problems with my login

[twodelay]

Hi, i don't know if anyone can help me. I'm really a novice to be honest. I have a site I'm working on and using some code I made with the help of a friend i set up a login system. It worked on the server we were using. But when i tried to adapt it to a different server for a website I needed this functionality for it doesn't seem to work.

Somewhere in the transition something has either been lost or not added. I'm sure I've cover all the bases. I know there will be more info from me but if anyone can think of any obvious reasons that would be great I can then start to tick them off the list!

I look forward to hearing from anyone!

[Atli]

Hi. Welcome to TSDN!

There are so many reasons why that could be happening I barely know where to start. It would help if you could post your code here, so we could see if we spot anything specific.

The first things I'd look for is any code that relies on register_globals or something that loads resources from or links to an absolute path ("http://localhost/page.php" rather than "/page.php").

But as I say, it's impossible to say unless we can have a look at your code.

[twodelay]

Ok bit of a mess but here is the login code. its in a separate document called account.php. I have then used an include_once within the page i want it to appear. if that makes sense. anyway see below:

<?
 
if ($_SESSION["userid"]) {
    ?>
<link href="../../css/rollovers.css" rel="stylesheet" type="text/css" />
<link href="../../css/styles.css" rel="stylesheet" type="text/css" />
<link href="../../css/stylestext.css" rel="stylesheet" type="text/css" />
 
    <div id="signup"><div id="blogspacer"></div>
        <p class="bodyboldblue">Logged in</p>
        <?=$loginerror?>
        <p class="loginbody">You are currently logged in as <strong>
        <?=$member["member_name"]?>
        </strong></p>    
        <p><a class="loginbody" href='<?=$_SERVER['PHP_SELF']?>?logout=true<?=($_GET["id"]) ? "&id=".$_GET["id"] : "";?>'>Click here to log out</a></p>
    </div>
    <div id="blogspacer"></div>
    <?
}
else {
    ?>
    <div id="signup"><div id="blogspacer"></div>
    <form action='<?=$_SERVER['PHP_SELF']?><?=($_GET["id"]) ? "?id=".$_GET["id"] : "";?>' method='POST'/>
    <p class="bodyboldblue">Blog Login</p>
    <p class="loginbody">Username <br /><input name='un' type='text' class="loginbody" size='20'/>
      </p><p class="loginbody">Password <br /><input name='pw' type='password' class="loginbody" size='20'/>
      </p><p><input type='submit' class="loginbody" value='Login'/></p>
    </div>
    <div id="blogspacer"></div>
    <?
}
 
?>
 

[Atli]

Ahh ok.

Before you change anything, change the short-tags into real PHP tags.
Short-tags are disabled by default in PHP and you should avoid using them at all times. They are a little shorter, but honestly, their nothing but trouble.

That is:

# Change these tags:
<? .. ?>
<?=$var?>
 
# Into these tags:
<?php ... ?>
<?php echo $var; ?>
 

[twodelay]

Ahh ok.

Before you change anything, change the short-tags into real PHP tags.
Short-tags are disabled by default in PHP and you should avoid using them at all times. They are a little shorter, but honestly, their nothing but trouble.

That is:

# Change these tags:
<? .. ?>
<?=$var?>
 
# Into these tags:
<?php ... ?>
<?php echo $var; ?>
 

Cool, i will sort this and let you know when its done. Thanks for your help so far.... and thanks in anticipation of your help to come!

[twodelay]

<?php if ($_SESSION["userid"]) {?>
<link href="../../css/rollovers.css" rel="stylesheet" type="text/css" />
<link href="../../css/styles.css" rel="stylesheet" type="text/css" />
<link href="../../css/stylestext.css" rel="stylesheet" type="text/css" />
 
    <div id="signup"><div id="blogspacer"></div>
        <p class="bodyboldblue">Logged in</p>
        <?php echo $loginerror?>
        <p class="loginbody">You are currently logged in as <strong>
        <?php echo $member["member_name"]?>
        </strong></p>    
        <p><a class="loginbody" href='<?php echo $_SERVER['PHP_SELF']?>?logout=true<?php echo ($_GET["id"]) ? "&id=".$_GET["id"] : "";?>'>Click here to log out</a></p>
    </div>
    <div id="blogspacer"></div>
    <?php
}
else {
    ?>
    <div id="signup"><div id="blogspacer"></div>
    <form action='<?php echo $_SERVER['PHP_SELF']?><?=($_GET["id"]) ? "?id=".$_GET["id"] : "";?>' method='POST'/>
    <p class="bodyboldblue">Blog Login</p>
    <p class="loginbody">Username <br /><input name='un' type='text' class="loginbody" size='20'/>
      </p><p class="loginbody">Password <br /><input name='pw' type='password' class="loginbody" size='20'/>
      </p><p><input type='submit' class="loginbody" value='Login'/></p>
    </div>
    <div id="blogspacer"></div>
    <?php
}
 
?>
 

Ok so i have changed the short tags. It still does nothing when i try to log in. What do you think the next step is?

[Atli]

I can't see anything wrong with that particular code, except that you missed one short-tag in line 20.

There doesn't seem to be any code there to process the form data that is posted if the Session variable in line 1 is false, which I would guess is the code that actually logs the user in. Could the problem be there?

[twodelay]

I can't see anything wrong with that particular code, except that you missed one short-tag in line 20.

There doesn't seem to be any code there to process the form data that is posted if the Session variable in line 1 is false, which I would guess is the code that actually logs the user in. Could the problem be there?

Well from what you said in my limited knowledge I would have thought that that might be a problem, however, it is the same code as as i used before, which worked. Grr this is complicated. The thing that bugs me is that it seems as if its not even processing anything. When you submit illegal characters or incorrect login it doesnt come up with the error message that has been set up.

I will cross reference this with my old files and see if i can see anything in the code.

[twodelay]

Ok i have racked my brains and cant see or find anything that is different to the other version i did (that worked) other than stylesheets etc.

You mentioned:

There doesn't seem to be any code there to process the form data that is posted if the Session variable in line 1 is false, which I would guess is the code that actually logs the user in. Could the problem be there?

Could you suggest what changes i could make to correct this... so sorry as you can tell I'm very, very poor at this! thanks for your help.

[Atli]

I could probably see if there are problems with the code, if I could see it :)
Just the part where you fetch the POST values and where you log the user in.

My first guess would be it has something to do with the register_globals directive, but there is really no way to tell unless I see the code.

Just out of curiosity, which version of PHP did this code work on? And which version are you trying to use it on now?

Could you create a new .php file with the following content, run it and find the value of the 'short_open_tag' directive and the 'register_globals' directive?

<?php echo phpinfo(); ?>
 

[LacrosseB0ss]

From my previous experiences, ASP and such will not work on Linux servers. Is the same true for the reverse? i.e. Will PHP work on a Windows server? Off the top of my head that's what I am thinking.

This Article claims some versions of Windows do not support PHP. And some PHP versions aren't set up to run. You can read the article for more.

Now, I could just be blowing smoke. I don't really know if this is correct or not. Just throwing ideas out there but I know ASP won't work on Linux (where PHP can be used). Perhaps your old server was Linux based and the new one is Windows based. I'd contact your server owner to find out.

- LB

[twodelay]

From my previous experiences, ASP and such will not work on Linux servers. Is the same true for the reverse? i.e. Will PHP work on a Windows server? Off the top of my head that's what I am thinking.

This Article claims some versions of Windows do not support PHP. And some PHP versions aren't set up to run. You can read the article for more.

Now, I could just be blowing smoke. I don't really know if this is correct or not. Just throwing ideas out there but I know ASP won't work on Linux (where PHP can be used). Perhaps your old server was Linux based and the new one is Windows based. I'd contact your server owner to find out.

- LB

Hi thanks for the suggestion but it does have PHP installed on the server. I made sure of that when setting up the account. It has PHPmyAdmin pre-installed. I think it might be something to do with PHP 4 or 5 or something!

thanks.

[twodelay]

I could probably see if there are problems with the code, if I could see it :)
Just the part where you fetch the POST values and where you log the user in.

My first guess would be it has something to do with the register_globals directive, but there is really no way to tell unless I see the code.

Just out of curiosity, which version of PHP did this code work on? And which version are you trying to use it on now?

Could you create a new .php file with the following content, run it and find the value of the 'short_open_tag' directive and the 'register_globals' directive?

<?php echo phpinfo(); ?>
 

Ok i ran the PHP info document.

The short_open_tag is set to 'on' and the register_globals is also set as 'on'

does that help?

It is also PHP 4.... 4.4.7 to be exact. Im pretty sure the PHP im using is 4.

I noticed that the Register_globals on the previous server i used was set to off. Does this make a difference... it was also using PHP 4.4.6

hope some of this makes sense.

[twodelay]

I have been in touch with the hosting company as i figured they would have to change the register_globals. they said that there is a .htaccess file on the live directory already that i can access and change.

Only, showing my inexperience and lack of knowledge again, i dont know how to get it. Ive looked through dreamweaver and cant see it. I used an independent FTP client and i can see the .htaccess file but cant download a copy to edit.

If anyone can shed some light on this that would be great. Thanks.

[Atli]

I wouldn't worry about changing that. If both the 'register_globals' and the 'short_open_tags' are on, neither of them will cause your code to stop functioning.

Now we know that neither of those two are the cause of your problem, we really need to see the login code to have any chance of finding the problem.

If you could find the login code and post it here, I could look through it and see if I spot anything that may be causing this.

[twodelay]

Ok below is the code you have seen before which is the login:

<?php
 
if ($_SESSION["userid"]) {
    ?>
<link href="../../css/styles.css" rel="stylesheet" type="text/css" />
<link href="../../css/stylestext.css" rel="stylesheet" type="text/css" />
<link href="../../css/rollovers.css" rel="stylesheet" type="text/css" />
 
    <div id="signup"><div id="blogspacer"></div>
        <p class="bodyboldblue">Logged in</p>
        <?php echo $loginerror?>
        <p class="loginbody">You are currently logged in as <strong>
        <?php echo $member["member_name"]?>
        </strong></p>    
        <p><a class="loginbody" href='<?php echo $_SERVER['PHP_SELF']?>?logout=true<?php echo($_GET["id"]) ? "&id=".$_GET["id"] : "";?>'>Click here to log out</a></p>
    </div>
    <div id="blogspacer"></div>
    <?php
    }
    else {
    ?>
 
    <div id="signup"><div id="blogspacer"></div>
    <form action='
    <?php echo $_SERVER['PHP_SELF']?>
    <?php ($_GET["id"]) ? "?id=".$_GET["id"] : "";?>' method='POST'/>
    <p class="bodyboldblue">Blog Login</p>
    <p class="loginbody">Username <br /><input name='un' type='text' class="loginbody" size='20'/>
      </p><p class="loginbody">Password <br /><input name='pw' type='password' class="loginbody" size='20'/>
      </p><p><input type='submit' class="loginbody" value='Login'/></p>
    </div>
    <div id="blogspacer"></div>
 
<?php
}
?>
 

then the next bit of code is...

<?php
        $filter[] = "blog_type = 1";
        if ($_SESSION["userid"]) {
        $filter[] = "blog_type = 2";
        $filter[] = "(blog_type = 3 && memberID = ".$_SESSION["userid"].")";
        } // end if ($_SESSION["userid"])
        $sql = "SELECT * FROM blogs WHERE ".implode(" OR ",$filter);
        $result = mysql_query($sql);
        @ $rows = mysql_num_rows($result);
        if ($rows > 0) {
        while($data = mysql_fetch_array($result)) {
            $sql = "SELECT member_name FROM members WHERE memberID = ".$data["memberID"];
            $author_result = mysql_query($sql);
            $author_name = mysql_fetch_array($author_result);
            if ($data["blog_type"] == 1) $type = "Public";
            elseif ($data["blog_type"] == 2) $type = "Personal";
            elseif ($data["blog_type"] == 3) $type = "Private";
            echo "<p><a href='view.php?id=".$data["blogID"]."'>".$data["blog_name"]."</a> by ".$author_name["member_name"]." (".$type.")</p>";
        } // end while($data = mysql_fetch_array($result))
        } // end if ($rows > 0)
        else {
        ?>Sorry, but there are currently no blogs available for you to peruse.
        <p>Please try back again in a few days.</p>
 
        <?php
        } // end if ($rows > 0) else
        ?>
 
        </div>
 
        <div id="bloglogin">
        <?php include_once($_SERVER['DOCUMENT_ROOT']."/common/panel/account.php"); ?>
        </div>
 

[twodelay]

Another question... how would i go about finding out whether my server is set up to run sessions?

[Atli]

I still can't find any login code there.

The first example you posted appears to show you a logout page if you are logged in, or print a login form if you are not. But there is no code to process the data sent by the login form.

The second code seems to fetch blog entries from a MySQL database and display to the user. Again, there is no code here that will log a user in.

Are you sure there is any such code?
Could it be possible that you forgot to copy it from your old project?
That would certainly explain why the functionality won't work.

As to finding out if your server supports sessions.
Try this code. If you server supports sessions, the sessionID should stay the same, and the message should never change. No matter how much you refresh the page.

<?php
  # Start session and print the session ID
  session_start();
  echo "Session ID: ". session_id() ."<br />";
 
  # Set a random message if it isn't already set.
  if(!isset($_SESSION['message'])) {
    $textArray = array("First", "Second", "Third");
    $_SESSION['message'] = $textArray[mt_rand(0, 2)];
  }
 
  # Print the message
  echo "Message: {$_SESSION['message']}<br />";
?>
 

[twodelay]

Ok so now i have the code that communicates with the database to check login and password is correct etc.

<?
 
    session_start();
    function display_array($array) {
        echo "<pre>";
        print_r($array);
        echo "</pre>";
        return true;
    } // function display_array($array)
    function parseContent($content) {
        $content = str_replace("<ul>","\n<ul>\n",$content);
        $content = str_replace("<li>","\n<li>\n",$content);
        $content = str_replace("</li>","\n</li>\n",$content);
        $content = str_replace("</ul>","\n</ul>\n",$content);
        $lines = explode("\n",$content);
        $add_paragraph_tags = true;
        foreach($lines as $line) {
            $line = trim($line);
            if (!empty($line)) {
                if ($line == "<ul>") $add_paragraph_tags = false;
                elseif ($line == "</li>") $add_paragraph_tags = false;
                if ($add_paragraph_tags) $output .= "<p>".$line."</p>\n";
                else $output .= $line."\n";
                if ($line == "</ul>") $add_paragraph_tags = true;
                elseif ($line == "<li>") $add_paragraph_tags = true;
                $lines_output[] = $line;
            } // end if (!empty(trim($line)))
        } // end foreach($lines as $line)
        return $output;
    } // end function parseContent($content)    
    $db = mysql_pconnect("localhost","***************","*****************");
    mysql_select_db("******************");
 
    // If you are logging in do this
    if ($_POST["un"]) {
        $result = mysql_query("SELECT * FROM members WHERE member_username = '".$_POST["un"]."' AND member_password = PASSWORD('".$_POST["pw"]."')");
        @ $row = mysql_num_rows($result);
        if ($row > 0) {
            $member = mysql_fetch_array($result);
            mysql_query("UPDATE members SET member_lastlogin = NOW() WHERE memberID = ".$member["memberID"]);
            $_SESSION["userid"] = $member["memberID"];
        } // end if ($row > 0)
        else $loginerror = "<p><strong>Could not log you in. Username and password do not match!</strong></p>";
    } // end if ($_POST["un"])
 
    // This code logs you out
    if ($_GET["logout"]) {
        unset($_SESSION["userid"]);
    } // end if ($row > 0) else
 
    if (!empty($_SESSION["userid"])) {
        $result = mysql_query("SELECT * FROM members WHERE memberID = '".$_SESSION["userid"]."'");
        @ $row = mysql_num_rows($result);
        if ($row > 0) {
            $member = mysql_fetch_array($result);
        } // end if ($row > 0)
        else {
            unset($_SESSION["userid"]);
        } // end if ($row > 0) else
    } // end if (!empty($_SESSION["userid"]))
 
?>
 

[Atli]

Ok, I see a few things there I'd like to mention.

First, and most likely to solve your problem, line 52. I assume that the SQL statement there is meant to find out if the user with the given user ID actually exists.
The problem is that you are enclosing the ID in quote tags, which it should not be. Numeric values should not be quoted.

Second. You use the mysql_pconnect function to connect MySQL. Is there any specific reason for this?
If not, you may be better of using the mysql_connect function.

Lastly. The way your code is built, it would be possible to both log in and log out at the same time. I would add a else clause to the if statement that checks if the POST data has been sent so this would not be possible.
It should never happen anyways so the only thing you are doing with this is bypass the last two if statements if you are login in.