Solved

PHP Session webpage after authentication

Posted on 2014-03-23
6
834 Views
Last Modified: 2014-04-06
Hello All,

I have accomplished my first login web page using php and mysql, but in order to start a "session" or to redirect the user that has logged in to their home page wher their data is, how can I do this?

Here's my php code for my login page:

<?php
mysql_connect("localhost","root","**********");
      mysql_select_db("***********");

if(isset($_POST['submit'])){
      $uname = $_POST['uname'];
      $password = $_POST['password'];
      
      $sql = mysql_query("SELECT * FROM users WHERE uname = '$uname' AND password= '$password'");
      if(mysql_num_rows($sql) > 0){
            echo "You are now Logged in";
            exit();
      }
      else {
            echo "Wrong Username and Password";      
      }
      
}
else{
$form = <<<EOT
<form action="Login.php" method="POST">
Username: <input type="text" name="uname"/><br/>
Password: <input type="password" name="password"/><br/>
<input type="submit" value="Login" name="submit"/>
</form>
EOT;

echo $form;


}      

?>
0
Comment
Question by:LuiLui77
  • 3
6 Comments
 
LVL 35

Expert Comment

by:Terry Woods
ID: 39949463
A little knowledge can be a dangerous thing. In case you weren't aware, if a user enters the following value to your login form, the consequences are not good (no username or password would be required):
' or 1=1 or '

Open in new window

Or, potentially worse (this might drop your users table from the database; don't do it!):
'; drop table users; --'

Open in new window



More info here on sanitising user input: http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/Q_27699398.html

Looks like some good details on using sessions here: http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/Q_23573048.html
0
 
LVL 35

Expert Comment

by:Terry Woods
ID: 39949473
There also some information here on how to redirect after form submission: http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/Q_24926053.html

These days I'm using the CodeIgniter framework, which does redirects automatically, but my understanding is that you should be redirecting after every successful POST form submission (ie those that change information), otherwise you get unwanted browser behaviour (such as the wrong page loading when a user opens a bookmark, or a resubmit information question when refreshing the page).
0
 
LVL 108

Accepted Solution

by:
Ray Paseur earned 500 total points
ID: 39949956
This article explains the essential design patterns for PHP client authentication (all web sites do the basics the same way).  It shows how the PHP session is used.
http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/A_2391-PHP-login-logout-and-easy-access-control.html

This article explains PHP sessions.
http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/A_11909-PHP-Sessions-Simpler-Than-You-May-Think.html

This article explains why you want to put aside MySQL and instead choose one of the supported database extensions like MySQLi or PDO.
http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/PHP_Databases/A_11177-PHP-MySQL-Deprecated-as-of-PHP-5-5-0.html

And in case you're new to PHP and want to get some good learning resources (instead of copying code you found on the internet) try the resources called out in this article.
http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/A_11769-And-by-the-way-I-am-new-to-PHP.html
0
 
LVL 35

Expert Comment

by:Terry Woods
ID: 39951435
Good one Ray. Odd that my search didn't find any of those!
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Introduction Since I wrote the original article about Handling Date and Time in PHP and MySQL (http://www.experts-exchange.com/articles/201/Handling-Date-and-Time-in-PHP-and-MySQL.html) several years ago, it seemed like now was a good time to updat…
Introduction This article is intended for those who are new to PHP error handling (https://www.experts-exchange.com/articles/11769/And-by-the-way-I-am-New-to-PHP.html).  It addresses one of the most common problems that plague beginning PHP develop…
Use Wufoo, an online form creation tool, to make powerful forms. Learn how to choose which pages of your form are visible to your users based on their inputs. The page rules feature provides you with an opportunity to create if:then statements for y…
Learn how to set-up custom confirmation messages to users who complete your Wufoo form. Include inputs from fields in your form, webpage redirects, and more with Wufoo’s confirmation options.

867 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now