Asked by duncanb7
at 2024-05-06 07:03:50
Point:500 Replies:23 POST_ID:828549USER_ID:11059
Topic:
PHP Scripting Language;MySQL Server;JavaScript
Recently I'm working on my website for user login submit form and I google related information
at this link http://phpsense.com/2006/php-login-script/. And finally I successully complete the
login form based on the link example from those php files zipped into PHP-login.zip but I still
have some question please help on it
Question-1:The login form php file is login-form.php which require config.php file
In configure.php file which store my server's mysql databse root username and password for accessing
the database for checking user's login and password match
at this link http://phpsense.com/2006/php-login-script/. And finally I successully complete the
login form based on the link example from those php files zipped into PHP-login.zip but I still
have some question please help on it
Question-1:The login form php file is login-form.php which require config.php file
In configure.php file which store my server's mysql databse root username and password for accessing
the database for checking user's login and password match
THe question is , Because users can access my mysql database and at
the same time he can modifiy or change other users' information such as password
and login name besides himself. Is it Dangerours ? How to let the users only
can change his login information only and not to accesss others' information , please advise ?
Question-2 I have two different computers but users can login the form with the same login and same passwork.
How to avoid double same username login at different computers ? Do i need to write some php code to record
the status of users login saving into the mysql data when they are doing login and logout from the form.
Could you provide me some coding ?
Qestioon-3 Once the login success after login username is matching its password in the database
, the php code in login-exec.php will create php session variables to store members' id, firstname, lastname
like as follows
$_SESSION['SESS_MEMBER_ID'] = $member['member_id'];"
$_SESSION['SESS_FIRST_NAME'] = $member['firstname'];"
$_SESSION['SESS_LAST_NAME'] = $member['lastname'];"
In auth.php which will be used for every website page for user authority checking and it will check
the session variable whether it is set or not.
The question is whether the session variables are saved in the my server instead of user computer ?
If so, is it dangerous because other users might be also doing the login form submitting at the same so the
variable is set even some users is NOT doing any login and they access the web page without login?
Question-4 What is session_regenerate_id() and session_write_close() doing for in login-exec.php ?
Please advise, and you can directly download the example PHP_login.zip files to save all files above at
the link for testing
Duncan
Attachment:config.phplogin-exec.phplogin-form.phpmember-index.phpauth.phplogin-failed.phploginmodule.css