Hello all!! Could some please take a look at my php profile page. Here is my problem: On my index page i have a members login witch connects to my database to validate username, if the username exists they are diverted to the profile page, all this works apart from this: When the user is diverted to the profile page i would like there profile data from the databse to display in the profile page. I no that i need to use session id or a cookie, but i simply dont no how to do it...

 

I will post the entire code of my profile page. Please dont feel (Oh god am not going near that becuase the amount of code posted) becuase its just the cookie or session code that needs adding... Am new to PHp but learning very quickly...

 

I have attached my php profile page to this post... Like i say it prbebly just a couple of lines of code, my main problem is not knowing were to put it, so it works properly...

 

Cheers.

 

Please help!!!

Accounts.php

Hi there andy,

 

Handling an authentication is quite tough for a newbie to get his/her head around, so I will share my current method of doing so...

 

Firstly, when a user enters his/her email and password, I generate a random hash like so:

$rand = sha1( rand() );

then use this query:

UPDATE `users` SET `randhash` = '$rand' WHERE `username` = '$username' AND `password` = '$password' LIMIT 1

 

To ascertain wether the user entered the correct details, I use mysql_affected_rows, which returns either 1 (true) or 0 (false).

 

If this returns 1, I set a cookie or session as follows:

setcookie( "site_".$rand, sha1($username), time()+3600 );

 

as you can see, this sets the KEY to contain the randhash, and the value is a hashed version of the username.

 

how to recall the user auth:

because the key is not static, we need to loop through the cookies to find which one is relevant, using strlen...

foreach( $_COOKIE as $coo=>$kie ) {
  if( strlen( $coo ) == 45 && strlen( $kie ) == 40 ) {
   $cookie_key = $coo;
   $cookie_val = $kie;
  }
}

 

this isolates the correct cookie - the lengths 45 and 40 are used, because the SHA1 hash functions returns a string of length 40. Now that we have the key and value, we need to clean and run a query:

 

$cookie_key = substr( $cookie_key, 5 );
$query = mysql_query( "SELECT * FROM `users` WHERE `randhash` = '$cookie_key' AND SHA1(username) = '$cookie_val' LIMIT 1");

 

once again, we can do a mysql_num_rows() on $query to ascertain wether the user was logged in, and the $query also allows you to read all the user data at that point.

 

hope this helps, it is complicated but quite secure.

Hi there andy,

 

Handling an authentication is quite tough for a newbie to get his/her head around, so I will share my current method of doing so...

 

Firstly, when a user enters his/her email and password, I generate a random hash like so:

$rand = sha1( rand() );

then use this query:

UPDATE `users` SET `randhash` = '$rand' WHERE `username` = '$username' AND `password` = '$password' LIMIT 1

 

To ascertain wether the user entered the correct details, I use mysql_affected_rows, which returns either 1 (true) or 0 (false).

 

If this returns 1, I set a cookie or session as follows:

setcookie( "site_".$rand, sha1($username), time()+3600 );

 

as you can see, this sets the KEY to contain the randhash, and the value is a hashed version of the username.

 

how to recall the user auth:

because the key is not static, we need to loop through the cookies to find which one is relevant, using strlen...

foreach( $_COOKIE as $coo=>$kie ) {
  if( strlen( $coo ) == 45 && strlen( $kie ) == 40 ) {
   $cookie_key = $coo;
   $cookie_val = $kie;
  }
}

 

this isolates the correct cookie - the lengths 45 and 40 are used, because the SHA1 hash functions returns a string of length 40. Now that we have the key and value, we need to clean and run a query:

 

$cookie_key = substr( $cookie_key, 5 );
$query = mysql_query( "SELECT * FROM `users` WHERE `randhash` = '$cookie_key' AND SHA1(username) = '$cookie_val' LIMIT 1");

 

once again, we can do a mysql_num_rows() on $query to ascertain wether the user was logged in, and the $query also allows you to read all the user data at that point.

 

hope this helps, it is complicated but quite secure.

 

 

Thanks very much, this is proof to me that this forum is much more helpfull & polite than "Web Forumz"!!! Just one question, do i put this code in the login page or in my profile page??? Second of all could you bunch together what the final code should look like please mate, so i have one bunch of code to together, this way i no i will have the code in the right order....

 

Thanks very much for your help mate..

 

Cheers

Hi andy,

 

I currently use "object orientated" programming methods, which means that this code is all stored in one file (for me, class.users.php) as a class, but the code there is split into two parts, the "login" and the "recall" methods.

 

The login function needs to take "username" and "password", and optionally wether to use a cookie or a session (short of long memory), and with those variables it needs to query + update the database, and possibly set a cookie.

 

The recall function takes no variables, and needs to figure out which cookie holds the correct data, (possibly) query the database, and keep the users data in a global variable for later access.

 

Here is an example of the functions, assuming database connection is done prior to use, and the table names are all correct:

function login( $username, $password, $method = "cookie" ) {
// IRL you would do a form of string cleaning here, do a google for "mysql clean string"
$rand   = sha1( rand() );
$query = mysql_query( "UPDATE `users` SET `randhash` = '$rand' WHERE `username` = '$username' AND `password` = '$password' LIMIT 1" );
if( mysql_affected_rows() == 1 ) {
   if( $method == "cookie" ) {
		  setcookie( "site_".$rand, sha1( $username ), time()+3600*24*14 ); // two week lifespan
   } else {
		  @session_start();
		  $_SESSION['site_'.$rand] = sha1( $username ); // approx 1 hour lifespan
   }
   return true;
} else {
   return false; // no login, incorrect data
}
}

function recall() {
@session_start();
$memory = $_COOKIE + $_SESSION;
foreach( $_COOKIE as $coo=>$kie ) {
   if( strlen( $coo ) == 45 && strlen( $kie ) == 40 ) {
	   $cookie_key = $coo;
	   $cookie_val = $kie;
   }
}
$cookie_key = substr( $cookie_key, 5 );
$query = mysql_query( "SELECT * FROM `users` WHERE `randhash` = '$cookie_key' AND SHA1(username) = '$cookie_val' LIMIT 1");
return (boolean) $query; // returns TRUE or FALSE
}

Nice one buddy!!! Thanks very much!!! i will start busting my brains with this until i have managed it.. Good day & take care

 

 

 

 

 

Hi andy,

 

I currently use "object orientated" programming methods, which means that this code is all stored in one file (for me, class.users.php) as a class, but the code there is split into two parts, the "login" and the "recall" methods.

 

The login function needs to take "username" and "password", and optionally wether to use a cookie or a session (short of long memory), and with those variables it needs to query + update the database, and possibly set a cookie.

 

The recall function takes no variables, and needs to figure out which cookie holds the correct data, (possibly) query the database, and keep the users data in a global variable for later access.

 

Here is an example of the functions, assuming database connection is done prior to use, and the table names are all correct:

function login( $username, $password, $method = "cookie" ) {
// IRL you would do a form of string cleaning here, do a google for "mysql clean string"
$rand   = sha1( rand() );
$query = mysql_query( "UPDATE `users` SET `randhash` = '$rand' WHERE `username` = '$username' AND `password` = '$password' LIMIT 1" );
if( mysql_affected_rows() == 1 ) {
   if( $method == "cookie" ) {
		  setcookie( "site_".$rand, sha1( $username ), time()+3600*24*14 ); // two week lifespan
   } else {
		  @session_start();
		  $_SESSION['site_'.$rand] = sha1( $username ); // approx 1 hour lifespan
   }
   return true;
} else {
   return false; // no login, incorrect data
}
}

function recall() {
@session_start();
$memory = $_COOKIE + $_SESSION;
foreach( $_COOKIE as $coo=>$kie ) {
   if( strlen( $coo ) == 45 && strlen( $kie ) == 40 ) {
	   $cookie_key = $coo;
	   $cookie_val = $kie;
   }
}
$cookie_key = substr( $cookie_key, 5 );
$query = mysql_query( "SELECT * FROM `users` WHERE `randhash` = '$cookie_key' AND SHA1(username) = '$cookie_val' LIMIT 1");
return (boolean) $query; // returns TRUE or FALSE
}