How to protect some pages.

Hi. Today I’m coding a simple registration form and it is divided in 3 parts (3 pages). I want to restrict the access on some pages to don’t miss a step (example: I’m doing the 1st step but I want to go directly to the 3th step, so I write in the address box “www.mysite.com/registration.php?page=3” but I want that it prints “Sorry, you must complete the step 1 and 2.” or similiar…).

Thanks for your useful support.

Hi there,

You might want to use sessions to accomplish this. Suppose you have these files:

register.html
register.php
register_final.php

register.html is the first landing page where users have to provide user info and process it with register.php.

Now under register.php, you may create a session variable (as token) to be use for register_final.php. Your register.php should look like this:

[php]
$email=$_POST[‘email’]; //form data from register.html
if (!isset($email)){
//prompt and redirect to register.html
}
else{
$_SESSION[‘email’]=$email;
//the rest of register.php code here
}
[/php]

In register_final.php:

[PHP]
if (!isset($_SESSION[‘email’])){
//prompt and redirect to register.html
}
else{
//the rest of register_final.php code here
}
[/PHP]

Those simple lines ensure that users will not miss a step during registration.

Cheers.

Thanks man. It works!

Uh. There is a bug about a part of my code. It should says the errors when I don’t write in all inputs.

This is the code:

form:
[php]


























Username: Scrivi secondo questo esempio: Nome_Cognome
Password: La Password per accedere al tuo account.
Confirm Password: Ridigita la tua Password scritta precedentemente.
Email: Scrivi la tua email per contattarti in futuro.
“); echo(’’+$error+’’); echo(”


[/php]

This is the “get error” code:
[php]$_GET[‘error’] = $interror;
if($interror == 1)
{
$error = “The account exist.”;
}
elseif($interror == 2)
{
$error = “Passwords don’t match.”;
}
elseif($interror == 3)
{
$error = “You must write in all inputs”";
}[/php]

I used the $_GET[‘error’] because I used this code to find the error (it’s a part of checkdata.php):
[php]if(isset($_POST[‘username’]) && isset($_POST[‘pass’]) && isset($_POST[‘pass2’]) && isset($_POST[‘email’]))
{
if($_POST[‘pass’] == $_POST[‘pass2’])
{
if(!$result || !$result2)
{
header(“location:reg.php?error=1”);
}
else
{
header(“location:final.php”);
}
}
else
{
header(“location:reg.php?error=2”);
}
}
else
{
header(“location:reg.php?error=3”);
}[/php]

It says only “0”.

Since you used POST as your method, you should use $_POST function to collect values from your form. Your checkdata.php should look like this:

[PHP]
$username=$_POST[‘username’];
$pass=$_POST[‘pass’];

//perform your query here…
[/PHP]

Ok. This is the full code of my checkdata.php file. But the $error value in the reg.php file says only “0”.

New bug: checkdata.php says HTTP 500 Internal Server Error

Code of checkdata.php:
[php]<?
include(“include/_functions.php”);
include(“include/_connector.php”);
include(“include/_structure.php”);

session_start();
session_regenerate_id(TRUE);

$name = $_POST[‘username’];
$password = numhash($_POST[‘pass’]);
$password2 = numhash($_POST[‘pass2’]);
$email = $_POST[‘email’];
$query = “SELECT * FROM users WHERE LOWER(Name) = LOWER(’$name’)”;
$query2 = “SELECT * FROM users WHERE email = $email”;
$result = mysql_query($query);
$result2 = mysql_query($query2);
if(isset($name) && isset($password) && isset($password2) && isset($email))
{
if($password == $password2)
{
if(!$result || !$result2)
{
header(“location:reg.php?error=1”);
}
else
{
header(“location:final.php”);
}
}
else
{
header(“location:reg.php?error=2”);
}
}
else
{
header(“location:reg.php?error=3”);
}
?>[/php]

Seems like you’ve a perfect code. By the way, it would be a great help if you could print full error message upon querying the database. Just call mysql_error() function to do this, as follows:

[PHP]
$result=mysql_query($query) or die(mysql_error());
$result2=mysql_query($query2) or die(mysql_error());
[/PHP]

You may want to try this much simpler codes for your checkdata.php:

[PHP]<?php

include(“include/_functions.php”);
include(“include/_connector.php”);
include(“include/_structure.php”);

session_start();
session_regenerate_id(TRUE);

$name=$_POST[‘username’];
$password=numhash($_POST[‘pass’]);
$password2=numhash($_POST[‘pass2’]);
$email=$_POST[‘email’];

if(isset($name) && isset($password) && isset($password2) && isset($email)){
if($password==$password2){

$query=“SELECT * FROM users WHERE LOWER(Name)=LOWER(’$name’)”;
$query2=“SELECT * FROM users WHERE email=$email”;

$result=mysql_query($query) or die(mysql_error());
$result2=mysql_query($query2) or die(mysql_error());

if(!$result || !$result2){
Header(‘Location:reg.php?error=1’);
}
else{
Header(‘Location:final.php’);
}
}
else{
Header(‘Location:reg.php?error=2’);
}
}
else{
Header(‘Location:reg.php?error=3’);
}
?>
[/PHP]

Don’t forget to start your PHP scripting block with <?php – for best practice… :slight_smile:

OK, solved!

Now I have the $error var bug… it says only “0”. How can I solve it?

I’m wonderin either how did you get that 0 as $error value. But anyway, how did you extract the value for ‘error’ variable in this URL: “reg.php?error=1”?

In your reg.php file, you may use GET method to pull the value being passed in the URL like $error=$_GET[‘error’];

Solved.

New bug ( :’(): The Logout page doesn’t work…

This is the code…
[php]<?php
session_start();
include(“inc/functions.php”);
setcookie(‘username’, $name, time()-86400);
setcookie(‘pass’, $pass, time()-86400);
setcookie(‘sessionlog’, $s_log, time()-86400);
session_destroy();
?>[/php]

As I understand it, you want to create cookie first (which will expire the next 24 hours) before finally killing current sessions.

Here’s my solution for you:
[php]

<?php session_start(); include("inc/functions.php"); $name='Some Values'; $pass='Some Values'; $s_log='Some Values'; $expire=time()+86400; setcookie('username', $name, $expire); setcookie('pass', $pass, $expire); setcookie('sessionlog', $s_log, $expire); session_destroy(); ?>

[/php]

It says only “not connected” now.

New bug: I’m coding the Terms and Conditions page and I want the user must click on the checkbox (I accept) and then click on submit button. But it doesn’t work…

This is the form code:
[php]
I accept.

[/php]

This is the check function:
[php]if(isset($_POST[‘accept’]))
{
header(“location:?p=index&sub=register&step=steptwo”);
}
else
{
echo(“”);
}[/php]

Something’s wrong with your form action. Replace it with:
[php]

[/php]

Your checkdata.php should look something like this:
[php]
if($_POST[‘step’]==‘stepone’){
if(isset($_POST[‘accept’])){
//redirect to step 2
}
else{
// alert
}
}
[/php]

Thanks a lot for your support :D.

New bug (I’m sorry if I’m going in off topic…):

This is a part of the registration, but it says the inputs are empty…

This is the code:
[php]elseif($step == “steptwo”)
{
$perreg = “10%”;
$interror = $_GET[‘error’];
if($interror == 1)
{
$error = “Account exist!”;
}
elseif($interror == 2)
{
$error = “Passwords don’t match.”;
}
elseif($interror == 3)
{
$error = “You must complete all the form!!”;
}
else
{
$error = “”;
}
echo(“

Registration form




















username:
Password:
Conferma la Password:
Email:

“.$error.”

“);
}
elseif($step == “checkdataa”)
{
$name = htmlspecialchars($_GET[‘username’]);
$password = htmlspecialchars($_GET[‘pass’]);
$password2 = htmlspecialchars($_GET[‘pass2’]);
$email = htmlspecialchars($_GET[‘email’]);
$query = “SELECT Name FROM users WHERE LOWER(Name) = LOWER(””.$name.”")";
$query2 = “SELECT email FROM users WHERE email = “”.$email.”"";
$result = mysql_query($query);
$result2 = mysql_query($query2);
		if($_GET['username'] == "" || $_GET['pass'] == "" || $_GET['pass2'] == "" || $_GET['email'] == "")
		{
			header("location:?p=index&sub=register&step=steptwo&error=3");	
		}
		else
		{
			if($result != $_GET['username'] || $result2 != $_GET['email'])
			{
				$_SESSION['username'] = $_GET['username'];
				$_SESSION['password'] = $_GET['password'];
				$_SESSION['email'] = $_GET['email'];
				header("location:?p=index&sub=register&step=stepthree");
			}
			else
			{
				header("location:?p=index&sub=register&step=steptwo&error=1");
			}
		}	
	}[/php]

Solved.

I have now a little problem. I made a function that randomize a numer and select the question to print but it don’t work…

I want to do a quiz with random questions.

This is the function:
[php]function onRandomQuestionQuiz()
{
$tot_question = 75;
switch(rand(1, $tot_question))
{
case 1:
{
$question = “Che significa Role play?”;
$answerA = “Gioco di ruolo”;
$answerB = “Gioco a gruppo”;
$answerC = “Gioco rolloso”;
$answerD = “Non ne ho idea”;
$answer = “A”;
}
case 2: [other questions…][/php]

Now I want to print these vars to the register page, but how do I do it?

Sponsor our Newsletter | Privacy Policy | Terms of Service