Question

I’m learning PHP and am having issues getting the following code to work properly. Basically the login page displays correctly, and without errors and the variables appear to be assigned correctly, but upon page reload I just get the same login form, it appears the data has either not been passed and is therefore not being acted upon.

I’ve looked at the code over and over again and even tried a different method (produced same result!) so it’d be lovely if someone helpful could spend a minute and point me in the right direction.

One thing that might be an issue is my server is running 5.3.9 and the book I’m working from is PHP5 so maybe some of the function I’m calling have been deprecated. Which would be a pain…

    <?php 
include_once "common_db.inc";
$register_script = "register.php";

if (!isset ($userid)) {
    login_form();
    exit;
} else {
    session_start();
    session_register ("userid", "userpassword");
    $username = auth_user ($_POST['userid'], $_POST['userpassword']);

    if (!$username) {
        $PHP_SELF = $_SERVER['PHP_SELF'];
        session_unregister ("userid");
        session_unregister ("userpassword");
        echo "Failed to authorize. " .
                "Enter a valid DX number and password." . 
                "Click the link below to try again.<br>\n";
        echo "<a href=\"$PHP_SELF\">login</a><br>";
        echo "Click the following link to register<br>\n";
        echo "<a href=\"$register_script\">Register</a>";
        exit;
    } else {
        echo "Welcome, $username!";
    }
}

function login_form() 
    {
        global $PHP_SELF;
?>

<form method="post" action="<?php echo "$PHP_SELF"; ?>">
    <div align="center"><center>
        <h3>Please login to use the page you requested</h3>
        <table width="200" cellpadding="5">
            <tr>
            <th width="18%" align="right" nowrap>id</th>
            <td width="82%" nowrap>
                <input type="text" name="userid" />
            </td>
            </tr>
            <tr>
            <th width="18%" align="right" nowrap>password</th>
            <td width="82%" nowrap>
                <input type="password" name="userpassword" />
            </td>
            </tr>
            <tr>
            <td colspan="2" width="100%" nowrap>
                <input type="submit" value="login" name="Submit" />
            </td>
            </tr>
            </table>
            </center>
            </div>
</form>

<?php
    }
    function auth_user($userid, $userpassword)
    {
        global $dbname, $user_tablename;
        $link_id = db_connect($dbname);
        $query = "SELECT DXNumber FROM $user_tablename WHERE DXNumber = '$userid'
                                  AND userpassword = password ('$userpassword')";
        $result = mysql_query ($query);

        if (!mysql_num_rows($result)){
            return 0;
        }else{
            $query_data = mysql_fetch_row($results);
            return $query_data[0];
        }
    }
?>

Answer 1

You’re not defining $userid or checking if the form has been submitted. Try:

if (!isset($_POST['userid'])) {

Your query in your auth_user function needs to look like this:

$query = "SELECT DXNumber FROM $user_tablename WHERE DXNumber = '$userid' AND userpassword ='" . $userpassword."'";

Also, you’re open to sql injection. You should look into using PDO and prevent it.