php on member.php page session output "the implied username " worked in login.php but is not displaying in member.php

Question

php problem on member.php page session output "the implied username " worked in login.php but is not displaying in member.php

<html>

<form action="login.php" method="POST">
    Username: <input type="text" name="username"><p>
    Password: <input type="password" name="password">
              <input type="submit" name="submit" value="Login">
</form>

<a href='register'.php>Register Now</a>

</html

code above was index.html file

<?php

session_start();

$username = $_POST['username'];
$password = $_POST['password'];

if ($username&&$password)
    {

        $connect = mysql_connect("127.0.0.1","root","") or die ("Could not connect `to     database");
        mysql_selectdb("login") or die ("could not find database");
        $query = mysql_query("select * FROM users WHERE username='$username'");
        $numrows = mysql_num_rows($query);
        if($numrows !=0)
    {
    while ($row = mysql_fetch_assoc($query))
    {
        $dbusername = $row['username'];
        $dbpassword = $row['password'];

    }
    if ($username==$dbusername&&$password==$dbpassword)
    {
    echo $_Session['username']="$dbusername  ";
    echo ",  Login successful. <a href='member.php'>Click here to enter the Members area  

</a>";




    }
    else
        echo "Incorrect password";
    }
    else
        die ("That username does not exists");
    }
    else
        die ("Please enter a username and password");

?>

code above is login.php where on the login page it displays "username" login successful and a link for click here go to the member area.

<?php

session_start();

if ($_SESSION['username'] = '$dbusername')
    {
  echo "Welcome, ".$_SESSION['username']."<br><<a href='logout.php'>Click here</a> to logout!<br>Click<a href='changepassword.php'> here</a> to change your password!";
    }
else
     die("You must be logged in to see this page");

above is code from member.php page

Here is the display output:

Welcome, $dbusername

Click here to logout! Click here to change your password!

My problem is it should read as follows:

Welcome, Johnny Click here to logout! Click here to change your password!

A solution would be great!

You have easy sql injection in your query. and in member.php your wrongly checking in your if statement. — Lawrence Cherone, Jan 14 '13 at 21:55
I agree that seems like the most likely solution but my problem is Iwhen I try:the suggestions their not working. One person suggest "==", the other suggest taking out "", I got the code off youtube phplogin went through it 100 times and it worked for him but something is missing in it for me. Is their a possible version conflict of php that might cause this problem. if ($_SESSION['username'] = "$dbusername"){ { echo "Welcome, ".$_SESSION['username']."
<Click here to logout!
Click here to change your password!"; } — php beginner, Jan 14 '13 at 22:39

score 0 · Answer 1 · edited May 25 '19 at 14:33

Where to start? Okay, this will not work as a secure login script. First off you are storing the password in raw form in the database, with no encryption. Next checking if a session variable exist is not the correct way to see if the user is logged in. You must check user credentials each time they change page, and preferably regenerate the session id.

$dbusername has no value on the second page. You are resetting the $_SESSION['username'] to $dbusername when you use the = sign.

Shouldbe:

if ($_SESSION['username'])

or

if (isset($_SESSION['username']))

Here is a good place to start for hashing the password

Please, don't use mysql_* functions in new code. They are no longer maintained and are officially deprecated. See the red box? Learn about prepared statements instead, and use PDO, or MySQLi - this article will help you decide which. If you choose PDO, here is a good tutorial.

Roy I can't give you all the credit because Sean came back strong and answered my issues on login.php but he did not get the member page correctly. It works. Thank both of you guys and Roy I will take your advice and focus on making the site secure. Ill save this in a folder and have some working idea of what I want the design to be like. But yes Roy I will hash password moving forward. Ill make sure I give you guys the recognition you deserve! — php beginner, Jan 14 '13 at 22:54

php on member.php page session output "the implied username " worked in login.php but is not displaying in member.php

1 Answers1