PHP Password And Redirect Script...

[eragon]

Hello peoples. I have a voting system on my web site that uses 3 files. The first file is vote.php and has the vote form on it. This file passes the information to confirmation.php which has a thank you message on it. This file passes the information to vote.txt, which stores the information for me to tally up later. What i described to you works great, but theres one problem. I want users to have to log in first, using a login form on voteli.php. I have login scripts, but theyre not even close to secure. I want it so if they get smart and go directly to vote.php it will kick them back to voteli.php unless varaible $login is true. I would also like the login script to pass the username through all the pages as varaible $user. Then i wil echo the varaible in the page so it has a greeting message. I will also use this name in the results page to cancel out any double votes by the same user. I will provide the source codes i made using my small knowledge of php, and i will hope that you suggest some fixes.

vote.php:
[PHP]<?php
$login = $_GET['login'];
$user = $_GET['username']

if(!$login)
{
window.location=('voteli.htm');
}

else
{
echo('Hello, '$user'!');
}
?>[/PHP]The code above is the one i wrote to bounce the users back to the login page if they have not logged in. It also prints the hello message at the top of the vote page.

[HTML]
<?php echo('Voting as: '$user'.') ?>
<form name="poll" action="confirmation.php" method="get">
Lorem ipsum sit dolor amet?
<select name="q1">
<option value="q1a">Lorem</option>
<option value="q1b">Ipsum</option>
<option value="q1c">Dolor</option>
<option value="q1d">Amet</option>
</select>
</form>[/HTML]
The code above is the simplified vote form.

confirmation.php
[HTML]<?php
$q1 = $_GET['q1'];
//See notes below for username problem.

$filename = "vote.txt";
$content1 = "$v1\n";
$fp = fopen($filename, "a");
$fw = fwrite( $fp, $content1 );
fclose( $fp );

?>[/HTML]Tha code above writes to the text file. I need a way to get the username passed from vote.php to confirmation.php so i can display the name in the thanks message.

[HTML]Thank you for voting, <?php echo($user); ?>! Your vote will count. <br />
<!-- A logout link would be nice -->Click Here to log out.[/HTML]

[Motoma]

First: Use POST instead of GET as your FORM METHOD. Check the Referer to ensure that the POST came from your server.
Second: You cannot do window.location as that is Javascript langauge for sending a user places. Instead, you want to use header('Location: voteli.htm');
Third: You will most likely want to check that the POST array is set before you go assigning their values to other variables.
Fourth: Have you performed any credential checking? You have not compared user and login to anything to ensure that these are the correct credentials. You should also ensure that the data coming from your select box is valid.

I am sure there is more, but this is a start. If you really wanted to be fancy, you could combine the whole set into one PHP page.

[eragon]

ill use post. i know window.location is javascript i was just putting that there cause i knew somebody would suggest a change, and thank you for that. and ill doo all that other stuff and see. also, i need the whole login script. i dont have one that works with php.

[eragon]

ok, i know what i need. i need a login script that passes the following information to the next page ONLY if the user and pass is correct:

Input to script:

Username: Admin
Password: password

Output to vote.php:

$login=('true')
$user=('admin')

Possible Form:
[HTML]<form method="post" action="confirmation.php">
Username:<input name="user" type="text"><br />
Password:<input name="pass" type="password">
</form>[/HTML]

What I need:
I need a php script to work with the above form to validate the usernames and passwords when the form is submitted. If the information does not check out to be valid, it should put "Invalid Username or Password" in a DIV tag. i also need the correct syntax for the below statements:
[PHP]<?php
if $login=('true')
{
//this would bypass the script (end, exit, , or goto... ?)
}
else
{
header('Location: voteli.htm');
}
?>[/PHP]

If you need more information just ask.

[eragon]

Also, if i was to incoorperate all this into a MySQL database (usernames, passwords, and what that user voted for) i would need another script. Could somebody please suggest sometihng to me??

[eragon]

one wheel said to the other, "Ill see you around, ay?"

[Motoma]

<html>
<head><title>Motoma Rocks My Homework</title></head>
<body>
<?php
 
session_start();
 
if(!isset($_SESSION['userid']))
{
  if(!isset($_POST['username']) || !isset($_POST['password']))
  {
    echo '<form method="POST"><input type="text" name="username" /><input type="password" name="password" /><input type="submit" /></form>';
  }
  else if(authenticate($_POST['username'], $_POST['password']))
  {
    $_SESSION['userid'] = $_POST['username'];
    header('Location: thispage.php');
  }
}
else
{
  if(!isset($_POST['data1']) || !isset($_POST['data2'])) //fill with all question data objects
  {
    echo '<form method="POST"><select name="data1"><option value="q1a">Lorem</option><option value="q1b">Ipsum</option>
</select><select name="data2"><option value="q1a">Lorem</option><option value="q1b">Ipsum</option></select></form>';
  }
  else
  {
    AppendDataToFile($_SESSION['userid'], $_POST['data1'], $_POST['data2']);
    echo 'Thank you for your submission '.$_SESSION['userid'].'!';
  }
}
 
function authenticate($u, $p)
{
  if($u == 'admin' && $p == 'password') return true; //replace with the actual authentication.
  return false;
}
?>
</body>
</html>
 

[Motoma]

Also, if i was to incoorperate all this into a MySQL database (usernames, passwords, and what that user voted for) i would need another script. Could somebody please suggest sometihng to me??

If you take a look at the PHP Articles (under the Articles Header) you will see a tutorial labeled " Creating a Data Abstraction Layer in PHP" which would be a great start.

[eragon]

thanks

..............

[eragon]

oh, ya, and i had vote.php seperate because of one little problem... the voting page has:
A) 15 questions
B) Is made up of pictures, tables, divs, and more...
C) If i was to tell a php script to echo the WHOLE source code, php will jump out and bite me.
4) I think i can customise the script. im a very fast learner.

[Motoma]

Well, good luck. Come back if you have more questions.

[eragon]

ok, for multiple users and passwords, would i duplicate the line like this:

[PHP]{
if($u == 'admin' && $p == 'password') return true;
if($u == 'admin2' && $p == 'authentication') return true;
if($u == 'admin3' && $p == 'fish') return true;

return false;
}[/PHP]

[eragon]

Error, error! Red alert! Emergency! Ah-wooo-ga!

what caused this? (using the exact code you sent me)

Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at /www/110mb.com/p/l/a/y/e/r/-/k/player-killer-clan/htdocs/votealt.php:4) in /www/110mb.com/p/l/a/y/e/r/-/k/player-killer-clan/htdocs/votealt.php on line 6
 
Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /www/110mb.com/p/l/a/y/e/r/-/k/player-killer-clan/htdocs/votealt.php:4) in /www/110mb.com/p/l/a/y/e/r/-/k/player-killer-clan/htdocs/votealt.php on line 6

[eragon]

Well, good luck. Come back if you have more questions.

^^^^^ see above post ^^^^^

[Motoma]

Bah, you will have to put session_start() before any HTML.

[eragon]

you didnt tell me that... lol

so if i change your script to look like so:

[PHP]<?php

session_start();

?>
<html>
<head><title>Motoma Rocks My Homework</title></head>
<body>
<?php


if(!isset($_SESSION['userid']))
{
if(!isset($_POST['username']) || !isset($_POST['password']))
{
echo '<form method="POST"><input type="text" name="username" /><input type="password" name="password" /><input type="submit" /></form>';
}
else if(authenticate($_POST['username'], $_POST['password']))
{
$_SESSION['userid'] = $_POST['username'];
header('Location: thispage.php');
}
}
else
{
if(!isset($_POST['data1']) || !isset($_POST['data2'])) //fill with all question data objects
{
echo '<form method="POST"><select name="data1"><option value="q1a">Lorem</option><option value="q1b">Ipsum</option>
</select><select name="data2"><option value="q1a">Lorem</option><option value="q1b">Ipsum</option></select></form>';
}
else
{
AppendDataToFile($_SESSION['userid'], $_POST['data1'], $_POST['data2']);
echo 'Thank you for your submission '.$_SESSION['userid'].'!';
}
}

function authenticate($u, $p)
{
if($u == 'admin' && $p == 'password') return true; //replace with the actual authentication.
return false;
}
?>
</body>
</html>[/PHP]

i just might get it working?

[eragon]

could you split the script up into the different pages please? like i origionally intended... because the actual file requires this. please??

[Motoma]

Why don't you just split it up? All of the pieces are there, just take from the example I gave each section of the system. PHP.net is a great resource as well.

[eragon]

hmmm.... html is my second language. php is foreign (sp?). ill see what i can do and ill post it here.

[Motoma]

hmmm.... html is my second language. php is foreign (sp?). ill see what i can do and ill post it here.

Well, you know what they say about languages: the first seven are the hardest to learn.

[eragon]

Well, you know what they say about languages: the first seven are the hardest to learn.

i only know 6: English, Spanish, Japenese, HTML, Javascript, and CSS.

most of them i only know bits and pieces...

ayways, back to the subject:

i modified it a little so that it looks the way i want it to. theres still one problem. if i split it into pages, i cant pass the varaibles unless i put them into the value of a hidden form feild. so ill leave it on one page. i might just do includes with inc files. but now i have a script, a page, a style sheet, and i ran out of doughnuts. how do i get the style sheet linked properly with PHP? putting it into the head of this page is useless... it dosnt read untill... wait... at the beginning of the script i tell it to echo my head information. at the end i tell it to echo my foot information. well dont, thanks man! heres my finished script, and my stupid little error:

Error upon voting:

Fatal error: Call to undefined function appenddatatofile() in /www/110mb.com/p/l/a/y/e/r/-/k/player-killer-clan/htdocs/votealt.php on line 53

And my code:
[PHP]<?php

session_start();

echo('<html><head><title>Motoma Rocks My Homework</title><link href="basic-1.css" rel="stylesheet" type="text/css"><link href="css/poll.css" rel="stylesheet" type="text/css"></head><body><div id="body">') ;

if(!isset($_SESSION['userid']))
{
if(!isset($_POST['username']) || !isset($_POST['password']))
{
echo '<div class="frame wide_e">
<span style="float:right;"><a href="index.php">Main Page</a></span><div>You are not logged in.</div>
</div> <div style="text-align:center;">
<div class="polltitlebground">
<div class="polltitleframe">
<b>Poll Page</b><br>
<a href="index.php">Main Menu</a>
</div>
</div>
</div><div class="frame wide_e">
<center><b>Please log in to access this feature.</b><br />
<form method="post">Username:<input type="text" name="username" /><br />
Password:<input type="password" name="password" /><br />
<input type="submit" value="Login" /></form></center></div>';
}
else if(authenticate($_POST['username'], $_POST['password']))
{
$_SESSION['userid'] = $_POST['username'];
header('Location: thispage.php');
}
}
else
{
if(!isset($_POST['data1']) || !isset($_POST['data2'])) //fill with all question data objects
{
echo '<div class="frame wide_e">
<span style="float:right;"><a href="voteli.php">Main Page (Logout)</a></span><div>You are logged in as <span style="color:#FFBB22">'.$_SESSION['userid'].'.</span></div>
</div> <div style="text-align:center;">
<div class="polltitlebground">
<div class="polltitleframe">
<b>Poll Page</b><br>
<a href="index.php">Main Menu</a>
</div>
</div>
</div><div class="frame wide_e">
<center><b>Place write your responses below:</b><br />
<form method="post">Lorem?<input type="text" name="data1" /><br />
Ipsum?<input type="text" name="data2" /><br />
<input type="submit" value="Vote!" /></form></center></div>';
}
else
{
AppendDataToFile($_SESSION['userid'], $_POST['data1'], $_POST['data2']);
echo '<div class="frame wide_e">
<span style="float:right;"><a href="voteli.php">Main Page (Logout)</a></span><div>You are logged in as <span style="color:#FFBB22">'.$_SESSION['userid'].'.</span></div>
</div> <div style="text-align:center;">
<div class="polltitlebground">
<div class="polltitleframe">
<b>Poll Page</b><br>
<a href="index.php">Main Menu</a>
</div>
</div>
</div><div class="frame wide_e">
<center>Thank you for your submission '.$_SESSION['userid'].'!<br />
Your vote wil be tallied as soon as the week is over.</center></div>';
}
}

function authenticate($u, $p)
{
if($u == 'admin' && $p == 'password') return true; //replace with the actual authentication.
return false;
}

echo '<?php include(\'inc/foot.inc\'); ?></div></body></html>'

?>[/PHP]

It only partially works. Does this have persistency? Meaning, how come it always stays logged in when i load the page? please debug. also, i stripped the HTML you put in because this script writes it in now. im quick to learn PHP. thanks for all your help Motoma!

[Motoma]

Hey, wait: this is your assignment not mine. I gave you the basis for getting the system rolling, but you are going to have to implement appenddatatofile() yourself! I never wrote that function, I merely placed it there to show you the logic behind the page you are trying to create.

If you want to keep data between pages, (such as values from the previous post) just chuck them in the $_SESSION variable (hint: take a look at the userid).

[eragon]

i see, well, ill check out php.net to solve that error. or ill just use my origoinal write script.

[eragon]

all right mate, i got it working. thanks for your help. now, i have another concern. i want to use .inc files for another thing, using the login script (which after some time i now understand). how would i make it so that the .inc files only load on a ceratin file, say, user.php? meaning if somebody links directly to a inc file, it wont load or iw will be blank,, but if they load it using an include in user.php it will show?

[Motoma]

all right mate, i got it working. thanks for your help. now, i have another concern. i want to use .inc files for another thing, using the login script (which after some time i now understand). how would i make it so that the .inc files only load on a ceratin file, say, user.php? meaning if somebody links directly to a inc file, it wont load or iw will be blank,, but if they load it using an include in user.php it will show?

Well, if your .inc file contains only function definitions (as it should) then you don't have to do anything to have them display blank.

[eragon]

Well, if your .inc file contains only function definitions (as it should) then you don't have to do anything to have them display blank.

umm... ya, my .inc files contain portions of html pages (EX foot.ing just has the footer information...) i found that this is an easy way to update all the files on my site at once.

[Motoma]

Put them outside of your webroot.