I have done a few log in system posts in the past, and with the help I received here, they ended up working. Instead of having a login for a few directories, I want to make a single log in form at the root.
So if I wanted to protect:
/test.php
/dir1/
/dir3/form.php
When I visit the links above, I want to be bounced to /login.php. I have only tried this on one page so far. On that page I put:
You POST your login details to the page that redirected to login.php, instead of to login.php which has the code for actually logging you in. It’s a loop where the form processing code never gets run.
Check what is in $_SESSION[‘this_url’] - that is where your POST goes.
You should exit; after a header(‘Location…’); All that does function does is send a header to the browser, the “browser” doesn’t have to follow, and your script will still be executing.
hash, the $_SESSION[‘this_url’] is in test.php, it would also be in dir/index.php, /dir3/form.php as well as any other page/directory, that needs ‘locked’. The code in those pages looks like:
session_start();
if(!isset($_SESSION['user'])){
header('Location: login.php');
}
$this_url = $_SERVER['REQUEST_URI']; // this page relative to root
$_SESSION['this_url'] = $this_url;
Maybe the $_SESSION[‘this_url’] needs to be initiated prior to header redirect? These pages don’t necessarily have POST information. For example, test.php just has code snippets. So I am not following what your first comment means.
this is your login form action? this is where your form submits values to. think about it
// protected
if not logged in
store redirect url
send to login page
else
page
// login.php
if login worked
send to redirect url
else
show form and erros
Hi hash, sorry for the delay
Yes that is my login form action. I was thinking you meant what was the action of the form on test.php, so I was confused because I didn’t think that I said test.php had a form. Would a protected page then becomes a big if else statement?
test.php
<?php
session_start();
if(isset($_SESSION['user'])){
$this_url = $_SERVER['REQUEST_URI']; // this page relative to root
$_SESSION['this_url'] = $this_url;
header('Location: login.php');
exit;
} else { ?>
<!DOCTYPE html PUBLIC "-//W3C
....
<?php } //end else ?>
Correct me if I am off, it checks to see if submit is set, if not, show form. If it is set, check if the user/pass match. If not show form again, with user filled in.
I think part of the the issue is not quite knowing about how isset works exactly. Several sites say isset works like this:
if(isset($blah)){
#evaluate as false
}else{
#eval as true
}
There are sites that say that true is first then false. Not sure which is correct cause I have done a few examples. I have gotten both answers, but that may be server lag…
You’re saying that the browser should POST the data from this form to the page at “this_url”, which is the one that redirected them to the login form.
But that’s not where you want it POSTed, you want it sent to login.php which is where the code to process this form is.
If you POST it to the page that requires a login, you’re still not logged in, it’s going to redirect you right back to login.php and show the form again.
/facepalm
oi I didn’t realize that is what you guys meant. There is something I am still not catching something, since I am still in a loop. i made it login.php as well as putting the full path, neither work
I think that at this stage it would be useful to see the full code for a test form that bounces you to the login page, and the code for the login page itself.
