Ad:

PHP Discussion Thread
Unsolved
Views: 1760

Jul 19th, 2008

security using cookies/session variables

Expand Post »

hey guys.

i hav this page (a.php), where i ask te user for his username and password. I match these with static values, and upon succesful matching, i redirect the user to b.php.

my prob-

what if somebody, instead of going thru the normal procedure (from a.php to b.php after verification), directly types in the url for b.php into the address bar???

will that not SHATTER my security??

how can i implement security so that if some1 has not signed in (on a.php) and directly enters the url of b.php, he is

1. sent back to (a.php)

or

2. nothing is displayed on b.php

pls. help

thanks a lot.

Similar Threads

Do You Know Sessions! HELP PLEASE! in PHP
Inserting array into cookie in PHP
Zend PHP Certification in PHP

akshit

Reputation Points: 10

Solved Threads: 0

Light Poster

Offline

46 posts
since Jun 2008

Permalink

Jul 19th, 2008

Re: security using cookies/session variables

You just write small logic in one page called login_check.php...
and you must include that file in every page where ever you want security to your page:
like:

php Syntax (Toggle Plain Text)
<? include("login_check.php"); ?>
<? include("login_check.php"); ?>

In login_check.php:

php Syntax (Toggle Plain Text)
<?
session_start();
if(empty($_SESSION['user_name']))
 {
  header('location:index.php'); 
 }
?>
<?
session_start();
if(empty($_SESSION['user_name']))
 {
  header('location:index.php'); 
 }
?>

Shanti C

Reputation Points: 137

Solved Threads: 162

Posting Virtuoso

Offline

1,641 posts
since Jul 2008

Permalink

Jul 19th, 2008

Re: security using cookies/session variables

hi.

thx 4 d reply.

i guess u dint get my equirement totally.

on any page, i want the user to ba able to view the page contents only if

1. he has entered his username AND password
2. both are found to match the actual values

in case either is not true, i redirect him to the login page.

will ur solution help me get this?

pls suggest.

akshit

Reputation Points: 10

Solved Threads: 0

Light Poster

Offline

46 posts
since Jun 2008

Permalink

Jul 19th, 2008

Re: security using cookies/session variables

And tel me where you are going to compare your username and password...

I think that is from database...
tel me...

Shanti C

Reputation Points: 137

Solved Threads: 162

Posting Virtuoso

Offline

1,641 posts
since Jul 2008

Permalink

Jul 19th, 2008

Re: security using cookies/session variables

My reply will be the solution for your line...

Quote ...

what if somebody, instead of going thru the normal procedure (from a.php to b.php after verification), directly types in the url for b.php into the address bar???

Shanti C

Reputation Points: 137

Solved Threads: 162

Posting Virtuoso

Offline

1,641 posts
since Jul 2008

Permalink

Jul 19th, 2008

Re: security using cookies/session variables

And tel me where you are going to compare your username and password...

I think that is from database...
tel me...
here is the code for redirecting if username and password are correct...

php Syntax (Toggle Plain Text)
<?
session_start(); 
include('functions.php');
 
if($_SERVER['REQUEST_METHOD']=="POST"){
 
	$qer="select * from table where username='".$_POST['username']."' and password='".$_POST['password']."'";
	$res=mysql_query($qer);
	$num=mysql_num_rows($res);
	if($num==0)
		{
			echo'<script language="javascript">window.location.href="anotherpage.php";</script>';
		}
	else if($num==1)
		{
			session_unregister("user_name");
			session_register("user_name");
			$_SESSION['user_name']=$_POST['username'];
 
						echo'<script language="javascript">window.location.href="welcome.php";</script>';
		}
}
?>
<?
session_start(); 
include('functions.php');

if($_SERVER['REQUEST_METHOD']=="POST"){

	$qer="select * from table where username='".$_POST['username']."' and password='".$_POST['password']."'";
	$res=mysql_query($qer);
	$num=mysql_num_rows($res);
	if($num==0)
		{
			echo'<script language="javascript">window.location.href="anotherpage.php";</script>';
		}
	else if($num==1)
		{
			session_unregister("user_name");
			session_register("user_name");
			$_SESSION['user_name']=$_POST['username'];
			
						echo'<script language="javascript">window.location.href="welcome.php";</script>';
		}
}
?>

Shanti C

Reputation Points: 137

Solved Threads: 162

Posting Virtuoso

Offline

1,641 posts
since Jul 2008

Permalink

Jul 19th, 2008

Re: security using cookies/session variables

i want to compare the values for username and password with the values stored in a database.

i want this comparison to occur on the login page itself, so that in case either usrnam/passwd is wrong, i do not redirect the user...

pls sugest..

thx

akshit

Reputation Points: 10

Solved Threads: 0

Light Poster

Offline

46 posts
since Jun 2008

Permalink

Jul 19th, 2008

Re: security using cookies/session variables

see above answer which i have posted...

Shanti C

Reputation Points: 137

Solved Threads: 162

Posting Virtuoso

Offline

1,641 posts
since Jul 2008

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.

Previous Thread in PHP Forum Timeline: how can i fix may website data base??????????????

Next Thread in PHP Forum Timeline: dynamic form generation in PHP

DaniWeb Message

Cancel Changes

User Name
Password