Managing Users with PHP Sessions and MySQL

[Gaurav]

Hi,

The script is excellent, but I don't understand one thing. After you login as a successful user, the "accesscontrol.php" script appears to be blank. There should be some message which appears for a successful user. Moreover the "accesscontrol.php" script is also an include file. So this message should only appear on the page, which the user sees after logging in for h first time. Has anyone figured this out as yet?

[CptCochise]

Hi,

I know its a little late, but I had the same result as Gaurav. I don't think the author ever intended that page to be used on its own. If you were to log into the protectedpage.php page, you will notice that you are logged in and greeted with a welcome message. Therefore, I believe the author intended it to be used as a processing script only. I did however find the lack of a logout feature dissapointing.

[Alphz]

if you just want a logout page then you can always put a link that performs a session destroy and self, right?

[anonymous]

Isn't in necessary to sanitise user's input into database?

[varney]

how do i setup the database for this (there is no included sql file, please make it easy for beginners!!)?

[Howitzer]

One small flaw in the table creation (Page 3)...

-> password CHAR(16) NOT NULL,

The size of this field needs to be much larger, the encoded passwords created on my site (PHP version 4.4.8 & MySQL version 4.1.22)were over 40 characters long and it took me a while to figure out why I could never log in.

Increasing the size to 100 fixed the problem and it now works perfectly.

-> password CHAR(100) NOT NULL,

[jaysmoke]

i did everything according to this tutorial but when i try to log in....it just tells me access denied and that i should click here to try again...

[parker]

I don't see any mention of how to close the database connection when finished.

[T]

This is great. Thanks a lot!

[mubeen]

when i execute the signup.php file and click on the OK button i recieve the following message
"The site database is unavailable."

[rafs]

You are getting the site database is unavailable because you have forgotten to change the name of the database set in this example to your own database name, make sure you change whatever he has in bold.

I have a problem too, i dont know if someone could help me out, im a newbie in Mysql but this example is quite useful, I made it run perfectly, I can actually register and my database shows everything perfect, userid, name, email, and encrypted password. Once i receive an email with an automatic password i try to login using the userid and the password sent to me by email... I cannot login, i get "Your user ID or password is incorrect, or you are not a registered user on this site"... I am being REALLY CAREFUL by the way, I have registered a bunch of users and have gotten different password and i am just not able to login, what could be the problem?

[RichardN]

rafs: refer to Howitzer's comment about the column not being initially big enough to save an encrypted password in the mysql database. Increase the column size to at least 100 or remove the PASSWORD encoding functionality from the line of code below:

From

password = PASSWORD('$newpass'),

to

password = '$_POST[newpass]',

However this is not the most secure solution.

[kenwilly]

Every time I try to submit the form to create a new user I get "Object not found! Error 404.

Any ideas?

[paul_wilkins]

A 404 error means that the page it's trying to load doesn't exist.

[rponte]

The Signup page worked wonderfully I received my new password by email but when I try to login the system notifies me that I entered the wrong username/password. I verified my db and my password is hashed so its fine.
Any thoughts??

[rponte]

Where in the code does it tell to redirect the user to protectedpage.php? It it automatically because it detects the <?include protectedpage.php?> in the web page.
Thanks;
Ricky

[captnbirdman]

with reference to creating the script, shortly after creating the common.php and db.php, where would I put the
if (!isset($_POST['submitok'])):
// Display the user signup form
...
it is causing me confusion and don't really understand why it would go in front of the html tag of the "New User Registration" form, when I was in the understanding that this should be the signup script.
thanks,
C