loginscript user_id in header
ik heb het login script veranderd ik heb de isset functie alleen gebruikt voor de user_id een username is niet nodig mee te nemen in een session werd eerder verteld.
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
<?php
require_once 'scripts/connect.php';
require_once 'scripts/app_config.php';
error_reporting(E_ALL);
ini_set('display_errors',1);
if (!isset($_SESSION['user_id']))
{
// user is not logged in.
if (isset($_POST['cmdlogin']))
{
// retrieve the username and password sent from login form
// First we remove all HTML-tags and PHP-tags, then we create a md5-hash
// This step will make sure the script is not vurnable to sql injections.
$u = strip_tags($_POST['username']);
$p = strip_tags($_POST['password']);
//Now let us look for the user in the database.
$query = sprintf("SELECT user_id FROM users WHERE username = '$u' AND password = '$p' LIMIT 1;",
mysql_real_escape_string($u), mysql_real_escape_string($p));
$result = mysql_query($query);
// If the database returns a 0 as result we know the login information is incorrect.
// If the database returns a 1 as result we know the login was correct and we proceed.
// If the database returns a result > 1 there are multple users
// with the same username and password, so the login will fail.
if (mysql_num_rows($result) != 1)
{
// invalid login information
echo "Wrong username or password!";
//show the loginform again.
include "index.php";
} else {
// Login was successfull
$row = mysql_fetch_array($result);
// Save the user ID for use later
$_SESSION['user_id'] = $row['user_id'];
// Save the username for use later
$_SESSION['username'] = $u;
// Now we show the user
header("Location:profile.php");
}
} else {
// User is not logged in and has not pressed the login button
// so we show him the loginform
include "index.php";
}
} else {
// The user is already loggedin, so we show the user
include "profile.php";
}
?>
require_once 'scripts/connect.php';
require_once 'scripts/app_config.php';
error_reporting(E_ALL);
ini_set('display_errors',1);
if (!isset($_SESSION['user_id']))
{
// user is not logged in.
if (isset($_POST['cmdlogin']))
{
// retrieve the username and password sent from login form
// First we remove all HTML-tags and PHP-tags, then we create a md5-hash
// This step will make sure the script is not vurnable to sql injections.
$u = strip_tags($_POST['username']);
$p = strip_tags($_POST['password']);
//Now let us look for the user in the database.
$query = sprintf("SELECT user_id FROM users WHERE username = '$u' AND password = '$p' LIMIT 1;",
mysql_real_escape_string($u), mysql_real_escape_string($p));
$result = mysql_query($query);
// If the database returns a 0 as result we know the login information is incorrect.
// If the database returns a 1 as result we know the login was correct and we proceed.
// If the database returns a result > 1 there are multple users
// with the same username and password, so the login will fail.
if (mysql_num_rows($result) != 1)
{
// invalid login information
echo "Wrong username or password!";
//show the loginform again.
include "index.php";
} else {
// Login was successfull
$row = mysql_fetch_array($result);
// Save the user ID for use later
$_SESSION['user_id'] = $row['user_id'];
// Save the username for use later
$_SESSION['username'] = $u;
// Now we show the user
header("Location:profile.php");
}
} else {
// User is not logged in and has not pressed the login button
// so we show him the loginform
include "index.php";
}
} else {
// The user is already loggedin, so we show the user
include "profile.php";
}
?>
de profile.php pagina waar je vervolgens op terecht komt ziet er zo uit:
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
<?php
require_once 'scripts/connect.php';
require_once 'scripts/app_config.php';
error_reporting(E_ALL);
ini_set('display_errors',1);
session_start();
if (!isset($_SESSION['user_id']))
{
die ("Access Denied");
}
?>
<html>
<head>
<link href="css/style.css" rel="stylesheet" type="text/css" />
</head>
<body>
<div id="header" class="center">
<h1><img src="images/SW_banner.jpg" alt="StarWars"></h1>
</div>
<br>
<div id="container">
<div id="left">
<div id="users">
<h5 align="center">Geregistreerde Spelers:
<br><br><br>
<?php include 'show_users.php';?>
</h5>
</div>
</div>
<div id="middle">
<div id="menu">
<?php include 'menu.php';?>
</div>
<h4 align="center">Profiel pagina van: <?php echo $username; ?></h4>
<table align="center">
<tr>
<td>Naam: </td>
<td><?php echo $first_name . " " . $last_name; ?></td>
</tr>
<tr>
<td>Gebruikersnaam: </td>
<td><?php echo $username; ?></td>
</tr>
<tr>
<td>Email adres: </td>
<td><?php echo $email; ?></td>
</tr>
<tr>
<td>Profiel: </td>
<td><?php echo $bio; ?></td>
</tr>
<tr>
<td>Faction: </td>
<td><?php echo $faction; ?></td>
</tr>
<tr>
<td>Bank: </td>
<td>$ <?php echo $bank; ?></td>
</tr>
<tr>
<td>Cash: </td>
<td>$ <?php echo $cash; ?></td>
</tr>
</table>
<h5 align="center">
Profiel Foto:
</h5>
<h5 align="center">
<img height="250" width="250" src="<?php echo $user_image; ?>" >
</h5>
<h5 align="center">
<a href=" <?php echo $facebook_url; ?>">Jou facebook pagina! </a>
<br />
<a href=" <?php echo $twitter_url; ?>">Check je Twitter feed! </a>
<br />
</h5>
</div>
<div id="right">
<div id="login">
<form action="scripts/login.php" method="POST">
<h5 align="center">
Gebruikersnaam: <br><input type="text" name="username"><br><br>
Wachtwoord: <br><input type="password" name="password"><br><br>
<input type="submit" value="Log in" />
<input type="reset" value="Reset" />
</h5>
</form>
</div>
</div>
</div>
<br>
<div id="footer" class="center">
<h1><img src="images/SW_banner.jpg" alt="StarWars"></h1>
</div>
</body>
</html>
require_once 'scripts/connect.php';
require_once 'scripts/app_config.php';
error_reporting(E_ALL);
ini_set('display_errors',1);
session_start();
if (!isset($_SESSION['user_id']))
{
die ("Access Denied");
}
?>
<html>
<head>
<link href="css/style.css" rel="stylesheet" type="text/css" />
</head>
<body>
<div id="header" class="center">
<h1><img src="images/SW_banner.jpg" alt="StarWars"></h1>
</div>
<br>
<div id="container">
<div id="left">
<div id="users">
<h5 align="center">Geregistreerde Spelers:
<br><br><br>
<?php include 'show_users.php';?>
</h5>
</div>
</div>
<div id="middle">
<div id="menu">
<?php include 'menu.php';?>
</div>
<h4 align="center">Profiel pagina van: <?php echo $username; ?></h4>
<table align="center">
<tr>
<td>Naam: </td>
<td><?php echo $first_name . " " . $last_name; ?></td>
</tr>
<tr>
<td>Gebruikersnaam: </td>
<td><?php echo $username; ?></td>
</tr>
<tr>
<td>Email adres: </td>
<td><?php echo $email; ?></td>
</tr>
<tr>
<td>Profiel: </td>
<td><?php echo $bio; ?></td>
</tr>
<tr>
<td>Faction: </td>
<td><?php echo $faction; ?></td>
</tr>
<tr>
<td>Bank: </td>
<td>$ <?php echo $bank; ?></td>
</tr>
<tr>
<td>Cash: </td>
<td>$ <?php echo $cash; ?></td>
</tr>
</table>
<h5 align="center">
Profiel Foto:
</h5>
<h5 align="center">
<img height="250" width="250" src="<?php echo $user_image; ?>" >
</h5>
<h5 align="center">
<a href=" <?php echo $facebook_url; ?>">Jou facebook pagina! </a>
<br />
<a href=" <?php echo $twitter_url; ?>">Check je Twitter feed! </a>
<br />
</h5>
</div>
<div id="right">
<div id="login">
<form action="scripts/login.php" method="POST">
<h5 align="center">
Gebruikersnaam: <br><input type="text" name="username"><br><br>
Wachtwoord: <br><input type="password" name="password"><br><br>
<input type="submit" value="Log in" />
<input type="reset" value="Reset" />
</h5>
</form>
</div>
</div>
</div>
<br>
<div id="footer" class="center">
<h1><img src="images/SW_banner.jpg" alt="StarWars"></h1>
</div>
</body>
</html>
en ik krijg nu de acces denied melding.
Verder horen scripts niet te stoppen met die(), je scripts stoppen direct en dat is onnodig.
Code (php)
1
2
3
4
2
3
4
<?php
$query = sprintf("SELECT user_id FROM users WHERE username = '$u' AND password = '$p' LIMIT 1;",
mysql_real_escape_string($u), mysql_real_escape_string($p));
?>
$query = sprintf("SELECT user_id FROM users WHERE username = '$u' AND password = '$p' LIMIT 1;",
mysql_real_escape_string($u), mysql_real_escape_string($p));
?>
Je sprintf is hierdoor loos, zie http://www.php.net/sprintf voor hoe het wel moet.
Ten tweede: waaron include je profile.php etc terwijl je waarschijnlijk een redirect bedoelt?
En natuurlijk wat Ariën zegt.
Na een header('Location: ...'); hoort doorgaans ook altijd een exit; te staan.
Gewijzigd op 06/01/2016 21:58:56 door Thomas van den Heuvel
Boeken zijn vaak verouderd. Je kan ook op www.codeacademy.com een cursus PHP doen. Ik raad wel aan om de basis van websites, het online publiceren (hosten) onder de knie, en HTML + CSS onder de knie te hebben. Ook deze kan je daar op Codeacademy leren.
Toevoeging op 08/01/2016 15:27:36:
Kijk is aan, het is gelukt ! http://163.158.253.94/cms of nouja het begin is er haha :P je kan nu inloggen waarbij de username meegenomen word in de sessie.... nu de rest nog zoals achternaam profiel foto etc. Ik hou jullie op de hoogte ! bedankt voor alle tips !
Toevoeging op 08/01/2016 16:07:39:
Ben van Velzen op 06/01/2016 19:31:18:
Wat ik erg vind is dat het een boek uit 2013 is, en zo achterhaald is. Zo wordt het gebruik van $_REQUEST zelfs aangeraden zo te zien, en worden joins op de verkeerde manier uitgelegd. Fijn boek, gewoon weg ermee. Verbazingwekkend dat dit een O'Reilly boek is.
Wat is er tegenwordig beter dan ? inplaats van $_REQUEST ?
Jou facebook pagina! is trouwens jouw