PHP Forum

**ColourDreamer** · 08-21-2004, 04:02 PM

I thought that I had my member system all up and running, when I learned that it wasn't protecting access from non-members! Now I'm

Here is my code:

PHP Code:


			
<? ob_start(); ?>

<?php



// For register_global on PHP settings

$member = $_COOKIE['member'];



session_start(); // you must put this to read session variables



if (empty($member) || !isset($member)) // fail to read the browser cookie

{

// Try to read session

if (empty($_SESSION['member']) || !isset($_SESSION['member']))

{header("Location: /login.php"); // redirect user to login

exit;

} 

else

{$member = $_SESSION['member'];

}

}





// MySQL Connection Variables 

$hostname= 'EDIT';

$user= 'EDIT';

$pass='EDIT'; 

$dbase= 'colourdreamscom';



$connection = mysql_connect("$hostname" , "$user" , "$pass") or die ("Can't connect to MySQL");

$db = mysql_select_db($dbase , $connection) or die ("Can't select database.");



// User has login but you should check his account validity again

$qChk = "select id from membership where username='$member' and status='Y' ";

$rsChk = mysql_query($qChk);



if (mysql_num_rows($rsChk) != '1')

{header("Location: /login.php");

exit; 

}



// Rest of your welcome page content here

echo ("

<HEAD>

 <TITLE>COLOUR-DREAMS :: </TITLE>

<link rel='stylesheet' type='text/css' href='/style.css'>

</HEAD>

<BODY style='background-color: transparent;' topmargin='0' leftmargin='0'>

<? include ('/home/lauren/colour-dreams.net/includes/everypageinc.html'); ?>

<a href='#' onClick='history.go(-1)'><img src='/images/back.gif' border='0'> Go Back</a>

<p><img src='/images/bullet.gif'> <b>Members</b><p>



<Table align='center' border='0' cellpadding='5' cellspacing='0'>

<Tr>



<? include ('/home/lauren/colour-dreams.net/members/menu.html'); ?>



<TD valign='top'>





If you use anything post a credit link back to http://colour-dreams.net!



<p>First of all, if you use anything, tag my board and let me know.</p>



<p>&nbsp;Pixels:

<br>In many cases, please link the actual image back to us. For calendars, post a credit link directly under the calendars. For website pixels, post a credit link on your site, main page or credit page is fine. For smilies, I've made a little animated image you can post on your credit page or somewhere. Or, if you use smilies in a blog, you can put a link right in the name/time posted, etc. section. Be creative.

</p>



<p>&nbsp;Tutorials/Scripts:

<br>Yep, these, too. Post a link back if you use anything for your site!</p>

</TD></Tr></Table>



<p><a href='#' onClick='history.go(-1)'><img src='/images/back.gif' border='0'> Go Back</a>

</body>

</html>

");

?>

I got this script from daydreamgraphics.com and only edited it slightly.

Please help me.

**ermau** · 08-21-2004, 07:32 PM

It would be a very good idea to remove your MySQL connection variables, because right now, if I wanted, I could delete your entire database because you've now given me the login information.

**Christopher** · 08-21-2004, 07:41 PM

I edited for you, ColourDreamer

Thanks ermau