Hello,
I am farely new to PHP and I have stumbled on these set of scripts that work in conjunction to allow a person to login to my website. It works like this: Once you have tried to access the page that is password locked, it redirects you to the incSession.php page which determines if there is a cookie on your computer saying that you are logged in or not, but this page is not seen. If you are not logged in, it directs you to the Login.php page in which you can login. Once you have typed in the User and Password, it directs you to another page that can't be viewed, LoginAction.php. This page determines if you have entered the correct info by connecting to my MySQL page and seeing if that information is there or not. If it is, you will be directed to the page you want to view, if not, you go right back to the Login.php page. What I am trying to do is that I would like to add a timeout to the cookie or the session that the user is on and I would like to have a command here to determine if you have cookies enabled or not, and if not it would show an alert.
Here are the PHP pages in order:
members.php:(ex.)
<?PHP require('incSession.php');
?>
<html>
..................
</html>
incSession.php:
<?php
// Check for a cookie, if none got to login page
if(!isset($HTTP_COOKIE_VAR
S['session
_id'])) {
header('Location: Login.php?refer='.urlencod
e($PHP_SEL
F.'?'.$HTT
P_SERVER_V
ARS['QUERY
_STRING'])
);
}
// Try to find a match in the database
$sGUID = $HTTP_COOKIE_VARS['session
_id'];
$hDB = mysql_connect('host', 'user', 'pass');
mysql_select_db('database'
, $hDB);
$sQuery = "
Select iUser
From tblUsers
Where sGUID = '$sGUID'";
$hResult = mysql_query($sQuery, $hDB);
if(!mysql_num_rows($hResul
t)) {
// No match for guid
header('Location: Login.php?refer='.urlencod
e($PHP_SEL
F.'?'.$HTT
P_SERVER_V
ARS['QUERY
_STRING'])
);
}
?>
Login.php:
<html>
<body>
<p align="center"><form action="LoginAction.php" method="Post">
<div align="center"><font color="#FF6600"><strong>Us
er:<br />
<input type="Text" name="psUser" />
<br />
Password:</strong></font><
br />
<input type="password" name="psPassword" />
<br />
<input type="submit" value="Login" />
<input type="hidden" name="psRefer" value="<? echo($refer) ?>" >
</div>
</form> </p>
</body>
</html>
LoginAction.php:
<?php
// Check if the information has been filled in
if($psUser == '' || $psPassword == '') {
// No login information
header('Location: Login.php?refer='.urlencod
e($psRefer
));
} else {
// Authenticate user
$hDB = mysql_connect('host', 'user', 'pass');
mysql_select_db('database'
, $hDB);
$sQuery = "
Select iUser, MD5(UNIX_TIMESTAMP() + iUser + RAND(UNIX_TIMESTAMP())) sGUID
From tblUsers
Where sUser = '$psUser'
And sPassword = password('$psPassword')";
$hResult = mysql_query($sQuery, $hDB);
if(mysql_num_rows($hResult
)) {
$aResult = mysql_fetch_row($hResult);
// Update the user record
$sQuery = "
Update tblUsers
Set sGUID = '$aResult[1]'
Where iUser = $aResult[0]";
mysql_query($sQuery, $hDB);
// Set the cookie and redirect
setcookie("session_id", $aResult[1]);
if(!$psRefer) $psRefer = 'index.php';
header('Location: '.$psRefer);
} else {
// Not authenticated
header('Location: Login.php?refer='.urlencod
e($psRefer
));
}
}
?>
