$sql = mysql_query( "SELECT * FROM `users` WHERE (`username`, `password`) VALUES ( '$username', '$password' ) ");
if( mysql_num_rows( $sql) == "1" )
{
$_SESSION["username"] = $username;
}
etcetc. Not sure the sql will work.
Heres the little login class I wrote:
class cleaning
{
function clean( $string )
{
$string = str_replace( "\"", "", $string );
$string = nl2br( $string );
$string = htmlentities( $string );
$words = array( "UNION",
"SELECT FROM",
"ORDER BY",
"INSERT INTO",
"TRUNCATE",
"DROP TABLE",
"CREATE TABLE",
"DROP DATABASE" ); // All the queries we want to stop
$string = preg_replace( "/$words/i", "", $string );
}
}
// By Dan..
class login
{
function log( $username, $password )
{
if( isset( $username ) && isset( $password ) )
{
$username = cleaning::clean( $username );
$password = cleaning::clean( $password );
$sql = mysql_query( "SELECT * FROM `users` WHERE `username` = '$username' AND `password` = '$password'");
if( mysql_num_rows( $sql ) == 1)
{
$_SESSION["username"] = $username;
// Contine your sessions here
}
}
}
function login_check( $username, $password ) // This is to check if a user is logged in on the top of the page
{
if( isset( $username ) && isset( $password ) )
{
$username = cleaning::clean( $username );
$password = cleaning::clean( $password );
$sql = mysql_query( "SELECT * FROM `users` WHERE `username` = '$username' AND `password` = '$password'");
if( mysql_num_rows( $sql ) == "0")
{
die('Please Login! <a href="login.php">Click here</a>');
}
}
}
}
Call it login_class.php
Use:
Login:
<?php
require( "login_class.php" );
if( isset( $_POST["username"] ) && isset( $_POST["password"] ) )
{
login::log( $_POST["username"], $_POST["password"] );
} else {
echo "form stuff here..";
}
?>
Call that login.php
On main.php etc:
<?php
session_start( );
require( "login_class.php" );
login::login_check( $_SESSION["username"], $_SESSION["username"] );
?>
Should work, I aint tried it.