LOGIN.PHP

 

<?php
session_start();
include("config.php");
connect();

$username = protect($_POST['username']);
$pass = md5($_POST['pass']);

//make sure pass and username are not blank
if(isset($_POST['submit'])){
if(trim($_POST['username']) == '' || $_POST['pass'] == ''){

echo"<center><p>I am sorry both password and username must be filled out</p></center>";

}else{
// check if pass and username are in database
$sql1 = "SELECT pass,uid FROM users WHERE uid = '".$username."' AND pass ='".$pass."'";
$sql2 = mysql_query($sql1) or die (mysql_error());
if(mysql_num_rows($sql2) == 0){

echo"<center><p>Your username or password are incorrect</p></center>";

}else{
$member =mysql_fetch_assoc($sql2);

$_SESSION['uid'] = $member['uid'];
mysql_close();
header("Location:members.php");

}



}


}
if(!isset($_POST['submit'])){

echo "<form method=\"POST\" action=\"login.php\">";
echo "<p><b>Username:</b> <input type=\"text\" name=\"username\"></p>";
echo "<p><b>Password:</b> <input type=\"password\" name=\"pass\"></p>";
echo "<p> <input type=\"submit\" name=\"submit\" value=\"Login\"></p>";
echo "</form>";
}





?>

 

MEMBERS.PHP

 

<?php
session_start();
//Check if session exist
if(!$_SESSION['uid']){
echo "<center>
<p>
Welcome guest you currently are not logged in <a href=\"register.php\">Register</a>-Or-<a href=\"login.php\">Login</a>
</p>
</center>";
}else{
echo "<center>
<p>
Welcome ".$_SESSION['uid']." <a href=\"logout.php\">Logout</a>
</p>
</center>";
}

?>

 

LOGOUT.PHP

 

 

<?php
session_start();
if($_SESSION['uid']){
session_destroy();
header("Location:login.php");
}
?>

You're not checking/sanitising $username before passing it to the query.

 

Also, you're assuming that $_SESSION['uid'] is valid in members.php - sessions can be forged across domains (so it's uncommon, but not impossible). See: http://sla.ckers.org/forum/read.php?4,22496