 PHP Page 3 - Filters and Login Systems for Web Application Security |
The Login page - PHPIn this article we will be building our application, using the concepts discussed in the previous articles. Any web site that is selective in the kind of users that it wants to grant access to will need some method of filtering. This filtering is usually done through a login system. This (and more) is what we will be building. This article is the third part of an eight-part series.
print this article SEARCH DEV SHED |
The login page is the main entrance to our site. Any user that wants to use our site needs to be authenticated by this script. We want only users that have registered to be allowed in, so we filter out those that are not registered through this script. <? session_start(); //someone registered? if(isset($_GET['reg'])){ $reg="Your details have been added, please login"; } $error=false; $errmsg=""; //has form been submitted if(isset($_POST['key'])){ //check that the username and password is not empty if( empty($_POST['uname']) && (empty($_POST['upass']))){ print "Please enter your username and password."; $errmsg="Please enter your username and password."; $error=true; } //check that the username and password is string if( is_numeric($_POST['uname']) && (is_numeric($_POST['upass']))){ print "Please enter a valid username and password."; $errmsg=" Please enter a valid username and password."; $error=true; } //if no error then start authentication process if(!$error){ //transfer to shorter var $n=$_POST['uname']; $p=$_POST['upass']; //if no error then start authentication process //connect to db include('../config.inc'); //clean using mysql cleaner $cleanuname=mysql_real_escape_string($n); $cleanupass=mysql_real_escape_string($p); $query="select uname,pw from users where uname='$cleanuname' and pw='$cleanupass' "; $result=mysql_query($query); $num=mysql_num_rows($result); if($num>0 ){ //put in session vars session_start(); $mytime=time(); $mytime=date("H:i:s A",$mytime); $_SESSION['time'] = $mytime; $_SESSION['status'] = 'logged'; $_SESSION['username'] = $cleanuname; //goto next page header("location:welcome.php"); exit; } }else{ $_SESSION['status'] = 'not logged'; $errmsg="Your username ($n) and password do not match, please try again."; } } ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"><!-- InstanceBegin template="/primary/Templates/was.dwt.php" codeOutsideHTMLIsLocked="false" --> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" /> <!-- InstanceBeginEditable name="doctitle" --> <title>WebSecure::Login</title> <!-- InstanceEndEditable --> <!-- InstanceBeginEditable name="head" --> <!-- InstanceEndEditable --> <link href="Templates/was.css" rel="stylesheet" type="text/css" /> <script language="javascript" type="text/javascript"> function checkform(pform1){ if(pform1.uname.value==""){ alert("Please enter a username") pform1.uname.focus() return false } if(pform1.pw.value==""){ alert("Please enter a password") pform1.pw.focus() return false } if(pform1.pw.value=="" && pform1.uname.value==""){ alert("Please make sure that you have entered your username and password") return false } return true } </script> </head> <body> <table width="99%" border="1"> <tr> <td bgcolor="#333333" class="header">Web Secure</td> </tr>
<tr> <td><!-- InstanceBeginEditable name="main" --> <form name="form1" onSubmit="return checkform(this)" method="post" action=""> <table width="41%" border="0" align="center" cellpadding="0" cellspacing="3"> <tr class="listtop"> <td colspan="3">Login Status:<? if(isset($msg)){ echo "$msg"; }elseif(isset($reg)){ echo "$reg"; }?></td> </tr> <tr> <td width="9%">Username</td> <td width="41%"><input name="uname" type="text" id="uname" size="50"></td> <td width="50%" rowspan="4"> </td> </tr> <tr> <td>Password</td> <td><input name="upass" type="text" id="upass" size="50"> <input type="hidden" name="key" /></td> </tr> <tr> <td> </td> <td><a href="../password.php">Forgotten your password?</a>|<a href="register.php">Register</a></td> </tr> <tr> <td> </td> <td><input type="submit" name="Submit" value="Login"></td> </tr> </table> </form> <!-- InstanceEndEditable --></td> </tr> <tr> <td class="copy">©2008</td> </tr> </table> </body> <!-- InstanceEnd --></html>
blog comments powered by Disqus |
|
|
|
|
|
|
|
/ 5 
