Login script with expiration date verification

[GriffN84]

Evening All,

I'm new here and new to PHP, so please take it easy on me! =]

I'm working on a php login script that would allow a user to enter their last name or their username in the username field and their password. Upon submit, check for a record with last name or username, password and expiration date is greater than todays date. I've got the username or last name and password part down and working.

Background info: the 'Expiration Date' field is a usual text field in the SQL db and i'm not going to be able to change that.

This is what i have so far:

$cur_date = date("n/j/Y");
$sql="SELECT * FROM $tbl_name WHERE username='$myusername' or lastname='$myusername' and password='$mypassword' and 'Expiration Date' > $cur_date";

Thanks in advance everyone!

-Jacob

[gilgil2]

Hi

If &cur_date is a text field and not a MySql date field then I don't think >$cur_date will work, you need to change that field to a properly formatted date field, although I realise you say you can't. I'm not sure what to do about that. Maybe someone else has a suggestion?

Also I don't think you need ' ' round $myusername or $mypassword, my understanding is that is only used for numbers.

[diafol]

Personally I'd have expiration date as unix timestamp (integer) or at the very least a date (unix format): Y-m-d.

$now = time();
$sql="SELECT * FROM `$tbl_name` WHERE (`username` ='$myusername' OR `lastname` ='$myusername') AND `password`='$mypassword' AND `expiry` > $now";

BTW - using more than one word for a field can be bothersome

[veedeoo]

Hi,
ADDED LATER: MY post is late, so please consider diafol's response before this.

This is just a humble suggestion for your script. Why not use a unix timestamp instead of the actual human readable date.

For example, an account can have a date verification expiration two days from the date it was sent to the user. Both beginTime and expiry must be stored in the database.

  ## get the current time when the expiratio starts ticking.
  $beginTime = time();

  ## expire this in 1 day from the curTime above.
   //$expriry = strtotime('+1 day', $beginTime);

  ## we can use the above expiry or below..

  $expiry = strtotime("+24 hours", $curTime);

  ## now we can approximate if the expiry time has been exceeded or not.

  if(time() >= $expriry){

  echo "oops, your activation noticed had expired";

  }

  else{

  echo "Your ok..";

  }

The $beginTime above refers to the time recorded, when the expiration begins to countdown. The time() in the if statement is the current time, when the user access the account for activation.