PHP login authenication

Question

<?php
 session_start();

 if($_GET["log"] == "out") {
 session_unset();
 session_destroy();
 echo "done";
 }
 $username = $_POST["user_login"];
 $password = $_POST["user_pass"];

 if($_SESSION['LoggedIn']) {
 $_SESSION['LoggedIn'] = 1;
 $_SESSION['user_login'] = $username;
 $_SESSION['user_pass'] = $password;
 echo $_SESSION['user_login']."<br />".$_SESSION['user_pass'];
 $ftp_server = "127.0.0.1";
 $gName = $_GET["name"];

 require_once "ftp.class.php";
 $ftp =& new FTP();

 if ($ftp->connect($ftp_server)) {
  if ($ftp->login($_SESSION['user_login'],$_SESSION['user_pass'])) {
   echo "\n".$ftp->sysType() . "\n";
   echo $ftp->pwd() . "\n";
   if($gName)
   $ftp->chdir("$gName");
   else
   $ftp->chdir("Downloads");
   print_nice($ftp->nlist());
   echo "\n";
  } else {
   echo "login failed: ";
   print_r($ftp->error_no);
   print_r($ftp->error_msg);
  }
  $ftp->disconnect();
  print_r($ftp->lastLines);
 } else {
  echo "connection failed: ";
  print_r($ftp->error_no);
  print_r($ftp->error_msg);
 }
}
else
{
?>
<form method="POST" style="margin: 20px 10px; padding: 15px 25px 25px 20px; border: 1px solid #EEE8E1; background: #FAF7F5;"> 
    <p>Login Form</p>
   <?php echo $_SESSION['user_login']."<br />".$_SESSION['user_pass']; ?>
    <p> 
     <label for="name">Username</label><br />
     <input id="name" name="user_login" value="" type="text" tabindex="97" />
    </p>

    <p>
     <label for="email">Password</label><br />
     <input id="email" name="user_pass" value="" type="password" tabindex="98" />
    </p>

    <p><input type="checkbox" value="1" name="rmb"> Remember Me <br /><a href="#">Forgot Password</a><br /><a href="index.php?page=register">Don't have an Account?</a></p>

    <p class="no-border">
    <input class="button" name="submit" type="submit" value="Submit" tabindex="14" />
           <input class="button" type="reset" value="Reset" tabindex="15" /> 
    </p>
<?php
}
?>

Answer 1

Did you add a check for if the user was already logged in?

if (isset($_POST['submit']) || (isset($_SESSION['LoggedIn']) && $_SESSION['LoggedIn']))

Answer 2

Change first line with this:

if (isset($_POST['submit']) || (isset($_SESSION['user_login']) && $_SESSION['user_login'] != '') 
{

Answer 3

Maybe you can first check whether it is login or not:

if(isset($_SESSION['LoggedIn']) &&$_SESSION['LoggedIn']==1)
{
   // proceed to do the login stuff
}
else if (isset($_POST['submit'])) 
{
    $username = $_POST["user_login"];
    $password = $_POST["user_pass"];

    $_SESSION['LoggedIn'] = 1;
    $_SESSION['user_login'] = $username;
    $_SESSION['user_pass'] = $password;
    // some coding about ftp login
}
else
{
}

Answer 4

I dont use sessions but you can use like this

if (isset($_POST['submit']))  {
     //....
}

if($_SESSION['LoggedIn']) {
    //actual coding
}

Answer 5

Try

if ((isset($_POST['submit'])) OR ($_SESSION['LoggedIn'] == 1)) {

  // Logged in stuff...

}

Answer 6

I tend to do a check to see if there's a logged in session present then redirect to the main content for the user (ie. page.php) or show you the login box if you need to log in, I have a similar thing (only redirect to login.php or show content) for all other log in requiring pages as an include on so that it constantly checks that you're meant to be logged in or not and send you to login if you need to, stops you going to page.php and seeing nothing.

Answer 7

You need to call session_start(); on the first line of each page.