Breadcrumbs

[Mark]

hello,

im having a problem once I login and forget to logout again and when I login it says I need to login again can anyone help me please?

This is the members page code.

Code: Select all

<?php 

session_start(); 
if(!isset($_SESSION['username'])) { 
    echo("You must be logged in to view this page!."); 
} else { 
?> 

This is my login page code.

Code: Select all

<?php require("./styles/top.php"); ?> 
 
<?php 

$form = "<form action='index.php' method='post'> 
<table> 
<tr> 
    <td>Username:</td> 
    <td><input type='username' name='username'></td> 
</tr> 
<tr> 
    <td>Password:</td> 
    <td><input type='password' name='password'></td> 
</tr> 
<tr> 
    <td></td> 
    <td><input type='submit' value='Login' name='submit'></td> 
</tr> 
</table> 
</form>"; 

// We include out connect to database file. 
include('scripts/connect.php'); 
// now we check to see if the button has been pressed. 
if ($_SERVER['REQUEST_METHOD'] == 'POST'){ 
// retrieving the input from the user, also securing from SQL injection and 
// making the password md5 encryption.     
    $username = mysql_real_escape_string($_POST['username']); 
    $password = mysql_real_escape_string(md5($_POST['password'])); 
// now to make sure the fields are not empty. 
    if(!empty($_POST['username']) && !empty($_POST['password'])){ 
     
    $query = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'"); 
    $query_rows = mysql_num_rows($query); 
     
    if($query_rows > 0) { 
        echo("Successfully logged in! <a href='members.php'>Click Here</a> to go to the members only page!. "); 
        session_start(); 
        $_SESSION['username']=$username; 
    } else { 
        echo("The login information you provided does not exist!."); 
    }         
    } 
    else  
        echo("You need to enter a valid username and password!. $form"); 
} 
else 
    echo $form; 

?> 
 

<?php require("./styles/bottom.php"); ?> 

[XTechVB]

Wait... What? I don't understand what you mean, what is the problem again?

[Mark]

I mean how can i check if a user is banned or not i have value in mysql that says banned 1 means banned and 0 not banned how do i chexk before they can be logged in ?.

[XTechVB]

Code: Select all

$UserRow = mysqli_fetch_assoc($query);
if ($UserRow['banned'] === '1') {
     // user is banned. Show message
     exit('Your account is banned!');
} else {
    // proceed with login.
}

Wrote it on my phone so its not tested. Ohh and stop using mysql_ its deprecated and wont work. Use mysqli_ instead. Also, try writing in OOP style. Trust me you'll thank yourself later.

[Mark]

Hello,

This is what I mean with the above code.

Once I login the then says I must log in and when I logout it then lets me login?

[Mark]

Code: Select all

$UserRow = mysqli_fetch_assoc($query);
if ($UserRow['banned'] === '1') {
     // user is banned. Show message
     exit('Your account is banned!');
} else {
    // proceed with login.
}

where would I put this code in my login form?

Code: Select all

<?php require("./styles/top.php"); ?>

<?php

$form = "<form action='index.php' method='post'>
<table>
<tr>
    <td>Username:</td>
    <td><input type='username' name='username'></td>
</tr>
<tr>
    <td>Password:</td>
    <td><input type='password' name='password'></td>
</tr>
<tr>
    <td></td>
    <td><input type='submit' value='Login' name='submit'></td>
</tr>
</table>
</form>";

// We include out connect to database file.
include('scripts/connect.php');
// now we check to see if the button has been pressed.
if ($_SERVER['REQUEST_METHOD'] == 'POST'){
// retrieving the input from the user, also securing from SQL injection and
// making the password md5 encryption.    
    $username = mysql_real_escape_string($_POST['username']);
    $banned = mysql_real_escape_string($_POST['banned']);
    $password = mysql_real_escape_string(md5($_POST['password']));
// now to make sure the fields are not empty.
    if(!empty($_POST['username']) && !empty($_POST['password'])){
             
    $query = mysql_query("SELECT * FROM users WHERE username='$username' AND password='$password'");
    $query_rows = mysql_num_rows($query);
    
    if($query_rows > 0) {
        echo("Successfully logged in! <a href='members.php'>Click Here</a> to go to the members only page!. ");
        session_start();
        $_SESSION['username']=$username;
       
    } else {
        echo("The login information you provided does not exist!.");
    }        
    }
    else 
        echo("You need to enter a valid username and password!. $form");
}
else
    echo $form;

?>


<?php require("./styles/bottom.php"); ?>

[XTechVB]

That's up to you, but i would put it after

Code: Select all

if($query_rows > 0) {