Member Avatar for mindfrost82

I need a simple login script that has the ability to redirect a user.

For example:
- I want to be able to protect certain pages so that a user has to login to access them (in this case they wouldn't get redirected)
- Then in another case I would want the ability to redirect a user based on their login. For example, have a login box and store it as a session or cookie, then they could click on a My Account link and be directed to their specific folder.

For registration, I would need a username, password, company name, email address, and possibly a homedirectory variable (used to determine where to redirect them to).

Does something out there exist?

  • 2 Contributors
  • 1 Reply
  • 380 Views
  • 1 Month Discussion Span
  • Latest Post Latest Post by JeniF

Dani AI

Generated

For ’s two use-cases (protect pages with a session, and optionally redirect a logged-in user to a per-account folder), a simple, secure architecture is best: a users table with an id, username (unique), password_hash, email, company and a small, validated home_folder value (store only a short folder name or a folder id — never full URLs). Authenticate once, store only the user id, username and that sanitized home_folder in the session, and check the session on protected pages.

Security and implementation notes (avoid repeating the Dreamweaver pitfalls): use parameterized queries (PDO or mysqli) instead of building SQL strings; use PHP’s password_hash() / password_verify() (or a maintained compatibility library on old PHP); call session_start() before output, then session_regenerate_id(true) after login; set cookies with HttpOnly and Secure flags when possible; never overwrite the entire $_SESSION array; never trust a redirect value from GET without validating it. Always call exit after a header Location redirect to stop script execution.

Practical snippet (minimal, new example of a safe redirect after a verified login):

session_start();
// after successful verification via prepared statement + password_verify():
$_SESSION['user_id'] = $user['id'];
$_SESSION['username'] = $user['username'];
$_SESSION['home'] = preg_replace('/[^a-z0-9_-]/i','',$user['home_folder']); // keep it strict
session_regenerate_id(true);
$target = '/accounts/' . ($_SESSION['home'] ?: 'dashboard') . '/';
header('Location: ' . $target);
exit;

Quick troubleshooting checklist: don’t use addslashes/get_magicquotes (these are unsafe/obsolete); avoid mysql* APIs (use PDO/mysqli); ensure the DB home_folder values are constrained (or map an id to a path) to prevent open-redirects; provide a safe default when home_folder is missing; and test login, session expiry, and redirect behavior over both HTTP and HTTPS. As noted by , sample Dreamweaver code can be a starting point, but it needs these modern fixes before being used in production.

Member Avatar for JeniF

as an example from Dreamweaver login script:

//connect to your db through another file and include it:
<?php
require_once('the_connection_file.php');



if (!isset($_SESSION)) {
session_start();
}


$loginFormAction = $_SERVER;
if (isset($_GET)) {
$_SESSION = $_GET;
}


if (isset($_POST)) {
$loginUsername=$_POST;
$password=$_POST;
$MM_fldUserAuthorization = "";
//if they match the criteria, redirect to the allowed page
$MM_redirectLoginSuccess = "page_allowed_to access.php";
//if they have not passed the authorization, redirect bact to login page
$MM_redirectLoginFailed = "login.php";
$MM_redirecttoReferrer = false;
mysql_select_db($your_database, $your_db_table);


$LoginRS__query=sprintf("SELECT username, password FROM your_access_table WHERE username='%s' AND password='%s'",
get_magic_quotes_gpc() ? $loginUsername : addslashes($loginUsername), get_magic_quotes_gpc() ? $password : addslashes($password));


$LoginRS = mysql_query($LoginRS__query, $your_db_table) or die(mysql_error());
$loginFoundUser = mysql_num_rows($LoginRS);
if ($loginFoundUser) {
$loginStrGroup = "";


//declare two session variables and assign them
$_SESSION = $loginUsername;
$_SESSION = $loginStrGroup;


if (isset($_SESSION) && false) {
$MM_redirectLoginSuccess = $_SESSION;
}
header("Location: " . $MM_redirectLoginSuccess );
}
else {
header("Location: ". $MM_redirectLoginFailed );
}
}
?>

Now in the body of your page include a form :

<form id="form1" name="form1" method="POST" action="<?php echo $loginFormAction; ?>">
<table width="400" border="0">
<tr>
<td colspan="2"><div align="center" class="style1"> Login <br />
Please use your Network Password </div></td>
</tr>
<tr>
<td><span class="style2">Username:</span></td>
<td><input name="username" type="text" id="username" size="25" /></td>
</tr>
<tr>
<td><span class="style2">Password:</span></td>
<td><input name="password" type="password" id="password" size="25" /></td>
</tr>
<tr>
<td colspan="2"><div align="center">
<input name="Login" type="submit" id="Login" value="Submit" />
</div></td>
</tr>
</table>
</form>
?>

once the user has passed the verification send the user to the page desired and only allow access based on the credentials supplied like this (Place this at the top of the page restricting access):

<?php
if (!isset($_SESSION)) {
session_start();
}
$MM_authorizedUsers = "";
$MM_donotCheckaccess = "true";


// *** Restrict Access To Page: Grant or deny access to this page
function isAuthorized($strUsers, $strGroups, $UserName, $UserGroup) {
// For security, start by assuming the visitor is NOT authorized.
$isValid = False;


// When a visitor has logged into this site, the Session variable MM_Username set equal to their username.
// Therefore, we know that a user is NOT logged in if that Session variable is blank.
if (!empty($UserName)) {
// Besides being logged in, you may restrict access to only certain users based on an ID established when they login.
// Parse the strings into arrays.
$arrUsers = Explode(",", $strUsers);
$arrGroups = Explode(",", $strGroups);
if (in_array($UserName, $arrUsers)) {
$isValid = true;
}
// Or, you may restrict access to only certain users based on their username.
if (in_array($UserGroup, $arrGroups)) {
$isValid = true;
}
if (($strUsers == "") && true) {
$isValid = true;
}
}
return $isValid;
}


$MM_restrictGoTo = "login.php";
if (!((isset($_SESSION)) && (isAuthorized("",$MM_authorizedUsers, $_SESSION, $_SESSION)))) {
$MM_qsChar = "?";
$MM_referrer = $_SERVER;
if (strpos($MM_restrictGoTo, "?")) $MM_qsChar = "&";
if (isset($QUERY_STRING) && strlen($QUERY_STRING) > 0)
$MM_referrer .= "?" . $QUERY_STRING;
$MM_restrictGoTo = $MM_restrictGoTo. $MM_qsChar . "accesscheck=" . urlencode($MM_referrer);
header("Location: ". $MM_restrictGoTo);
exit;
}

hope this helps!

Edited by happygeek because: fixed formatting
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.