Sid tjek problemer med login tjek
Jeg har nogle problemer med mit login system. Når den skal tjekke om jeg er logget ind, virker det ikke vis jeg bruger ?index.php?page=home men bruger jeg den sådan home.php uden noget foran virker det fint. hvad kan det skylles og hvad skal jeg lave om.?!Loginform.
<? if($_SESSION['username'] == ""){?>
<div align="center">
<form method="POST" action="login.php">
<p>Username:<input type="text" name="username" size="20"></p>
<p>Password: <input type="password" name="password" size="20"></p>
<p><input type="submit" value="Login" name="Submit"></p>
</form>
</div>
<? }else{
include_once("functions.php");
connectToDatabase();
authenticateUser();
?>
Du er nu logget ind på denne hjemmeside:D
<? }?>
Login.
<?php
if ($_POST) { //If user has submitted data from form
if ($_POST['username'] == "" || $_POST['password'] == "") { //If any of the fields are empty
$error = "One or more fields are empty, please fill in all the fields";
} else { //Fields are not empty
session_start();// Needed to initialise session variables (i.e. start session :D)
$_SESSION['username'] = htmlspecialchars($_POST['username']);
$_SESSION['password'] = htmlspecialchars($_POST['password']);
header("location: index.php?page=protected&sid=".strip_tags(session_id()).""); //Redirect to protected.php, but can be whatever you want
}
}
if (isset($_GET['id'])) {//if the id var exists in the url
$error = "One or more fields you have entered are incorrect, please try again";
}
echo $error;
?>
Home.php // protected page
<?
include_once("functions.php");
connectToDatabase();
authenticateUser();
?>
Welcome to Gamersloot DK a page for friends. Share you information and game experience here.
functions.php
<?php
function authenticateUser() {
session_start();
$query = "SELECT username FROM db_users WHERE username = '".$_SESSION['username']."' AND password = '".md5($_SESSION[password])."';"; //Select from database the username & password the user entered
$result = mysql_query($query) or die('Query failed: ' . mysql_error()); //Query the db
if (!isset($_GET['sid'])) { // If the sid URL var exists in the url
header("location: index.php?page=login.php&id=1"); //does not exists
} else { //sid exists
if ($_GET['sid'] != session_id()) { //check URL sid with current sid
header("location: index.php?page=login.php&id=1"); //does not match
}
}
if (!mysql_num_rows($result)) { //If no match
header("location: index.php?page=login.php&id=0"); //redirect to login page with username/password error
}
}
?>
