conditions on login code

[anfetienne]

hi

i have this code for login using a database

<?php
$username="********";
$password="********";
$database="auctionTemps";
 
// Connect to server and select databse.
$connection=mysql_connect("localhost" ,"$username", "$password") or die("Unable to connect!");
 
mysql_select_db("$database") or die("Unable to select database!");
 
// username and password sent from form
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];
 
// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
 
$sql="SELECT * FROM users WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);
 
// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row
 
if($count==1){
// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("myusername");
session_register("mypassword");
header("location:tsandcs.php");
}
else {
header("location:incorrect.php");
}
?>
 

the part of it that i want to ask about is the part i add to all my pages that redirects all users back to a certain page if they are not logged in is this code

<?
session_start();
if(!session_is_registered(myusername)){
header("location:index.php");
}
?>
 

what i want to do is check if the username is in the database which it does already but also check if the email address that is stored with the username has been confirmed.

the system im building goes like this.

1. user clicks register
2. they enter user details email, password and username
3. then the enter their name and postal details which are passed to paypal.
4. they then enter their payment details for the subscription.
5. once completed paypal they are directed back to a page where they confirm their email address.
6. once confirmed they are able to login.

the aim is to make sure that people don't get access to the site without completing the full process as it's a subscription site

[Markus]

WARNING! WARNING! The use of session_is_registered() and register_session is being dropped completely from PHP6 and deprecated from something like 5.3.

Instead, to set sessions, add them directly to the SESSION array, and to check if a session exists, use isset() on the session key.

$_SESSION['username'] = 'username';
 
if (isset($_SESSION['username']))
{
    // session is registered
}
 

You should have a flag in your database table, something like 'email_confirmed'. When the user confirms their email, you update this to '1' or 'y' or whatever you want, otherwise, the email remains unconfirmed.

Then, in your WHERE clause add "AND email_confirmed = 'y'"

Mark.

[anfetienne]

how do i do add for it to check not just the user name but if they email has been confirmed?

like 0=not confirmed 1=confirmed

also do i just simply swap the coding around?

changing register session for $_SESSION['username'] = 'username';

and if(!session_is_registered(myusername)){ for if (isset($_SESSION['username']))

[Markus]

@anfetienne
1. Add an extra bit to the WHERE clause.

SELECT * FROM `tbl` WHERE `col1` = 'x' AND `col2` = 'y' AND `col3` = '1'
 

2. Yes. But remember the ! in before your isset() call.

[anfetienne]

great ill test that now.....thanks markus