473,503 Members | 1,813 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Login Logout and Session Expire...

Any Suggestions for an Authentication System ...
Do you have any Links to suggest ?
My current Authentication works ok but it has a major BUG !!!

BUG:
If I use the same Authentication mechanism in Two Different Websites and I
login in one of the two... Then I can change the URL to the other website
and it will log me in as the user of the other Website.

Anyway... I knew when I was writing that is not going to be perfect... but
maybe you can show me the door to getting it fixed.

What I actually do is this simple thing:
if (!isset($_SESSION['user_id'])) echo '<a href="login.php">Login</a>';

YES I know it doesn't even go close to an Authentication Mechanism... But it
does its job for a begginner...

Every page I call has a header.php and a footer.php so I just have to make
the Authentication in the Header...

Suggestions ..............
Thanks Angelos.
Jul 17 '05 #1
7 5174
I use this on my auth. site, maybe this might help you

<?php
// This Function authenticates to make sure that the user has entered a
valid
// username and password, and then grabs the user's info
function authenticate($user, $pass, $minRank) {
global $diplomacy, $log, $members, $news, $status, $templates,
$useronline, $images;
global $fontString;
global $myrow;
global $recruit;
$result = @mysql_query("SELECT * FROM $members WHERE username =
\"$user\"");
$myrow = mysql_fetch_array($result);
if($myrow != NULL)
extract($myrow);

// If the username matches the result in the mysql query and the
password is correct
// return the rank of the user.
if($user == $username && $pass == $password and $username != NULL) {
if($disable != 1) {
if($rank >= $minRank) {
return 1;
}
else {
echo("
$fontString
You are not high enough rank. <center><br><font size=2
face=verdana><b><a href=main.php>Click Here to return to
console</font></b></center>
");
}
}
if($disable == 1) {
$result = @mysql_query("SELECT * FROM $members WHERE username =
\"$user\"");
$row = mysql_fetch_array($result);
extract($row);
echo("
$fontString
You have been disabled.<br><br>
<font color=#1C86EE size=1 face=verdana>$disabled</font>
");
}
}
else {
if(!$user) {

echo("
$fontString

<b><font color=red>Invalid Username or Password</font></b><br><br>
<font color=red>Note:</font> Username and Password are CaSe Sensitive.
<br>
If you are unsure of how your name is spelled you should check the
members page.<br>
If you had forgotten your password ask one of the generals to retrieve
it for you<p>
<form action=main.php method=post>
<FONT color=#76A5D5 size=2>
<b>Username:<b> <INPUT style=\"border:1px solid
#76A5D5; WIDTH: 115px; HEIGHT: 20px; BACKGROUND-COLOR: #ffffff\"
type=username name=username size=\"20\"><br>
<b>Password:</b>&nbsp; <INPUT style=\"border:1px solid #76A5D5;
WIDTH: 115px; HEIGHT: 20px; BACKGROUND-COLOR: #ffffff\" type=password
name=password size=\"20\"><br><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs p;&nbsp;&nbsp;&nbsp;&nbsp;<INPUT
style=\"border:1px solid #1874CD; WIDTH: 115px; HEIGHT: 20px;
BACKGROUND-COLOR: #76A5D5; float:center\" type=submit value=Login>

");

}
else {
echo("
$fontString
<b><font color=red>Invalid Username or Password</font></b><br><br>
<font color=red>Note:</font> Username and Password are CaSe Sensitive.
<br>
If you are unsure of how your name is spelled you should check the
members page.<br>
If you had forgotten your password ask one of the generals to retrieve
it for you
<p>
<form action=main.php method=post>
<FONT color=#76A5D5 size=2>
<b>Username:<b> <INPUT style=\"border:1px solid
#76A5D5; WIDTH: 115px; HEIGHT: 20px; BACKGROUND-COLOR: #ffffff\"
type=username name=username size=\"20\"><br>
<b>Password:</b>&nbsp; <INPUT style=\"border:1px solid #76A5D5;
WIDTH: 115px; HEIGHT: 20px; BACKGROUND-COLOR: #ffffff\" type=password
name=password size=\"20\"><br><br>
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs p;&nbsp;&nbsp;&nbsp;&nbsp;<INPUT
style=\"border:1px solid #1874CD; WIDTH: 115px; HEIGHT: 20px;
BACKGROUND-COLOR: #76A5D5; float:center\" type=submit value=Login>
");
}
}

}
?>

This is used to grab the username & password from mysql and then lets
the member view w/e page this function is on like for example if i only
want a member of a rank 26 (admin) to view a page called ip.php that
views the name & ips of each member then i would put the following on
that page.

<?php
$username = $usercook;
$password = $passcook;
setcookie("usercook", $username);
setcookie("passcook", $password);

require("functions.php");

if(authenticate($username, $password, 26)) {
Ip();
}
?>

Maybe this will help you.. if you want the full code then email me and
ill help you out...

Jul 17 '05 #2
> Maybe this will help you.. if you want the full code then email me and
ill help you out...


First of all thank you for your reply,
This code is better than nothing so it will be a bit helpfull. Although I
noticed that you use globals... and I don't know how that is going to affect
my program that doesn't use Globals... Also I don't use Cookies....

So I will wait to see if I have any other suggestions and then I will have a
better look in your Code bit ...
Thanks Again Craft !!!
Jul 17 '05 #3
No probelm.. sessions are tricky.. but i use cookies b/c you can set
how long til they expire.. so if the user times out (ie: closes the
page for how ever long i set it) they logged out.. but yea no problem..

You could try and use different variables for each site..

IE: $username & $password for one site

then $user & $pass for the other so then you wont be logged in one
both.. just and idea it might work..

Jul 17 '05 #4
You can register another variable like

$_SESSION['site']=$_SERVER['SERVER_NAME'];

this will register the sites adress (www.site.com) to session than you
can compare the sites after login while checking
(!isset($_SESSION['user_id']))

if (!isset($_SESSION['user_id']) or
(isset($_SESSION['site'])!=$_SERVER['SERVER_NAME']))

If you are working on localhost its better you to use
$site=explode("/",$_SERVER['PHP_SELF']);
$_SESSION['site']=$site[1];

to get the directory name of your site insted of
$_SERVER['SERVER_NAME'].

Jul 17 '05 #5
> You could try and use different variables for each site..

IE: $username & $password for one site

then $user & $pass for the other so then you wont be logged in one
both.. just and idea it might work..


Yeah That is an OPTION ... not the Best Though but you can get away with the
problem I have at the moment. Thanks Again !!! ;-)
Jul 17 '05 #6
> if (!isset($_SESSION['user_id']) or
(isset($_SESSION['site'])!=$_SERVER['SERVER_NAME']))

If you are working on localhost its better you to use
$site=explode("/",$_SERVER['PHP_SELF']);
$_SESSION['site']=$site[1];

to get the directory name of your site insted of
$_SERVER['SERVER_NAME'].


Wow... That was something I haven't thought ... Great !!!
This will definetely do my Job ;-)
Cheers Botan Guner !!!
Jul 17 '05 #7
I actually had a problem with logging into both my sites when I was
developing my open source CMS (ProtonCMS http://protoncms.gotdns.com). Here
is what I did to stop it, and I'll show you how allow it also.

on every page put (in your case header.php).

<other session stuff here>
session_name(SITE_SESS_NAME);
session_start();

If SITE_SESS_NAME is different, then you cannot go across domains that are
on one machine, however if they are the same, then it works like a charm. I
hope this helps.
Jul 17 '05 #8

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

3
2835
by: koolyio | last post by:
Hey, could you please tell me what is wrong with my login script. I just started learning php. CODE: login.php <? session_start(); header("Cache-Control: private"); ?>
0
1657
by: konsu | last post by:
hello, i need to implement a secure web site in php and mysql but i have just started looking at php a few days ago, and i would appreciate any advice from the experts. the site, as i said,...
3
3925
by: Joey Lee | last post by:
Hi, Does anyone knows how to control user login that only a single userid can login at a time? Thanks Joey
2
2853
by: Shakun | last post by:
Hi All, This is my 1st posting to this group. Can any1 help me with the "Remember Me" which is there in a login form. Im pasting the code below. Im not able to set a cookie.. Thanks, Shakun...
4
4058
tolkienarda
by: tolkienarda | last post by:
Hi all I work for a small webdesign company and we have remote hosting. i built a mysql database with phpmyadmin on the server. i then downloaded and modified a php login page. i am continuing to...
1
3313
by: Kandiman | last post by:
Hiya, i made a asp page, and one of my divs (as a include) is as below. the problem is if the main page is resubmitted, i get logged out again?... heres the code.. i think its on the value=true...
1
3279
by: Adrock952 | last post by:
I have a link on my site which obviously says "Login" where users log in. I would like that link to be changed to "Logout" when the user has successfully logged in and the session has been created...
10
4794
by: DavidPr | last post by:
When I logout as one user and log in under a different user, it opens with the last user's information. User 1 - Unsername: Davey Jones User 2 - Unsername: David Smith I log out from Davey...
5
53925
by: vinodsk101 | last post by:
Hi all, I am developing a web application. I am using Servlet and JSP. After logout the user should not able to see the previous pages and page should navigate to loginpage.jsp. I have used...
0
7086
by: Hystou | last post by:
Most computers default to English, but sometimes we require a different language, especially when relocating. Forgot to request a specific language before your computer shipped? No problem! You can...
0
7280
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers,...
0
7330
jinu1996
by: jinu1996 | last post by:
In today's digital age, having a compelling online presence is paramount for businesses aiming to thrive in a competitive landscape. At the heart of this digital strategy lies an intricately woven...
0
7460
tracyyun
by: tracyyun | last post by:
Dear forum friends, With the development of smart home technology, a variety of wireless communication protocols have appeared on the market, such as Zigbee, Z-Wave, Wi-Fi, Bluetooth, etc. Each...
1
5014
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 1 May 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome a new...
0
3167
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The...
0
3154
by: adsilva | last post by:
A Windows Forms form does not have the event Unload, like VB6. What one acts like?
0
1512
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated ...
0
380
bsmnconsultancy
by: bsmnconsultancy | last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.