1)create a database. name it whatever you want.(EX: members)
2)create a new file and call it db_connect.php
insert the following code into the file and change the database variables to match yours.
CODE
<?php
$dbhost = 'localhost';
// your database username.
$dbusername = 'database_username';
// the password that corresponds to the above username.
$dbpasswd = 'password';
// the database name that your username is associated with.
$database_name = 'database_name';
$connection = mysql_connect("$dbhost","$dbusername","$dbpasswd")
or die ("Couldn't connect to server.");
$db = mysql_select_db("$database_name", $connection)
or die("Couldn't select database.");
// we write this later on, ignore for now.
include('check_login.php');
?>
$dbhost = 'localhost';
// your database username.
$dbusername = 'database_username';
// the password that corresponds to the above username.
$dbpasswd = 'password';
// the database name that your username is associated with.
$database_name = 'database_name';
$connection = mysql_connect("$dbhost","$dbusername","$dbpasswd")
or die ("Couldn't connect to server.");
$db = mysql_select_db("$database_name", $connection)
or die("Couldn't select database.");
// we write this later on, ignore for now.
include('check_login.php');
?>
3)now save it.
4)now go to your phpadmin and create a table with this query:
CODE
CREATE TABLE users (
id int(10) DEFAULT '0' NOT NULL auto_increment,
username varchar(40),
password varchar(50),
regdate varchar(20),
email varchar(100),
website varchar(150),
location varchar(150),
show_email int(2) DEFAULT '0',
last_login varchar(20),
PRIMARY KEY(id))
id int(10) DEFAULT '0' NOT NULL auto_increment,
username varchar(40),
password varchar(50),
regdate varchar(20),
email varchar(100),
website varchar(150),
location varchar(150),
show_email int(2) DEFAULT '0',
last_login varchar(20),
PRIMARY KEY(id))
5)now create a new file and call it register.php and insert the following code:
CODE
<?php
require('db_connect.php'); // database connect script.
?>
<html>
<head>
<title>Register an Account</title>
</head>
<body>
<?php
if (isset($_POST['submit'])) { // if form has been submitted
/* check they filled in what they supposed to,
passwords matched, username
isn't already taken, etc. */
if (!$_POST['uname'] || !$_POST['passwd'] ||
!$_POST['passwd_again'] || !$_POST['email']) {
die('You did not fill in a required field.');
}
// check if username exists in database.
if (!get_magic_quotes_gpc()) {
$_POST['uname'] = addslashes($_POST['uname']);
}
$qry = "SELECT username FROM users WHERE username = '".$_POST['uname']."'";
$sqlmembers = mysql_query($qry);
$name_check = mysql_fetch_array ($sqlmembers);
$name_checkk = mysql_num_rows ($sqlmembers);
if ($name_checkk != 0) {
die('Sorry, the username: <strong>'.$_POST['uname'].'</strong>'
. ' is already taken, please pick another one.');
}
// check passwords match
if ($_POST['passwd'] != $_POST['passwd_again']) {
die('Passwords did not match.');
}
// check e-mail format
if (!preg_match("/.*@.*..*/", $_POST['email']) ||
preg_match("/(<|>)/", $_POST['email'])) {
die('Invalid e-mail address.');
}
// no HTML tags in username, website, location, password
$_POST['uname'] = strip_tags($_POST['uname']);
$_POST['passwd'] = strip_tags($_POST['passwd']);
$_POST['website'] = strip_tags($_POST['website']);
$_POST['location'] = strip_tags($_POST['location']);
// check show_email data
if ($_POST['show_email'] != 0 & $_POST['show_email'] != 1) {
die('Nope');
}
/* the rest of the information is optional, the only thing we need to
check is if they submitted a website,
and if so, check the format is ok. */
if ($_POST['website'] != '' & !preg_match("/^(http|ftp):///", $_POST['website'])) {
$_POST['website'] = 'http://'.$_POST['website'];
}
// now we can add them to the database.
// encrypt password
$_POST['passwd'] = md5($_POST['passwd']);
if (!get_magic_quotes_gpc()) {
$_POST['passwd'] = addslashes($_POST['passwd']);
$_POST['email'] = addslashes($_POST['email']);
$_POST['website'] = addslashes($_POST['website']);
$_POST['location'] = addslashes($_POST['location']);
}
$regdate = date('m d, Y');
$insert = "INSERT INTO users (
username,
password,
regdate,
email,
website,
location,
show_email,
last_login)
VALUES (
'".$_POST['uname']."',
'".$_POST['passwd']."',
'$regdate',
'".$_POST['email']."',
'".$_POST['website']."',
'".$_POST['location']."',
'".$_POST['show_email']."',
'Never')";
$sqlmembers = mysql_query($insert);
?>
<h1>Registered</h1>
<p>Thank you, your information has been added to the database,
you may now <a href="login.php" title="Login">log in</a>.</p>
<?php
} else { // if form hasn't been submitted
?>
<h1>Register</h1>
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
<table align="center" border="1" cellspacing="0" cellpadding="3">
<tr><td>Username*:</td><td>
<input type="text" name="uname" maxlength="40">
</td></tr>
<tr><td>Password*:</td><td>
<input type="password" name="passwd" maxlength="50">
</td></tr>
<tr><td>Confirm Password*:</td><td>
<input type="password" name="passwd_again" maxlength="50">
</td></tr>
<tr><td>E-Mail*:</td><td>
<input type="text" name="email" maxlength="100">
</td></tr>
<tr><td>Website:</td><td>
<input type="text" name="website" maxlength="150">
</td></tr>
<tr><td>Location</td><td>
<input type="text" name="location" maxlength="150">
</td></tr>
<tr><td>Show E-Mail?</td><td>
<select name="show_email">
<option value="1" selected="selected">Yes</option>
<option value="0">No</option></select>
</td></tr>
<tr><td colspan="2" align="right">
<input type="submit" name="submit" value="Sign Up">
</td></tr>
</table>
</form>
<?php
}
?>
</body>
</html>
require('db_connect.php'); // database connect script.
?>
<html>
<head>
<title>Register an Account</title>
</head>
<body>
<?php
if (isset($_POST['submit'])) { // if form has been submitted
/* check they filled in what they supposed to,
passwords matched, username
isn't already taken, etc. */
if (!$_POST['uname'] || !$_POST['passwd'] ||
!$_POST['passwd_again'] || !$_POST['email']) {
die('You did not fill in a required field.');
}
// check if username exists in database.
if (!get_magic_quotes_gpc()) {
$_POST['uname'] = addslashes($_POST['uname']);
}
$qry = "SELECT username FROM users WHERE username = '".$_POST['uname']."'";
$sqlmembers = mysql_query($qry);
$name_check = mysql_fetch_array ($sqlmembers);
$name_checkk = mysql_num_rows ($sqlmembers);
if ($name_checkk != 0) {
die('Sorry, the username: <strong>'.$_POST['uname'].'</strong>'
. ' is already taken, please pick another one.');
}
// check passwords match
if ($_POST['passwd'] != $_POST['passwd_again']) {
die('Passwords did not match.');
}
// check e-mail format
if (!preg_match("/.*@.*..*/", $_POST['email']) ||
preg_match("/(<|>)/", $_POST['email'])) {
die('Invalid e-mail address.');
}
// no HTML tags in username, website, location, password
$_POST['uname'] = strip_tags($_POST['uname']);
$_POST['passwd'] = strip_tags($_POST['passwd']);
$_POST['website'] = strip_tags($_POST['website']);
$_POST['location'] = strip_tags($_POST['location']);
// check show_email data
if ($_POST['show_email'] != 0 & $_POST['show_email'] != 1) {
die('Nope');
}
/* the rest of the information is optional, the only thing we need to
check is if they submitted a website,
and if so, check the format is ok. */
if ($_POST['website'] != '' & !preg_match("/^(http|ftp):///", $_POST['website'])) {
$_POST['website'] = 'http://'.$_POST['website'];
}
// now we can add them to the database.
// encrypt password
$_POST['passwd'] = md5($_POST['passwd']);
if (!get_magic_quotes_gpc()) {
$_POST['passwd'] = addslashes($_POST['passwd']);
$_POST['email'] = addslashes($_POST['email']);
$_POST['website'] = addslashes($_POST['website']);
$_POST['location'] = addslashes($_POST['location']);
}
$regdate = date('m d, Y');
$insert = "INSERT INTO users (
username,
password,
regdate,
email,
website,
location,
show_email,
last_login)
VALUES (
'".$_POST['uname']."',
'".$_POST['passwd']."',
'$regdate',
'".$_POST['email']."',
'".$_POST['website']."',
'".$_POST['location']."',
'".$_POST['show_email']."',
'Never')";
$sqlmembers = mysql_query($insert);
?>
<h1>Registered</h1>
<p>Thank you, your information has been added to the database,
you may now <a href="login.php" title="Login">log in</a>.</p>
<?php
} else { // if form hasn't been submitted
?>
<h1>Register</h1>
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
<table align="center" border="1" cellspacing="0" cellpadding="3">
<tr><td>Username*:</td><td>
<input type="text" name="uname" maxlength="40">
</td></tr>
<tr><td>Password*:</td><td>
<input type="password" name="passwd" maxlength="50">
</td></tr>
<tr><td>Confirm Password*:</td><td>
<input type="password" name="passwd_again" maxlength="50">
</td></tr>
<tr><td>E-Mail*:</td><td>
<input type="text" name="email" maxlength="100">
</td></tr>
<tr><td>Website:</td><td>
<input type="text" name="website" maxlength="150">
</td></tr>
<tr><td>Location</td><td>
<input type="text" name="location" maxlength="150">
</td></tr>
<tr><td>Show E-Mail?</td><td>
<select name="show_email">
<option value="1" selected="selected">Yes</option>
<option value="0">No</option></select>
</td></tr>
<tr><td colspan="2" align="right">
<input type="submit" name="submit" value="Sign Up">
</td></tr>
</table>
</form>
<?php
}
?>
</body>
</html>
6)save the file.
7)Create a new file and call it check_login.php and add this code:
CODE
<?php
session_start();
if (!isset($_SESSION['username']) || !isset($_SESSION['password'])) {
$logged_in = 0;
return;
} else {
// remember, $_SESSION['password'] will be encrypted.
if(!get_magic_quotes_gpc()) {
$_SESSION['username'] = addslashes($_SESSION['username']);
}
// addslashes to session username before using in a query.
$qry = "SELECT password FROM users WHERE username = '".$_SESSION['username']."'";
$sqlmembers = mysql_query($qry);
$pass = mysql_num_rows($sqlmembers);
if($pass != 1) {
$logged_in = 0;
unset($_SESSION['username']);
unset($_SESSION['password']);
// kill incorrect session variables.
}
$db_pass = mysql_fetch_array ($sqlmembers);
// now we have encrypted pass from DB in
//$db_pass['password'], stripslashes() just incase:
$db_pass['password'] = stripslashes($db_pass['password']);
$_SESSION['password'] = stripslashes($_SESSION['password']);
//compare:
if($_SESSION['password'] == $db_pass['password']) {
// valid password for username
$logged_in = 1; // they have correct info
// in session variables.
} else {
$logged_in = 0;
unset($_SESSION['username']);
unset($_SESSION['password']);
// kill incorrect session variables.
}
}
// clean up
unset($db_pass['password']);
$_SESSION['username'] = stripslashes($_SESSION['username']);
?>
session_start();
if (!isset($_SESSION['username']) || !isset($_SESSION['password'])) {
$logged_in = 0;
return;
} else {
// remember, $_SESSION['password'] will be encrypted.
if(!get_magic_quotes_gpc()) {
$_SESSION['username'] = addslashes($_SESSION['username']);
}
// addslashes to session username before using in a query.
$qry = "SELECT password FROM users WHERE username = '".$_SESSION['username']."'";
$sqlmembers = mysql_query($qry);
$pass = mysql_num_rows($sqlmembers);
if($pass != 1) {
$logged_in = 0;
unset($_SESSION['username']);
unset($_SESSION['password']);
// kill incorrect session variables.
}
$db_pass = mysql_fetch_array ($sqlmembers);
// now we have encrypted pass from DB in
//$db_pass['password'], stripslashes() just incase:
$db_pass['password'] = stripslashes($db_pass['password']);
$_SESSION['password'] = stripslashes($_SESSION['password']);
//compare:
if($_SESSION['password'] == $db_pass['password']) {
// valid password for username
$logged_in = 1; // they have correct info
// in session variables.
} else {
$logged_in = 0;
unset($_SESSION['username']);
unset($_SESSION['password']);
// kill incorrect session variables.
}
}
// clean up
unset($db_pass['password']);
$_SESSION['username'] = stripslashes($_SESSION['username']);
?>
8)Save the file.
9)Create another file and name it login.php and paste the following code:
CODE
<?php
// database connect script.
require 'db_connect.php';
if($logged_in == 1) {
die('You are already logged in, '.$_SESSION['username'].'.');
}
?>
<html>
<head>
<title>Login</title>
</head>
<body>
<?php
if (isset($_POST['submit'])) { // if form has been submitted
/* check they filled in what they were supposed to and authenticate */
if(!$_POST['uname'] | !$_POST['passwd']) {
die('You did not fill in a required field.');
}
// authenticate.
if (!get_magic_quotes_gpc()) {
$_POST['uname'] = addslashes($_POST['uname']);
}
$qry = "SELECT username, password FROM users WHERE username = '".$_POST['uname']."'";
$sqlmembers = mysql_query($qry);
$info = mysql_fetch_array ($sqlmembers);
$check = mysql_num_rows ($sqlmembers);
if ($check == 0) {
die('That Account does not exist in our database.');
}
// check passwords match
$_POST['passwd'] = stripslashes($_POST['passwd']);
$info['password'] = stripslashes($info['password']);
$_POST['passwd'] = md5($_POST['passwd']);
if ($_POST['passwd'] != $info['password']) {
echo "Incorrect password, please try again.";
}
// if we get here username and password are correct,
//register session variables and set last login time.
$date = date('m d, Y');
$qry = "UPDATE users SET last_login = '$date' WHERE username = '".$_POST['uname']."'";
$query=mysql_query($qry);
$_POST['uname'] = stripslashes($_POST['uname']);
$_SESSION['username'] = $_POST['uname'];
$_SESSION['password'] = $_POST['passwd'];
?>
<h1>Logged in</h1>
<p>Welcome back <?php echo $_SESSION['username']; ?>, you are logged in.</p>
<?php
} else { // if form hasn't been submitted
?>
<h1>Login</h1>
<form action="<?php echo $_SERVER['PHP_SELF']?>" method="post">
<table align="center" border="1" cellspacing="0" cellpadding="3">
<tr><td>Username:</td><td>
<input type="text" name="uname" maxlength="40">
</td></tr>
<tr><td>Password:</td><td>
<input type="password" name="passwd" maxlength="50">
</td></tr>
<tr><td colspan="2" align="right">
<input type="submit" name="submit" value="Login">
</td></tr>
</table>
</form>
<?php
}
?>
</body>
</html>
// database connect script.
require 'db_connect.php';
if($logged_in == 1) {
die('You are already logged in, '.$_SESSION['username'].'.');
}
?>
<html>
<head>
<title>Login</title>
</head>
<body>
<?php
if (isset($_POST['submit'])) { // if form has been submitted
/* check they filled in what they were supposed to and authenticate */
if(!$_POST['uname'] | !$_POST['passwd']) {
die('You did not fill in a required field.');
}
// authenticate.
if (!get_magic_quotes_gpc()) {
$_POST['uname'] = addslashes($_POST['uname']);
}
$qry = "SELECT username, password FROM users WHERE username = '".$_POST['uname']."'";
$sqlmembers = mysql_query($qry);
$info = mysql_fetch_array ($sqlmembers);
$check = mysql_num_rows ($sqlmembers);
if ($check == 0) {
die('That Account does not exist in our database.');
}
// check passwords match
$_POST['passwd'] = stripslashes($_POST['passwd']);
$info['password'] = stripslashes($info['password']);
$_POST['passwd'] = md5($_POST['passwd']);
if ($_POST['passwd'] != $info['password']) {
echo "Incorrect password, please try again.";
}
// if we get here username and password are correct,
//register session variables and set last login time.
$date = date('m d, Y');
$qry = "UPDATE users SET last_login = '$date' WHERE username = '".$_POST['uname']."'";
$query=mysql_query($qry);
$_POST['uname'] = stripslashes($_POST['uname']);
$_SESSION['username'] = $_POST['uname'];
$_SESSION['password'] = $_POST['passwd'];
?>
<h1>Logged in</h1>
<p>Welcome back <?php echo $_SESSION['username']; ?>, you are logged in.</p>
<?php
} else { // if form hasn't been submitted
?>
<h1>Login</h1>
<form action="<?php echo $_SERVER['PHP_SELF']?>" method="post">
<table align="center" border="1" cellspacing="0" cellpadding="3">
<tr><td>Username:</td><td>
<input type="text" name="uname" maxlength="40">
</td></tr>
<tr><td>Password:</td><td>
<input type="password" name="passwd" maxlength="50">
</td></tr>
<tr><td colspan="2" align="right">
<input type="submit" name="submit" value="Login">
</td></tr>
</table>
</form>
<?php
}
?>
</body>
</html>
10)save the file.
11)now make a new file and call it logout.php and put in the following code. but remember to change the __URL__to the page you want them to go to after they log out.
CODE
<?php
require 'db_connect.php'; // database connect script.
if ($logged_in == 0) {
die('You are not logged in so you cannot log out.');
}
unset($_SESSION['username']);
unset($_SESSION['password']);
// kill session variables
$_SESSION = array(); // reset session array
session_destroy(); // destroy session.
header('Location: __URL__');
// redirect them to anywhere you like.
?>
require 'db_connect.php'; // database connect script.
if ($logged_in == 0) {
die('You are not logged in so you cannot log out.');
}
unset($_SESSION['username']);
unset($_SESSION['password']);
// kill session variables
$_SESSION = array(); // reset session array
session_destroy(); // destroy session.
header('Location: __URL__');
// redirect them to anywhere you like.
?>
12)after you save it, open whatever page you would like to protect.
13)add the following code before your header:
CODE
<?php
require 'db_connect.php';
// require our database connection
// which also contains the check_login.php
// script. We have $logged_in for use.
if ($logged_in == 0) {
?>
require 'db_connect.php';
// require our database connection
// which also contains the check_login.php
// script. We have $logged_in for use.
if ($logged_in == 0) {
?>
14)then add the conent you want them to see if they are not logged in.(for example:)
CODE
<?php
require 'db_connect.php';
// require our database connection
// which also contains the check_login.php
// script. We have $logged_in for use.
if ($logged_in == 0) {
?>
<html>
<head>
<title>Member Profile</title>
</head>
<body>
Im sorry, but you must be logged in to view this page!
</body>
</html>
require 'db_connect.php';
// require our database connection
// which also contains the check_login.php
// script. We have $logged_in for use.
if ($logged_in == 0) {
?>
<html>
<head>
<title>Member Profile</title>
</head>
<body>
Im sorry, but you must be logged in to view this page!
</body>
</html>
15)now add
CODE
<?php
}
else { ?>
}
else { ?>
after the end of what you wish to show to those not logged in. Now we will add the content that we will show the logged in users.
CODE
<html>
<head>
<title>Member Profile</title>
</head>
<body>
Welcome to the members only section!!!</body>
</html>
<head>
<title>Member Profile</title>
</head>
<body>
Welcome to the members only section!!!</body>
</html>
16)now we need to end the if/else statement with the following code:
CODE
<?php
}
?>
}
?>
17) this should be what your members only page would look like:
CODE
<?php
require 'db_connect.php';
// require our database connection
// which also contains the check_login.php
// script. We have $logged_in for use.
if ($logged_in == 0) {
?>
<html>
<head>
<title>Member Profile</title>
</head>
<body>
Im sorry, but you must be logged in to view this page!
</body>
</html>
<?php
}
else { ?>
<html>
<head>
<title>Member Profile</title>
</head>
<body>
Welcome to the members only section!!!</body>
</html>
<?php
}
?>
require 'db_connect.php';
// require our database connection
// which also contains the check_login.php
// script. We have $logged_in for use.
if ($logged_in == 0) {
?>
<html>
<head>
<title>Member Profile</title>
</head>
<body>
Im sorry, but you must be logged in to view this page!
</body>
</html>
<?php
}
else { ?>
<html>
<head>
<title>Member Profile</title>
</head>
<body>
Welcome to the members only section!!!</body>
</html>
<?php
}
?>
now save it.
And there you have it! A nice users script that will automatically add users to the datavase once they register, and will them to log in and access special pages!!
If you have any questions, PM me or visit my website at www.city-scapes.net.
