Hey,
At the minute it is really basic :D I am in the process of writing version two, and have already started adding in injection protection as well as md5 hash password encryption.
Login Form:
PHP Code:
<?php
session_start();
?>
<html>
<head>
</head>
<body>
<?php
if(!session_is_registered("username")){?>
<form action="loginFunction.php" method="post">
<b style="font-size:150%;">Log in</b><br/>
Username: <input type="text" name="username"/><br/>
Password: <input type="password" name="password"/><br/>
<input type="submit" value="Log in"/>
</form>
Don`t have an account?
<form action="registrationFunction.php" method="post"><br/>
<b style="font-size:150%;">Register</b><br/>
Username: <input type="text" name="user"/><br/>
Password: <input type="password" name="pass"/><br/>
Retype password: <input type="password" name="pass1"/><br />
<input type="submit" value="Register" />
</form>
<?php }
else{
echo 'Welcome ' . $_SESSION["username"] . '<br/><a href="logout.php">Log out</a>';
}?>
</body>
</html>
loginFunction.php
PHP Code:
<?php
include('config.inc.php');
if(mysql_num_rows(mysql_query("SELECT * FROM users WHERE username='".$_POST["username"]."' and password='".$_POST["password"]."'"))==1){
session_register("username");
$_SESSION['username'] = $_POST['username'];
header("location:login.php");
}
else {
echo 'Wrong username or password!';
}
?>
registrationFunction.php
PHP Code:
<?php
include('config.inc.php');
// Check to see if the username has already been taken
if(mysql_num_rows(mysql_query("SELECT * from users WHERE username='" . $_POST['user']. "'")) == 1) {
echo "Sorry this username is not available. Please pick another username and try again";
}
// Checking to see if the two passwords enter match
else if ($_POST['pass'] !== $_POST['pass1']) {
echo "The two passwords entered do not match. Please go back and try again!";
}
// Checking the length of the username
else if (strlen($_POST['user']) > 15) {
echo "The username you have chosen is too long!";
}
else if (strlen($_POST['user']) < 6) {
echo "The username you have chosen is too short!";
}
// Checking the length of the password
else if (strlen($_POST['pass']) >15) {
echo "The password you have chosen is too long!";
}
else if (strlen($_POST['pass']) < 6) {
echo "The password you have chosen is too short!";
}
// checking for invalid characters in the username and password
else if(preg_match('/[^0-9A-Za-z]/',$_POST['user'])){
echo "Invalid characters in username!";
}
else if(preg_match('/[^0-9A-Za-z]/',$_POST['pass'])){
echo "Invalid characters in password!";
}
else{
// Insert the data into the database
mysql_query("INSERT into users VALUES ('".$_POST['user']."','".$_POST['pass']."')") or die(mysql_error());
}
// redirects to success page
header('location:login.php');
?>
No passwords shown as they are stored in a database, and as you can see the connection info to the DB is written as a separate file :D
Regards, Zenax
LinkBack URL
About LinkBacks
Reply With Quote
Originally Posted by Zenax
