PHP: User Login System / Check if User has acess to a page

Question

Hello guys. This is a bit noob question but.. Its happens sometimes to everybody.

I never worked with $_SESSION so once i need a login system i've used Dreamweaver to do one for me.

I have a page where he asks for user name and password. And if loggin successful its goes to other page. Else it says in the login page.

The problem its that the Login, system that once worked, now isn't working. Because the he stays in the login page. And i've done a "echo $_SESSION['MM_Username'];"

And nothing returned. So i think it means that i isn't creating the cookie for access??

Right? I think that a echo on the session displays something.

Well can i have some help guys? Maybe a simple login system. Not a Dreamweaver loggin.

I will post the user login code in the login page.

// *** Validate request to login to this site.
if (!isset($_SESSION)) {
  session_start();
}

$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($_GET['accesscheck'])) {
  $_SESSION['PrevUrl'] = $_GET['accesscheck'];
}

if (isset($_POST['username'])) {
  $loginUsername=$_POST['username'];
  $password=$_POST['passe'];
  $MM_fldUserAuthorization = "power";
  $MM_redirectLoginSuccess = WWW."/administrador";
  $MM_redirectLoginFailed = WWW."/login";
  $MM_redirecttoReferrer = false;
  mysql_select_db($database_dbconnect, $dbconnect);

  $LoginRS__query=sprintf("SELECT username, passwd, power FROM `user` WHERE username=%s AND passwd=%s",
  GetSQLValueString($loginUsername, "text"), GetSQLValueString($password, "text")); 

  $LoginRS = mysql_query($LoginRS__query, $dbconnect) or die(mysql_error());
  $loginFoundUser = mysql_num_rows($LoginRS);
  if ($loginFoundUser) {

    $loginStrGroup  = mysql_result($LoginRS,0,'power');

    //declare two session variables and assign them
    $_SESSION['MM_Username'] = $loginUsername;
    $_SESSION['MM_UserGroup'] = $loginStrGroup;       

    if (isset($_SESSION['PrevUrl']) && false) {
      $MM_redirectLoginSuccess = $_SESSION['PrevUrl'];  
    }
    header("Location: " . $MM_redirectLoginSuccess );
  }
  else {
    header("Location: ". $MM_redirectLoginFailed );
  }
}

I worked. it the changes you see there that are in the $MM_redirectLoginSuccess and $MM_redirectLoginFailed and nothing changed in the database.

If its tired some. Just post a simple login user code, i've found some but, not good ones. That i do the rest.

Do you know whats its wierd? It worked. I saved, then turn off computer, then when i came back didn't worked.

Thanks again.

Answer 1

I take it your database is running?

Otherwise just start going through the code, when debugging variables try using var_dump($var) that way you'll see the type (specifically if it's null) of the variable you're debugging.

$LoginRS__query -- echo this, and see what query is being generated. Run that through you're database yourself and see what happens.

header("Location: " . $MM_redirectLoginSuccess ); -- Keep in mind that if any data has been sent ( variables echoed etc.) this wont be able to redirect the user as the headers will already have been sent.

Answer 2

Thanks for the help. Its as some kind of conflict, not sure which one, i didn't had much time to spend on that, i had to make it work quickly.

I've placed this code, the first code i've posted contained a user power check, and i wasn't using it because i could only use it once the admin panel was finished.

I removed that part and turned out ok.

// *** Validate request to login to this site.
if (!isset($_SESSION)) {
  session_start();
}

$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($_GET['accesscheck'])) {
  $_SESSION['PrevUrl'] = $_GET['accesscheck'];
}

if (isset($_POST['username'])) {
  $loginUsername=$_POST['username'];
  $password=$_POST['passe'];
  $MM_fldUserAuthorization = "";
  $MM_redirectLoginSuccess = WWW."/administrador";
  $MM_redirectLoginFailed = WWW."/login";
  $MM_redirecttoReferrer = false;
  mysql_select_db($database_conn, $dbconnect);

  $LoginRS__query=sprintf("SELECT username, passwd FROM `user` WHERE username=%s AND passwd=%s",
    GetSQLValueString($loginUsername, "text"), GetSQLValueString($password, "text")); 

  $LoginRS = mysql_query($LoginRS__query, $dbconnect) or die(mysql_error());
  $loginFoundUser = mysql_num_rows($LoginRS);
  if ($loginFoundUser) {
     $loginStrGroup = "";

    //declare two session variables and assign them
    $_SESSION['MM_Username'] = $loginUsername;
    $_SESSION['MM_UserGroup'] = $loginStrGroup;       

    if (isset($_SESSION['PrevUrl']) && false) {
      $MM_redirectLoginSuccess = $_SESSION['PrevUrl'];  
    }
    header("Location: " . $MM_redirectLoginSuccess );
  }
  else {
    header("Location: ". $MM_redirectLoginFailed );
  }
}

Now i only gotta do the power check system by my self, but that wont be a problem.

Thanks.