Here is my code, with important bits taken out. I am sure there are errors in here, but I am looking for why it is not displaying what they are.
/index.php
code:
<?php include($_SERVER['DOCUMENT_ROOT'] . "/t/head.php"); ?>
<h1 id="title">Test 1</h1>
<div id="content">
<h1>Please Login</h1>
<p>Please Login.</p>
</div>
<div id="menu">
<div id="login">
<?php echo(login->get_login_box()); ?>
</div>
<div id="links">
</div>
</div>
<?php include($_SERVER['DOCUMENT_ROOT'] . "/t/foot.php"); ?>
/t/head.php
code:
<?php require_once($_SERVER['DOCUMENT_ROOT'] . "/c/global.php"); ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Test 1</title>
<meta http-equiv="Content-type" content="text/html; charset=iso-8859-1" />
<style type="text/css" media="all">@import "/s/style01.css";</style>
</head>
<body>
/c/global.php
code:
<?php
require_once($_SERVER['DOCUMENT_ROOT'] . "/c/mysqldb.php");
require_once($_SERVER['DOCUMENT_ROOT'] . "/c/login.php");
session_start();
$database = new mysqldb();
$login = new login();
?>
/c/mysqldb.php
code:
<?php
class mysqldb {
var $dbhost;
var $db;
var $dbuser;
var $dbpassword;
var $results;
var $numberrows;
var $connection;
var $database;
function mysqldb() {
$this->dbhost = "localhost";
$this->db = "####";
$this->dbuser = "####";
$this->dbpassword = "####";
$this->connection = mysql_connect($this->dbhost,$this->dbuser,$this->dbpassword);
$this->database = mysql_select_db($this->db);
}
function query($sql){
$this->results = mysql_query($sql) or die ("The query has failed. " . mysql_error());
return $this->results;
}
}
?>
/c/login.php
code:
<?php
class login{
var $loginerror = "";
function login(){
$this->loginerror = "";
}
function get_error(){
return $this->loginerror;
}
function do_login($username,$password){
error_reporting(E_ALL);
//Validate Input
if(!preg_match("/^\w{4,16}$/",$username)
|| !preg_match("/^\w{8,16}$/",$password) ) return false;
$sql = "SELECT id, first_name, last_name FROM user WHERE ";
$sql.= "username = '" . $username . "' and ";
$sql.= "password = '" . md5($password) . "'";
$results = $database->query($sql);
if(!$results){
$this->loginerror = "Could not perform the query for the username and password.";
return false;
}
$num_rows = mysql_num_rows($results);
if($num_rows != 1){
$this->loginerror = "Could not match the username or password.";
return false;
}
$line = mysql_fetch_array($results);
$id = $line['id'];
$first_name = $line['first_name'];
$last_name = $line['last_name'];
$datetime = date("Y-m-d H:m:s");
$session_string = #######;
$session_hash = md5($session_string);
$sql = "UPDATE user SET last_login = '" . $datetime ."', ";
$sql.= "session_hash = '" . $session_hash . "' WHERE ";
$sql.= "id = " . $id;
$results = $database->query($sql);
if(!$results){
$this0>loginerror = "Could not update the the user information.";
return false;
}
$_SESSION['id'] = $id;
$_SESSION['session_hash'] = $session_hash;
$_SESSION['first_name'] = $first_name;
$_SESSION['last_name'] = $last_name;*/
return true;
}
function is_logged_in(){
$id = "";
$session_hash = "";
if(isset($_SESSION['id']) && isset($_SESSION['session_hash'])){
$id = $_SESSION['id'];
$session_hash = $_SESSION['session_hash'];
}
else {
$this->loginerror = "The user's session is not set.";
return false;
}
//Validate the input again, can't be too careful
if(!preg_match("/^\w{32}$/",$session_hash) || !preg_match("/^\d{1,32}$/",$id)){
$this->loginerror = "The user's session informatio is malformed.";
return false;
}
$sql = "SELECT " . $id . " FROM user WHERE ";
$sql.= "session_hash = " + $_SESSION['session_hash'];
$results = $database->query($sql);
if(!$results || mysql_num_rows($results) != 1){
$this->loginerror = "The session information is invalid.";
return false;
}
$line = mysql_fetch_array($results);
$id2 = $line['id'];
if($id != $id2){
$this->loginerror = "The session id is invalid.";
return false;
}
return true;
}
function get_login_box(){
if(!is_logged_in()){
$output = '<form method="POST" action="/login.php">';
$output.= '<label>Username</label>';
$output.= '<input type="text" name="username"/>';
$output.= '<label>Password</label>';
$output.= '<input type="password" name="password"/>';
$output.= '<div class="control">';
$output.= '<input type="submit" value="Login"/>';
$output.= '<input type="reset" value="Clear"/>';
$output.= '</div>';
$output.= '</form>';
}
else{
$output = '<p><strong>You are logged in as ' . $_SESSION['first_name'] . '</p>';
}
return $output;
}
}
/login.php
code:
<?php
require_once($_SERVER['DOCUMENT_ROOT'] . "/c/global.php");
if($_SERVER['REQUEST_METHOD'] == 'POST'){
$username = $_POST['username'];
$password = $_POST['password'];
if(login->do_login($username,$password)){
//header("Location: http://192.168.20.33/");
echo "Login Sucessful";
}
else{
echo login->get_error();
}
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Test 1</title>
<meta http-equiv="Content-type" content="text/html; charset=iso-8859-1" />
<style type="text/css" media="all">@import "/s/style01.css";</style>
</head>
<body>
<h1>You have failed to login.</h1>
<p>Click <a href="/index.php">Here</a> to try again.</p>
</body>
</html>
I think those are all the relevant bits and bobs, if I am missing something let me know.
Dan @ Code Town
(Edited by WarMage on 12-01-2004 17:08)