Question

I’m learning PHP and need a little help if possible.

I know I’m missing something simple her but can’t figure it out, I have got the following piece of PHP to transfer users from a page they have just entered their username and password on, to the next page of the site called homepage.php. This script needs to generate a session name but I’m unsure were to put it.

I then need a small piece of PHP to then check the user name and password is correct before loading the page for the user to see, does this make sense and can anyone help?

<?php 
$host="localhost"; // Host name
$username="root"; // username
$password=""; // password
$db_name="gotswapuser"; // Database name
$tbl_name="users"; // Table name


mysql_connect("$host", "$username", "$password");
mysql_select_db("$db_name");


$myusername=mysql_real_escape_string($_POST['myusername']);
$mypassword=mysql_real_escape_string($_POST['mypassword']);

$sql="SELECT * FROM $tbl_name WHERE name='$myusername' and password='$mypassword'";
$result=mysql_query($sql);

$count=mysql_num_rows($result);

if($count==1){
    header("location:homepage.php");
} else {
  header("location:subscriptionpage.php");
}
?>

Answer 1

You should use PDO for database access, not mysql. Mysql is in the process of being deprecated, and is not good practice.

To answer your question, however:

Using the code that you have, you just want to add a few lines on the “successful” login:

 if($count==1) {  
     session_start();  
     $_SESSION["logged_in"] = 1;  
     header("location:homepage.php");  
 } else {  
   header("location:subscriptionpage.php");  
 }  

Then, on the page where the user should be logged in, do something like so:

 session_start();
 if ( ! isset($_SESSION["logged_in"]) || ! $_SESSION["logged_in"]) {
      header("location:signin.php");
      exit;
 }