Log In User

"The_Cardinal" <webforumsuser@macromedia.com> wrote in message
news:fjpa2f$lsu$1@forums.macromedia.com...
> Thanks for the reply.
>
> Here is the code that was added by the behaviour:
>
> <?php
> if (!function_exists("GetSQLValueString")) {
> function GetSQLValueString($theValue, $theType, $theDefinedValue = "",
> $theNotDefinedValue = "")
> {
> $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) :
> $theValue;
>
> $theValue = function_exists("mysql_real_escape_string") ?
> mysql_real_escape_string($theValue) : mysql_escape_string($theValue);
>
> switch ($theType) {
> case "text":
> $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
> break;
> case "long":
> case "int":
> $theValue = ($theValue != "") ? intval($theValue) : "NULL";
> break;
> case "double":
> $theValue = ($theValue != "") ? "'" . doubleval($theValue) . "'" :
> "NULL";
> break;
> case "date":
> $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
> break;
> case "defined":
> $theValue = ($theValue != "") ? $theDefinedValue :
> $theNotDefinedValue;
> break;
> }
> return $theValue;
> }
> }
> ?>
> <?php
> // *** Validate request to login to this site.
> if (!isset($_SESSION)) {
> session_start();
> }
>
> $loginFormAction = $_SERVER['PHP_SELF'];
> if (isset($_GET['accesscheck'])) {
> $_SESSION['PrevUrl'] = $_GET['accesscheck'];
> }
>
> if (isset($_POST['username'])) {
> $loginUsername=$_POST['username'];
> $password=$_POST['passwrd'];
> $MM_fldUserAuthorization = "username";
> $MM_redirectLoginSuccess = "/~user/sitename/admin.php";
> $MM_redirectLoginFailed = "/~user/sitename/valerror.html";
> $MM_redirecttoReferrer = true;
> mysql_select_db($database_connXXXX, $connXXXX);
>
> $LoginRS__query=sprintf("SELECT username, password, username FROM Users
> WHERE username=%s AND password=%s",
> GetSQLValueString($loginUsername, "text"), GetSQLValueString($password,
> "text"));
>
> $LoginRS = mysql_query($LoginRS__query, $connEden) or
> die(mysql_error());
> $loginFoundUser = mysql_num_rows($LoginRS);
> if ($loginFoundUser) {
>
> $loginStrGroup = mysql_result($LoginRS,0,'username');
>
> //declare two session variables and assign them
> $_SESSION['MM_Username'] = $loginUsername;
> $_SESSION['MM_UserGroup'] = $loginStrGroup;
>
> if (isset($_SESSION['PrevUrl']) && true) {
> $MM_redirectLoginSuccess = $_SESSION['PrevUrl'];
> }
> header("Location: " . $MM_redirectLoginSuccess );
> }
> else {
> header("Location: ". $MM_redirectLoginFailed );
> }
> }
> ?>


Is that all the code?
I'm missing a connection include connEden.php

> As you can see, the code does contain session_start(). Is that a problem?
> I
> haven't modified the code in any way although I have removed my site name
> etc.
> from the code above for this post.

You need session_start on every page using sessions.

> The page is published to a local testing server and I have no problem with
> other php code, such as displaying records from a MySQL table. It is just
> the
> security stuff that is causing me problems.

the only thing I can see is the line-break between the GetSQLValueString and
the login Server Behavior participants,
this may prevent the redirect because all http headers must be sent before
any content.
Try removing

?>
<?php

> I have set error_reporting = E_ALL in the php.ini file so that I can see
> all
> errors during testing.

No errors at all?

No, I don't think so. the Log In behaviour goes on the page that the user types their username and password onto.

You use another behaviour to check the login credentials on the pages you wish to secure.