Hi everyone,
I am new to PHP and having been working through a tutorial on how to develop a PHP log in capability (in conjunction with MySQL). Everything is working just fine, but I dislike the idea that once you know the URL for the ‘secret’ landing page, you can navigate staright there without the need to log in!
What I am hoping to achieve is to only allow access to the landing page as part of the PHP/MySQL validation process or perhaps some other routine.
I would be grateful for any ideas/suggestions.
Not sure if it helps, but I’ve provided the PHP code as follows. As you will see, if the user name & password is correct you are directed to SecretPage.php.
[php<?php
/* Program: Login.php
*/
session_start();
switch (@$_POST[‘Button’])
{
case “Log in”:
include(“dogs.inc”);
$cxn = mysqli_connect($host,$user,$passwd,$dbname)
or die(“Query died: connect”);
$sql = “SELECT loginName FROM Member
WHERE loginName=’$_POST[fusername]’”;
$result = mysqli_query($cxn,$sql)
or die("Query died: fusername: ".mysqli_error($cxn));
$num = mysqli_num_rows($result);
if($num > 0) //login name was found
{
$sql = “SELECT loginName FROM Member
WHERE loginName=’$_POST[fusername]’
AND password=md5(’$_POST[fpassword]’)”;
$result2 = mysqli_query($cxn,$sql)
or die(“Query died: fpassword”);
$num2 = mysqli_num_rows($result2);
if($num2 > 0) //password matches
{
$_SESSION[‘auth’]=“yes”;
$_SESSION[‘logname’] = $_POST[‘fusername’];
$sql = “INSERT INTO Login (loginName,loginTime)
VALUES (’$_SESSION[logname]’,NOW())”;
$result = mysqli_query($cxn,$sql)
or die(“Query died: insert”);
header(“Location: SecretPage.php”);
}
else // password does not match
{
$message_1=“The Login Name, ‘$_POST[fusername]’
exists, but you have not entered the
correct password! Please try again.”;
$fusername = strip_tags(trim($_POST[‘fusername’]));
include(“login_form.inc”);
}
}
else // login name not found
{
$message_1 = “The User Name you entered does not
exist! Please try again.”;
include(“login_form.inc”);
}
break;
default:
include("login_form.inc");
}
?>][/php]