So what we are trying to do is stop people from seeing pages unless they are logged in. We also don’t want any people going directly to the url to see the page either.
The first thing that we need to do is to create a session and a session variable.
Assuming you have a html form with a “username” and a “password” field, it would post a page that has this script
//##################################
// Author: Anthony Damasco
//
// Purpose: The login form posts the username and password to this script. We check if the password is correct and then display the main page, else we sent the user to
// “incorrect_password.php”
//
// Directions: Post a form with 2 text fields to this script. Name them “username” and “password”. then just change the include files in the if else below .
//##################################
// Connect to the database
//…………………………………
include “../includes/database_connect.php”;
// if both Fields are filled out proceed with check
if(isset($_POST['username']) && isset($_POST['password']))
{
// escape the variables
$username = mysql_real_escape_string($_POST['username']);
$password = mysql_real_escape_string($_POST['password']);
// If the username and password exsist in the database then you get in, else, you get to see the wrong password page
$sql = “SELECT * FROM Users WHERE `username`=’$username’ AND `password`=’$password’”;
$result = mysql_query($sql);
if(mysql_num_rows($result) == 1)
{
session_start();
// create the session variables
$user = mysql_fetch_assoc($result);
foreach($user as $key => $value)
{
$_SESSION[$key] = $value;
}
//The username and password were correct, show em the goods
include “main.php”;
}
else
{
// they got the password wrong
include ‘incorrect_password.php’;
}
mysql_close();
}
else
{
// they got the password wrong
include ‘incorrect_password.php’;
}
Now that the session variables are set, every page that will have protection, this user will be able to see. But no one else will. This is how we protect the pages.
Make a page called “password_check.php” and use the code below.
<?php
//##################################
// Author: Anthony Damasco
// Purpose: To protect files with a password
// Directions: Include this file at the top of the php pages. Do not start a new session, it is being created here.
//##################################
// check to see if there is a session, if not, create one. Woot
$ifsession = session_id();
if ( isset($ifsession)) {
session_start();
}
// If “password” is not stored in the session then show them nothing, and exit the script completely. this will also exit HTML and stop the page from displaying as long as the file extension is “.php”
if (!isset($_SESSION['password']))
{
include ‘not_logged_in.php’;
exit();
// else continue script
} else {
// Continue Script
}
?>
Now, on all the pages that need protection you just put an ” include “password_check.php”; ” at the top of the page, now you won’t have to start a session at the top of the protected pages because the session is already being created in this script.
Happy Coding!
