This is a very simple and secure login script. I will try to add as many comments as possible, to make it easier to
understand.
Lets start with the database.
Just make a new SQL file, and call it whatever you want. Paste this code:
CODE
CREATE TABLE `user` (
`id` int(4) unsigned NOT NULL auto_increment,
`username` varchar(32) NOT NULL,
`password` varchar(32) NOT NULL,
`level` int(4) default '1',
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=27 DEFAULT CHARSET=latin1;
`id` int(4) unsigned NOT NULL auto_increment,
`username` varchar(32) NOT NULL,
`password` varchar(32) NOT NULL,
`level` int(4) default '1',
PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=27 DEFAULT CHARSET=latin1;
Now we have made a table called 'user' in the SQL
We have made 4 colums.
Id, Username, Password, And Level.
Level is made for the Admin level.
Save the file, and import it into your database.
Now that part is done.
Now lets begin with the Index.phppage.
CODE
<?php
session_start();
require_once 'database.php';
if (isset($_SESSION['user'])){
echo "Welcome ".$_SESSION['user'];
?>
<form name="logout" method="post" action="logout.php">
<input type="submit" name="logout" id="logout" value="Logout">
</form>
<br /><form name="news" method="post" action="news.php">
<input type="submit" name="news" id="news" value="News">
</form>
<?php
}
elseif(isset($_SESSION['admin'])){
echo"Welcome ".$_SESSION['admin'];
echo"<br><br>You are logged in as an Admin";
?>
<form name="logout" method="post" action="logout.php">
<input type="submit" name="logout" id="logout" value="Logout">
</form>
<br /><form name="news" method="post" action="news.php">
<input type="submit" name="news" id="news" value="News">
</form>
<?php
}else{
?>
<form name="login_form" method="post" action="login2.php">
<label>
<input name="user" type="text" id="user">ID<br />
<input name="pass" type="password" id="pass">Password<br />
</label>
<input type="submit" name="login" id="login" value="Login">
</label>
</p>
</form>
<form name="Register" method="post" action="reg.php">
<input type="submit" name="register" id="register" value="Register">
</form><br />
<form name="news" method="post" action="news.php">
<input type="submit" name="news" id="news" value="News">
</form>
<?php
}
?>
session_start();
require_once 'database.php';
if (isset($_SESSION['user'])){
echo "Welcome ".$_SESSION['user'];
?>
<form name="logout" method="post" action="logout.php">
<input type="submit" name="logout" id="logout" value="Logout">
</form>
<br /><form name="news" method="post" action="news.php">
<input type="submit" name="news" id="news" value="News">
</form>
<?php
}
elseif(isset($_SESSION['admin'])){
echo"Welcome ".$_SESSION['admin'];
echo"<br><br>You are logged in as an Admin";
?>
<form name="logout" method="post" action="logout.php">
<input type="submit" name="logout" id="logout" value="Logout">
</form>
<br /><form name="news" method="post" action="news.php">
<input type="submit" name="news" id="news" value="News">
</form>
<?php
}else{
?>
<form name="login_form" method="post" action="login2.php">
<label>
<input name="user" type="text" id="user">ID<br />
<input name="pass" type="password" id="pass">Password<br />
</label>
<input type="submit" name="login" id="login" value="Login">
</label>
</p>
</form>
<form name="Register" method="post" action="reg.php">
<input type="submit" name="register" id="register" value="Register">
</form><br />
<form name="news" method="post" action="news.php">
<input type="submit" name="news" id="news" value="News">
</form>
<?php
}
?>
The First Thing We Do, Is Starting The Session
And we require the database file, so that the code can connect to the database
After that, we check if the 'user' session is active. If it is, the code will show u a text that says Welcome 'your name' and a logout button.
Then we check if the 'admin' session is active.
if it is, the code will write Welcome 'your name'.
But it will also write that you are logged in as an admin, and show you a logout button.
Then we check if there is a session at all
If there isn't, we'll just show the login form and some buttons.
Now Lets Begin with "Login2.php"
CODE
<?php
session_start();
require_once 'database.php';
# make a variable out of the username that was posted in the index-page.
$username = $_POST['user'];
# I am not sure what this thing makes.. but it has something with safety to do.
$escaped_username = mysql_real_escape_string($username);
# make a md5 password.
$md5_password = md5($_POST['pass']);
$queryN = mysql_query("select * from user where username = '".$username."' and password = '".$md5_password."' AND
level='1'");#This variable will check if the user is a level 1 user (Normal User)
$queryA = mysql_query("select * from user where username = '".$username."' and password = '".$md5_password."' AND
level='9'");#This variable will check if the user is a level 9 user (Admin User)
if(mysql_num_rows($queryN) == 1)
{
$resultN = mysql_fetch_assoc($queryN);
$_SESSION['user'] = $_POST['user'];
header("location:Index.php");
}
elseif(mysql_num_rows($queryA) == 1)
{
$resultA = mysql_fetch_assoc($queryA);
$_SESSION['admin'] = $_POST['user'];
header("location:index.php");
}
else{
echo "Wrong Username or Password";
}
?>
<form name="back" method="post" action="login.php">
<input type="submit" name="back" id="back" value="Back to Home">
session_start();
require_once 'database.php';
# make a variable out of the username that was posted in the index-page.
$username = $_POST['user'];
# I am not sure what this thing makes.. but it has something with safety to do.
$escaped_username = mysql_real_escape_string($username);
# make a md5 password.
$md5_password = md5($_POST['pass']);
$queryN = mysql_query("select * from user where username = '".$username."' and password = '".$md5_password."' AND
level='1'");#This variable will check if the user is a level 1 user (Normal User)
$queryA = mysql_query("select * from user where username = '".$username."' and password = '".$md5_password."' AND
level='9'");#This variable will check if the user is a level 9 user (Admin User)
if(mysql_num_rows($queryN) == 1)
{
$resultN = mysql_fetch_assoc($queryN);
$_SESSION['user'] = $_POST['user'];
header("location:Index.php");
}
elseif(mysql_num_rows($queryA) == 1)
{
$resultA = mysql_fetch_assoc($queryA);
$_SESSION['admin'] = $_POST['user'];
header("location:index.php");
}
else{
echo "Wrong Username or Password";
}
?>
<form name="back" method="post" action="login.php">
<input type="submit" name="back" id="back" value="Back to Home">
The First Thing We Do, Is Starting The Session
And we require the database file, so that the code can connect to the database
then we changing the $_POST['user'] into a variable.
Then we add some safety stuff.
Then the code will check, if the password, username was correct, and if the user level (admin or normal user) is level 1 (normal user).
if it is, the session 'user' will be created.
then, it will check if the level is level 9.
if it is, the session 'admin' will be created.
else if the username or password was incorrect, the code will write that the password or username was wrong, and show a "back to home" button.
I require the database.phpin both files. Here it is:
CODE
<?
$con = mysql_connect('localhost','mysql_username','mysql_password');
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db('databasename');
?>
$con = mysql_connect('localhost','mysql_username','mysql_password');
if (!$con)
{
die('Could not connect: ' . mysql_error());
}
mysql_select_db('databasename');
?>
the first thing we do here, is:
Open a connection to the mysql server.
If the connection failed, the code will write an error
then, we select the database we want to use.
And Ofc we want the logout.php script:
CODE
<?php
session_start();#This will start the session
session_unset(); #Session_unset and Session_destroy
session_destroy();#Will remove all sessions.
header("location:index.php");#This code will sen du back to the index page
?>
session_start();#This will start the session
session_unset(); #Session_unset and Session_destroy
session_destroy();#Will remove all sessions.
header("location:index.php");#This code will sen du back to the index page
?>
the first thing we do, is:
start the session.
Then, we remove all session data, with session_unset and session_destroy.
Then, we make the code send the user back to the "index page"
Tell me if i missed something. I would also like to know if you liked this tutorial =)
And if you find any errors, tell me, and ill fix them =)
//Feelay
