Creating a Login System Part 2

So i am going to continue the login system that i had started in the part one of this series.
and you can find that here
http://localtechrepair.blogspot.com/2011/01/creating-login-page-part-1-website.html

so now that we have added members to our database we can login as them

lets post some code to look at.

first we will start with the login screen and then from there what we use to check the login credentials. login will be our index page.

---------------index.php------------------

<?php
if( isset( $_COOKIE['Username'] ) )
{
if( isset( $_COOKIE['Passhash'] ) )
{

$user = $_COOKIE['Username'];
$pass = $_COOKIE['Passhash'];
$user = stripslashes($user);
$pass = stripslashes($pass);
$user = mysql_real_escape_string($user);
$pass = mysql_real_escape_string($pass);
$user = ereg_replace("[^A-Za-z0-9]", "", $user );
$pass = ereg_replace("[^A-Za-z0-9]", "", $pass );
include_once "connect.php";
$sql="SELECT * FROM members WHERE username='$user' and password='$pass'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if($count==1){
// Register $myusername, $mypassword and redirect to file "Home.php"
session_register("myusername");
header("location:home.php");
}}}
$title = "local tech repair";
include ("header.php");
?>
<td class="left_content"><div align="center"><strong>Here are some useful links</strong></div><br />


<?include "leftside.php";?>


</td>
<td class="body_content"><strong><h4></h4></strong>

<form name="form1" method="post" action="./checklogin.php">
<td>
<table border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF">
<center><strong><h1></h1></strong></center>
<p>Study</p>
<tr>
<td colspan="2"><strong>Member Login </strong></td>
</tr>
<tr>
<td>Username:</td>

<td><input name="myusername" type="text" id="myusername"></td>
</tr>
<tr>
<td>Password:</td>

<td><input name="mypassword" type=PASSWORD id="mypassword"></td>
</tr>
<tr>
<td></td>
<td><input type="submit" name="Submit" value="Login"></td>
</tr>
</table>
<p>
Are you a corban student and want to join. <a href="register.php">click here and join</a>
</p>
<p>
<!-- Lost your password? click <a href="recovery.php">here</a> -->
</p>
</td>
</form>



</td>
<?
include ("footer.php");
?>

---------------------------------------------
-----------checklogin.php--------------

<?
// Define $myusername and $mypassword
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];
$date_of_expiry = time() + 86400 ;
setcookie( "Username", "$myusername", $date_of_expiry );


ob_start();
$tbl_name="members"; // Table name

include("connect.php"); //connect to database

// To protect MySQL injection (more detail about MySQL injection)
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
// this only allows alpha numeric passwords.
$myusername = ereg_replace("[^A-Za-z0-9]", "", $myusername );
$mypassword = ereg_replace("[^A-Za-z0-9]", "", $mypassword );
// encrypts with sha512 bit + salt to help protect against rainbow table cracking.
$salt = "website";
$encrypted_mypassword=hash('sha512', $salt.$mypassword);
setcookie( "Passhash", "$encrypted_mypassword", $date_of_expiry);
$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$encrypted_mypassword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if($count==1){
$query3 = "SELECT * FROM members WHERE username='$myusername' and password='$encrypted_mypassword' and privlege='Admin'";
$result3=mysql_query($query3);
$count2=mysql_num_rows($result3);
if ($count2==1){
setcookie('Admincookie', 'admin395', $date_of_expiry);
}
// Register $myusername, $mypassword and redirect to file "Home.php"
session_register("myusername");
header("location:home.php");
}
else {

// else if fales it will go back to the login page.
header("location:index.php");
}

ob_end_flush();
?>

-------------------------------------------------

so i will explain a little bit what this does.

first the index page just is a normal form asking for your user name and password the user types that in then submits the form

it then goes to the checklogin.php from there it saves the username to a cookie for later use.
it then strips all the mysql escape characters and strips any slashes from both username and password that the user submitted. the password then is hashed in to a sha2 512 bit hash with a salt added at the beginning. you can also add a the random salt if you like. i do that on my own websites.
the database is then queried to see if their is a match for the username and passwords hash. if there is 1 then the script continues and checks to see if they are admin user or not and also continues to start a session for them and then direct them to the home page. if they fail and there is no user it will redirect them to the login page.


i hope these scripts help you start making your own pages. you can do a lot more with these scripts but this is a start.