FROM buser WHERE name='$bname' AND password='$password'");
            if (!$sql) {
                   echo 'Query failed. Error: ', mysql_error();
                   exit();
                }
            $_SESSION['bname'] = $_POST['bname'];
            }
        else {
            echo '<br /><b><center>We are sorry, but there seems to have been an error. Please contact us for assistance';
            exit();
        }
        $login_check = mysql_num_rows($sql);
        if($login_check > 0){
            while($row = mysql_fetch_array($sql)) {
            foreach( $row AS $key => $val ) {
                $$key = stripslashes( $val );
                }
           /* Testing purposes only
            echo "$fname";
            echo "$bname";
            exit();
           End Test */
            $_SESSION['bname'] = $bname;
            $_SESSION['fname'] = $fname;
            $_SESSION['lname'] = $lname;
            $_SESSION['email'] = $email;
            $_SESSION['user_id'] = $user_id;
            header("Location: control/control.php");
            exit();
            }
        }
        else {
            echo '<center><br /><b>You were not able to be logged in. Please verify that all required fields are filled in. If you need assistance, please contact us.</b><br /><br />';
            echo '<hr></center>';
            }
        }
      }
    }
?>
control.php
PHP Code:
    <?PHP

        // Testing Purposes Only
        // echo $_SESSION['fname'];
        // echo $_SESSION['bname'];
        //

        if (isset($_SESSION['fname'])) {
            echo '<center><h2><b><u>User Control Panel</u></h2></center>';
            echo 'Hello, '.$_SESSION['fname'].' '.$_SESSION['lname'].'! You are now logged in.<br /><br /><hr>';
            /* echo 'Your ID number is: '.$_SESSION['user_id'].'.<br />'; */
            echo 'Here you can do multiple actions, such as add a phone number. Just click on the links below!<hr><br /><br />';
            echo '<a class="class2" href="addphone.php">Add a phone number</a>&nbsp;•&nbsp;<a class="class2" href="addaddress.php">Add/Modify Mailing Address</a>
                <br /><br />
                <a class="class2" href="../logout.php">Logout of your control panel</a><br><br>';
            }
        else if (isset($_SESSION['bname'])) {
            echo '<center><h2><b><u>Business Control Panel</u></h2></center>';
            echo 'Hello, '.$_SESSION['bname'].'! You are now logged in.<br /><br /><hr>';
            // Testing
                echo 'Your ID number is: '.$_SESSION['user_id'].'.<br /><br /><hr>';
            // End Testing
            echo 'Here you can do multiple actions, such as add a phone number. Just click on the links below!<hr><br /><br />';
            echo '<a class="class2" href="addbizphone.php">Add a phone number</a>&nbsp;•&nbsp;<a class="class2" href="addbizaddress.php">Add/Modify Mailing Address</a>
            <br /><br />
            <a class="class2" href="../logout.php">Logout of your control panel</a><br><br>';
        }
        else {
            echo '<center><b>You currently are not logged in. Please <a class="class2" href="../login.php">login</a> now.<br></b></center>';
            }
    ?>
Thanks,
David
__________________
Smooth Stone Services
Affordable Web Hosting Solutions Starting at only $4.95/month, IT Consulting and Technical Support

Hunt Sources - Hunting Resources Online
Last edited by Rudy; 05-18-2006 at 07:13 AM.
Rudy is offline  
Old 05-18-2006, 07:28 AM   #2 (permalink)
NPQ's PA, Slave, and On Call Coder

Technical Services


 
Eric's Avatar
 
Join Date: Mar 2005
Posts: 4,545
0.71 NP$ (Donate)

Eric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond repute

Save a Life Child Abuse 9/11/01 :: Never Forget Baby Health Marrow Donor Program AIDS/HIV Breast Cancer Cystic Fibrosis Ethan Allen Fund Animal Cruelty Ethan Allen Fund Ethan Allen Fund Cancer Alzheimer's Protect Our Planet Cancer Survivorship SIDS Child Abuse
This _may_ work, if not... I blame it on my lack of sleep. May take another look later:

login.php
PHP Code:
<?PHP

// ini_set('error_reporting', E_ALL);
// ini_set('display_errors', true);

require('library.php');

if(isset($_SESSION['fname']) && isset($_SESSION['bname']))
{
  unset($_SESSION['fname'], $_SESSION['bname']);
  $relogin = 'true';
}
elseif(isset($_SESSION['fname']) || isset($_SESSION['bname']))
{
  header("Location: control.php");
  exit();
}
else
{
  $verlogin = isset($_POST['login']) ? $_POST['login'] : "";

  if($verlogin == 'submitted')
  {
    if($_POST['fname'] && $_POST['bname'])
    {
      $duplicate = 'yes';
    }
    else
    {
      if(!empty($_POST['fname']))
      {
        $fname = $_POST['fname'];
        $lname = $_POST['lname'];
        $password = $_POST['password'];
        $qType = 'per';
        $use_per = true;
      }
      elseif(!empty($_POST['bname']))
      {
        $bname = $_POST['bname'];
        $password = $_POST['password'];
        $qType = 'bus';
        $use_bus = true;
      }
      else
      {
        echo '<br /><b><center>We are sorry, but there seems to have been an error. Please contact us for assistance';
      }
      
      if($qType == 'per')
      {
        $password = md5($password);
        $sql = mysql_query("SELECT * FROM user WHERE fname='$fname' AND lname='$lname' AND password='$password'");

        if(!$sql)
        {
          echo 'Query failed. Error: ', mysql_error();
          exit();
        }
      }
      elseif($qType == 'bus')
      {
        $password = md5($password);
        $sql = mysql_query("SELECT * FROM buser WHERE name='$bname' AND password='$password'");

        if(!$sql)
        {
          echo 'Query failed. Error: ', mysql_error();
          exit();
        }
      }
      else
      {
        echo '<br /><b><center>We are sorry, but there seems to have been an error. Please contact us for assistance';
        exit();
      }

      $login_check = mysql_num_rows($sql);

      if($login_check > 0)
      {
        while($row = mysql_fetch_array($sql))
        {
          foreach($row AS $key => $val)
          {
            $$key = stripslashes($val);
          }
          /* Testing purposes only
          echo "$fname";
          echo "$bname";
          exit();
          End Test */
          
          if($use_per)
          {
            $_SESSION['fname'] = $fname;
            $_SESSION['lname'] = $lname;
          }
          else
          {
            $_SESSION['bname'] = $bname;
          }
          $_SESSION['email'] = $email;
          $_SESSION['user_id'] = $user_id;

          header("Location: control/control.php");
          exit();
        }
      }
      else
      {
        echo '<center><br /><b>You were not able to be logged in. Please verify that all required fields are filled in. If you need assistance, please contact us.</b><br /><br />';
        echo '<hr></center>';
      }
    }
  }
}
?>
control.php
PHP Code:
<?PHP

// Testing Purposes Only
// echo $_SESSION['fname'];
// echo $_SESSION['bname'];
//

if(isset($_SESSION['fname']))
{
  echo '<center><h2><b><u>User Control Panel</u></h2></center>';
  echo 'Hello, '.$_SESSION['fname'].' '.$_SESSION['lname'].'! You are now logged in.<br /><br /><hr>';
  /* echo 'Your ID number is: '.$_SESSION['user_id'].'.<br />'; */
  echo 'Here you can do multiple actions, such as add a phone number. Just click on the links below!<hr><br /><br />';
  echo '<a class="class2" href="addphone.php">Add a phone number</a>&nbsp;•&nbsp;<a class="class2" href="addaddress.php">Add/Modify Mailing Address</a><br /><br />
  <a class="class2" href="../logout.php">Logout of your control panel</a><br><br>';
}
elseif(isset($_SESSION['bname']))
{
  echo '<center><h2><b><u>Business Control Panel</u></h2></center>';
  echo 'Hello, '.$_SESSION['bname'].'! You are now logged in.<br /><br /><hr>';
  // Testing
  echo 'Your ID number is: '.$_SESSION['user_id'].'.<br /><br /><hr>';
  // End Testing
  echo 'Here you can do multiple actions, such as add a phone number. Just click on the links below!<hr><br /><br />';
  echo '<a class="class2" href="addbizphone.php">Add a phone number</a>&nbsp;•&nbsp;<a class="class2" href="addbizaddress.php">Add/Modify Mailing Address</a><br /><br />
  <a class="class2" href="../logout.php">Logout of your control panel</a><br><br>';
}
else
{
  echo '<center><b>You currently are not logged in. Please <a class="class2" href="../login.php">login</a> now.<br></b></center>';
}

?>
And just a note, I'd highly advise you validate any user input. Right now, you're open to SQL Injection, among other things.. esp, in login.php
__________________
Eric is offline  
Old 05-18-2006, 09:30 AM   #3 (permalink)
NamePros Regular
 
Rudy's Avatar
 
Join Date: Jul 2005
Location: United States
Posts: 588
613.72 NP$ (Donate)

Rudy is just really niceRudy is just really niceRudy is just really niceRudy is just really nice

Save a Life
I'm not sure what you did... don't tell me so I can study the code and look at it myself.

Thanks so much for the help. It looks like everything is working perfectly now.

I really appreciate it. I'll also look into the validating user input. I'm not too familiar with how to do that, so I'll see if I can read up on anything like it on the net and in a couple books I have.

- David
__________________
Smooth Stone Services
Affordable Web Hosting Solutions Starting at only $4.95/month, IT Consulting and Technical Support

Hunt Sources - Hunting Resources Online
Rudy is offline  
Old 05-18-2006, 05:16 PM   #4 (permalink)
NPQ's PA, Slave, and On Call Coder

Technical Services


 
Eric's Avatar
 
Join Date: Mar 2005
Posts: 4,545
0.71 NP$ (Donate)

Eric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond reputeEric has a reputation beyond repute

Save a Life Child Abuse 9/11/01 :: Never Forget Baby Health Marrow Donor Program AIDS/HIV Breast Cancer Cystic Fibrosis Ethan Allen Fund Animal Cruelty Ethan Allen Fund Ethan Allen Fund Cancer Alzheimer's Protect Our Planet Cancer Survivorship SIDS Child Abuse
'twas no problem. Glad I could help
__________________
Eric is offline  
Closed Thread

« Phpsessid | turing »

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

Site Sponsors
Advertise your business at NamePros

All times are GMT -7. The time now is 04:25 AM.

Contact Us - NamePros.com - Archive - Privacy Statement - Top

Powered by: vBulletin® Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
Search Engine Friendly URLs by vBSEO 3.3.0
Template-Modifications by TMS
vBCredits v1.4 Copyright ©2007 - 2008, PixelFX Studios

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85