Login, Redirect Multiple Users in PHP

I am working on login form where multiple users can sign in using their username and password. Depending on who it is, it will take them to certain file or link depending on how we set it for that user (john.doe goes to test1.php and jane.doe goes to test2.php).

When I try to login with username and password, it won't take me to the page. It keep saying the page has a redirect loop and it timed out. Also, how do I secure a page where once I logout, I can't go back to it by using the back button or type in the url directly? Please help. Thank you in advance. Here is what I have so far:

SQL has 4 fields

Field      Type         Collation           Null   Extra
id         int10                            No     auto_increment
username   varchar20    latin1_swedish_ci   No
password   varchar20    latin1_swedish_ci   No
redirect   varchar250   latin1_swedish_ci   No

I have 4 php files I work with. workspace.php, workspace_login.php, workspace_logout.php, workspace_files.php.

workspace.php - login screen

<form name="form" method="post" action="workspace_login.php">
<table>
<tr><td>Login</td></tr>
<tr><td>Username: <input name="username" type="text" style="width:215px" autocomplete="off"></td></tr>
<tr><td>Password: <input name="password" type="password" style="width:215px" autocomplete="off"></td></tr>
<tr><td><input type="submit" name="submit" value="Login"></td></tr>
</table>
</form>

workspace_login.php - login script

workspace_login.php - login script
<?php 
$host="localhost"; // Host name 
$username="*****"; // Mysql username 
$password="******"; // Mysql password 
$db_name="*****"; // Database name 
$tbl_name="workspace"; // Table name 

// Connect to server and select databse. 
mysql_connect("$host", "$username", "$password")or die("cannot connect"); 
mysql_select_db("$db_name")or die("cannot select DB"); 

// username and password sent from form 
$username=$_POST['username']; 
$password=$_POST['password']; 

// To protect MySQL injection (more detail about MySQL injection) 
$username = stripslashes($username); 
$password = stripslashes($password); 
$username = mysql_real_escape_string($username); 
$password = mysql_real_escape_string($password); 
$sql = "SELECT * FROM $tbl_name WHERE username='$username' and password='$password'"; 
$result = mysql_query($sql); 

// Mysql_num_row is counting table row 
$count = mysql_num_rows($result); 

// If result matched $username and $password, table row must be 1 row 
if($count == 1){ 
    // Register $username, $password and redirect to file "workspace_success.php" 
    $_SESSION['username'] = $username; 
    $_SESSION['password'] = $password; 
    // get the result set from the query
    $result = mysql_fetch_array($result); 
    // get the redirect column's value
    $redirect = trim($result['redirect']); 
    if ($redirect == '') {
        echo "No redirect value was set!";
    } else {
        header('Location: ' . $redirect);
        exit;
    }
} else { 
     echo "Wrong Password!";
} 
?>

workspace_logout.php - logout script

<?php
session_start();
$username=$_SESSION['username'];

if (session_destroy()){
unset($username);
}

if($username=="")
{
header("Location: workspace.php");
exit();
}
?>

workspace_files.php

<?php
session_start();
if (!isset($_SESSION['username'])) {
header('Location: workspace_files.php');
}
?>
<html>
<head>
<title>Secured Page</title>
</head>
<body>
<p>Welcome <b><?php echo $_SESSION['username']; ?></b>
Information here.</p>
<p><a href="logout.php">Logout</a></p>
</body>
</html>

6

Contributors

75

Replies

2 Months

Discussion Span

7 Months Ago

Last Updated

76

Views

diablo4151

Light Poster

36 posts since Aug 2012

Reputation Points: 0

Solved Threads: 0

Skill Endorsements: 0

Login, Redirect Multiple Users in PHP

This article has been dead for over three months: Start a new discussion instead