<?php
/* Basic login using php and mysql
** nothing clever or complicated 
** Build mainly to demonstrate a login system
** that anyone can follow
** Requirements:
** PHP4+/PHP5+
** MySQL database
**
** */
/* functions.php
** This page is literally for the function that can
** be used in the script more than once or need to be
** called from different locations eg: login
** Also on this page are some basic congiuration items
** as this file is included in other pages
**
** session_start();
** www.php.net/session_start
** Initialize session data
**
** ini_set("display_errors", 2);
** ERROR_REPORTING(E_ALL);
** set up error reporting
** www.php.net/manual/en/function.error-reporting.php
** */
/* session handler
** Start session
** append with @ depending on server config */
@session_start();
/* error handler
** set error reporting level to 0 to show no error, 2 to show */
ini_set(“display_errors”, 2);
ERROR_REPORTING(E_ALL);
/* define some useful constants
** */
define(‘DB_USER’, ‘root’);
define(‘DB_PASS’, ‘peanuts2′);
define(‘DB_HOST’, ‘localhost’);
define(‘DB_BASE’, ’spf’);
/* database connection
** connect to your MySQL database
** using the constants above.
**
** */
mysql_connect(DB_HOST, DB_USER, DB_PASS);
mysql_select_db(DB_BASE);
/*————————————->
function: login form
** basic login form
** nothing fancy
————————————–*/
function loginForm() {
return ‘
<fieldset>
<legend>Please Login</legend>
<form name="loginForm" id="loginForm" method="post" action="">
<p><label for="usr">Username</label><br />
<input type="text" name="usr" value="" /></p>
<p><label for="psw">Password</label><br />
<input type="password" name="psw" value="" /></p>
<button type="submit" name="submit" value="SUBMIT">Login</button>
<input type="hidden" name="login" value="1">
</form>
</fieldset>
‘;
}
/*————————————->
function: login process
** process the login form
————————————–*/
function loginProcess($username, $password) {
/* never trust incoming data
** sanitise it and escape it
** basic cleaning
** mysql_real_escape_string (www.php.net/mysql_real_escape_string)
** trim (www.php.net/trim)
** */
$username = mysql_real_escape_string(trim($username));
/* using md5 for password security
** if you are using plain password - stop it!
** if you insist on using plain passwords then
** comment/hash the line below
** */
$password = md5($password);
/* Run the query to find a match in the database
** selecting only the basic fields and
** NOT using *
** also using LIMIT 1 as there should only be one
** result…..
** */
$sql = mysql_query(“
select
id
, username
, password
from
members
where
username = ‘$username’
and
password =’$password’
limit 1
“);
/* are there any rows returned
** from the login query?…..
** mysql_num_rows() returns the total number of rows
** found by the query
** So if there is a row
** */
if(mysql_num_rows($sql) > 0) {
/* assign a results handler to the
** returned fields.
** */
$rows = mysql_fetch_assoc($sql);
/* register some session variables
** based on the database values */
$_SESSION[‘usr_logged’] = 1;
$_SESSION[‘usr_id’] = $rows[‘id’];
$_SESSION[‘usr_name’] = $rows[‘username’];
/* now that the basic values are registered
** fire them off to the next page
** using header("Location: nextPage.php");
** */
header(“location: members.php”);
/* exit() as we dont want the
** script to carry on */
exit();
} else {
/* but what happens if there are no results
** returned from the database?
** Make a polite error message
** */
$errorMsg = ‘<p>Sorry. Your details couldnt be found</p>’;
/* and return that value to the script
** for displaying */
return $errorMsg;
}
}
/*————————————->
function: check auth
is the usr_logged variable present?
has the user logged in?
————————————–*/
function checkAuth() {
/* is the SESSION usr_logged variable
** anywhere? */
/* if not - redirect them to somewhere they can login
** */
if(!isset($_SESSION[‘usr_logged’])) {
header(“Location: index.php”);
exit();
return false;
} else {
/* return true - not really needed but keeps things tidy! */
return true;
}
}
/*————————————->
function: get member details
based on the usr_id session variable
————————————–*/
function getMemberDetails($id) {
/* query the database using the session usr_id
** variable. Also left join the information table
** to get the extra information
** */
$sql = mysql_query(“
select
members.id
, members.username
, members.password
, membersinfo.realname
from
members
left join
membersinfo
on
members.id=membersinfo.usr_id
where
members.id = $id
“);
/* for this tutorial there are no real details
** but if you had another table with more
** information such as address, postcode etc
** you can use the same theory
** */
/* assign a results handler as we did earlier
** to handle the returning information */
$rows = mysql_fetch_assoc($sql);
/* note that $rows is an ARRAY and as such holds the
** information like:
** $rows['usrname']
** $rows['password']
** etc… */
return $rows;
}
?>
SpikeZ | 
02 9th, 2009| 
Validation?