Question

Let say i’ve the follow files [index.php / admin.php / access.php]

1) File index.php is with login form

<form method="post" name="login" id="login" action="check.php">
Username : <input name="loginid" id="loginid" type="text">
Password : <input name="password" id="password" type="password">
</form>

it should send entries (user,pass) to file check.php so that check if the username and password is correct or not and i’d like to use this way

2) File check.php

At file check.php it should do the following function
– Check if the user,pass is correct
– If correct then create cookies or somehow
– If wrong or empty send me back to login.php

Let say here are my db informations

$sql= "select * from settings where admuser='$loginid' and admpass='$password'";
$result = mysql_query($sql) or die("query failed: $sql");

3) File access.php

This file should compare if i’ve logged or not so that if not send me back to login.php

4) File admin.php [ needs access.php to check if i’m logged or not]

<?php
include('access.php');
echo "balah blah blah";
?>

So can anyone please write this example as simple as possible

That example will helps me a lot to study it as study case
cause i’ve tried before but failed so i really do not know why and here was my last question Login not working after php updated but i found i need complate study case code that working.

thank you for helping

Answer 1

You can set a session on the filecheck.php page by using a simple if() loop.

$loginid = mysql_real_escape_string(strip_tags($_POST['loginid']));
$loginpass = mysql_real_escape_string(strip_tags($_POST['loginpass']));
$sql = mysql_query("SELECT loginid, loginpass FROM settings WHERE loginid='$loginid' AND loginpass='$loginpass'");
if(mysql_num_rows($sql) != 0){
      //create $_SESSION
   session_start();
   $_SESSION['id'] = $loginid;
setcookie("id","id",time()+3600*24*30);
}else{
         //the user doesn't match any of the ones in the database. Tell them to try another login}

To keep the session active through the website just call the `session_start(); statement at the top of every webpage.
By getting a match of username and password with the database and creating a $_SESSION[‘username’]; that only you could have created by using the user and password you have effectively logged in.

To logout out you can use the session_destroy(); statement.

One think to note about sessions is that the session will end when you close the webpage. The ideal login system will incorporate session and cookies. So that you can set a cookie as well as session when you login. When you close the webpage and later return to it the cookie will still exist, you can use the cookie to recreate the session. This stops the need for users to constantly have to login every time they return to the page.

To reset the session['id'] you could do something like:

if(!isset($_SESSION['id'])){
   if(isset($_COOKIE['id'])){
      $_SESSION['id'] = $_COOKIE['id'];
       echo '<p>Welcome back ' . $_SESSION['id'] . '</p>';
    }
}elseif(isset($_SESSION['id'])){
      echo '<p>Welcome back ' . $_SESSION['id'] . '</p>';
}else{
     echo '<p>Please login</p>';
}