Multiple session variables from login page

[RGolfer]

Hey there, I should point out that i have been using ASP for a number of years and am trying to start a transition over to PHP. I'm a little stuck and i am sure there is a simple solution to this. After a login page I go to my start page. When you are at the start page depending on the status you are given i.e. level1, level2 etc.

Dreamweaver gives you code to start a page and I seem to be able to capture the session variable 'MM_Username' in the start page but in my setup, this is your first name. Of course there could be a lot of "Fred’s" out there so it takes the info from the first name field. How do I capture the password session or create a new session for password so when I am filtering the session on the next page I can use multiple variables like the following must match username, password, address ...?

In asp is was easy. I simply started a session variable capturing from the names of the username and password fields. Like this:

<% Session ("username1") = Request ("username") %>

<% Session ("password1") = Request ("pass") %>

My session would then be username1 and password1 and i would sort from there.

In PHP how would i do a similar thing? Help please!!

Here is the generated code from Dreamweaver.

<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")
{
  if (PHP_VERSION < 6) {
    $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;
  }

  $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;   
    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? doubleval($theValue) : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  }
  return $theValue;
}
}
?>
<?php
// *** Validate request to login to this site.
if (!isset($_SESSION)) {
  session_start();
}

$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($_GET['accesscheck'])) {
  $_SESSION['PrevUrl'] = $_GET['accesscheck'];
}

if (isset($_POST['username'])) {
  $loginUsername=$_POST['username'];
  $password=$_POST['password'];
  $MM_fldUserAuthorization = "";
  $MM_redirectLoginSuccess = "/support/startpageSQL.php";
  $MM_redirectLoginFailed = "/test2.php";
  $MM_redirecttoReferrer = false;
  mysql_select_db($database_toyosupport, $toyosupport);
 
  $LoginRS__query=sprintf("SELECT Name, Password FROM entry WHERE Name=%s AND Password=%s",
    GetSQLValueString($loginUsername, "text"), GetSQLValueString($password, "text"));
  
  $LoginRS = mysql_query($LoginRS__query, $toyosupport) or die(mysql_error());
  $loginFoundUser = mysql_num_rows($LoginRS);
  if ($loginFoundUser) {
     $loginStrGroup = "";
   
if (PHP_VERSION >= 5.1) {session_regenerate_id(true);} else {session_regenerate_id();}
    //declare two session variables and assign them
    $_SESSION['MM_Username'] = $loginUsername;
    $_SESSION['MM_UserGroup'] = $loginStrGroup;      

    if (isset($_SESSION['PrevUrl']) && false) {
      $MM_redirectLoginSuccess = $_SESSION['PrevUrl'];
    }
    header("Location: " . $MM_redirectLoginSuccess );
  }
  else {
    header("Location: ". $MM_redirectLoginFailed );
  }
}
?>

[Ben M]

In PHP the $_SESSION is a superglobal much like your "Session" in ASP.  And instead of your "Request" as you used in ASP, it would be much more secure to limit where the data is and use the $_POST or $_GET superglobals which take in the POST or GET methods from forms.  So all you need to do to mimic your code in PHP would be:

$_SESSION['username'] = $_POST['username'];

$_SESSION['password'] = $_POST['password'];

DW is adding an intermediary step in the process here that you should be aware of:

if (isset($_POST['username'])) {

  $loginUsername=$_POST['username'];

  $password=$_POST['password'];

So that's why it looks slightly different from your example.

Hopefully this explains what you are looking for to get you started.

[RGolfer]

Thanks Snakeyez02,

I have searched the posts and other sites etc. and i did get the lines of code you have presented. I can get the Username to pass over as MM_Username but when add a single line to the code to try to grab the password:

$_SESSION['pass'] = $_POST['password'];

I get this error:

Notice: Undefined index: password in /var/www/html/toyo_support_site/index_support_en_bak2.php on line 76

If i try to enter this code inside of any of DW's log in user code i get this error message and have to revert to an older version:

If i try to simply insert the sessions variables on their own like this:

<?php

$_SESSION['username1'] = $_POST['username'];

$_SESSION['password1'] = $_POST['password'];

?>

I get the same sort of error but for both lines:

Notice: Undefined index: username in /var/www/html/toyo_support_site/index_support_en_bak2.php on line 78

Notice: Undefined index: password in /var/www/html/toyo_support_site/index_support_en_bak2.php on line 79

Now Dreamweaver must be capturing the password somehow and storing that data to use for the User Authentication - Rrestrict access to page. On the receiving page my recordset is as follows. Is there something i can add here to simply capture teh password information?

<?php
// *** Validate request to login to this site.
if (!isset($_SESSION)) {
  session_start();
} ?>

<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")
{
  if (PHP_VERSION < 6) {
    $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;
  }

  $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;   
    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? doubleval($theValue) : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  }
  return $theValue;
}
}

$colname_rsSession = "-1";
if (isset($_SESSION['MM_Username'])) {
  $colname_rsSession = $_SESSION['MM_Username'];
}
mysql_select_db($database_toyosupport, $toyosupport);
$query_rsSession = sprintf("SELECT * FROM entry WHERE Name = %s", GetSQLValueString($colname_rsSession, "text"));
$rsSession = mysql_query($query_rsSession, $toyosupport) or die(mysql_error());
$row_rsSession = mysql_fetch_assoc($rsSession);
$totalRows_rsSession = mysql_num_rows($rsSession);
?>

Sorry I have been trying everything to hopefully come accross the right formula here but I am not doing well. Any help is very much appreciated.

[Ben M]

The undefined index is because the variable is not set.  PHP requires that you make sure a variable is defined before using it for any other function.  The "isset" function will do just that on a variable.  In VB terms it would be like trying to use a variable that you did not define with a "dim" statement first.

DW does use its own method for a login behavior to allow it to be edited via a GUI, and so that it can be edited later.  By editing the code, DW is stating that it can no longer help you and wants you to revert to its original code.  Unfortunately it is a little bit unflexible in that sense, but it does it for good reason and did do it with ASP as well.  If your login needs go beyond DW, it may be time to just code some of the elements yourself because to me, it sounds like you have the understand of the programming that is necessary to accomplish your task and DW is holding you back with its proprietary code. 

[RGolfer]

Hi SnakEyez02,

I get what you are saying and can understand why Dreamweaver would be set in its ways at times. And i hope I didn't mislead you in thinking I know what i am doing because at times I haven't a clue! What is it they say, "better to be quiet and have people think you are stupid than speak up and remove all doubt!" Here is where I probably remove all doubt. I am definately trying my best to understand the coding but I am not a coder. In most cases I am in awe as to how much you guys know but in my case working with web sites is only part of my function so I tend to scramble along as best as I can.

Now I did try to add my own code to start a new session and of course I received a whole slew of errors one being that a session has already been started. I tried using the Adobe forum on session vaiables and could not get it to work. Yes, I need to learn more about PHP which I guess I am putting the cart before the horse here but just need to get past this part to get something up there to keep some people happy.

In ASP it was an easy thing to make a session work but our new server is Linux and I have lot's to catch up on with PHP .

Now are you suggesting thatI should start from scratch and not use teh DW login server behavior and start from scratch? If so could you point me to aplace that would have a good tutorial on how to do this? This would be a great help ... and of course stop me from using yet another old cliche!

[bregent]

>And instead of your "Request" as you used in ASP,

>it would be much more secure to limit where the data is

It's also a good idea not to use it that way in ASP. Use the FORM or QUERYSTRING collections instead of the generic Request("blahblah")

[RGolfer]

Hi bregent, when i first read your reply I went "duh, why didn;t i think of that" I did give it a try but the information is not transfering over for some reason so i get a blank where I put a test echo.

<?php echo $row_rsSUPPORTLOGIN['Password']; ?>

Here is my recordset

<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")
{
  if (PHP_VERSION < 6) {
    $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;
  }

  $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;   
    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? doubleval($theValue) : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  }
  return $theValue;
}
}

$pass_rsSUPPORTLOGIN = "-1";
if (isset($_POST['password'])) {
  $pass_rsSUPPORTLOGIN = $_POST['password'];
}
$user_rsSUPPORTLOGIN = "-1";
if (isset($_POST['user'])) {
  $user_rsSUPPORTLOGIN = $_POST['user'];
}
mysql_select_db($database_toyosupport, $toyosupport);
$query_rsSUPPORTLOGIN = sprintf("SELECT * FROM entry WHERE Password = %s AND entry.Name = %s", GetSQLValueString($pass_rsSUPPORTLOGIN, "text"),GetSQLValueString($user_rsSUPPORTLOGIN, "text"));
$rsSUPPORTLOGIN = mysql_query($query_rsSUPPORTLOGIN, $toyosupport) or die(mysql_error());
$row_rsSUPPORTLOGIN = mysql_fetch_assoc($rsSUPPORTLOGIN);
$totalRows_rsSUPPORTLOGIN = mysql_num_rows($rsSUPPORTLOGIN);
?>

Having said this, if I get this to work then wouldn't I have to then create a session at this point to continue the information tansfering from page to page?

[RGolfer · Accepted solution]

To get this to work it ended up being very simple. at the login page I simply used:

<?php

   // this is defining the session values.

   $_SESSION["user_name"] = $_POST['username'];

   $_SESSION["pass_word"] = $_POST['password'];

        ?>

after all the Dreamweaver code to start a completely different pair of sessions.

On the receiving page I made the recordset like this:

<?php  session_start(); ?>
<?php virtual('/Connections/toyosupport.php'); ?>
<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "")
{
  if (PHP_VERSION < 6) {
    $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;
  }

  $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;   
    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? doubleval($theValue) : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  }
  return $theValue;
}
}

$pass_word_rsUSERNAME = "-1";
if (isset($_SESSION['pass_word'])) {
  $pass_word_rsUSERNAME = $_SESSION['pass_word'];
}
$user_name_rsUSERNAME = "-1";
if (isset($_SESSION['user_name'])) {
  $user_name_rsUSERNAME = $_SESSION['user_name'];
}
mysql_select_db($database_toyosupport, $toyosupport);
$query_rsUSERNAME = sprintf("SELECT * FROM entry WHERE Password = %s AND Name = %s", GetSQLValueString($pass_word_rsUSERNAME, "text"),GetSQLValueString($user_name_rsUSERNAME, "text"));
$rsUSERNAME = mysql_query($query_rsUSERNAME, $toyosupport) or die(mysql_error());
$row_rsUSERNAME = mysql_fetch_assoc($rsUSERNAME);
$totalRows_rsUSERNAME = mysql_num_rows($rsUSERNAME);
session_start(); ?>

Although Dreamweaver's code fought it a bit it works and appears to be stable. Notice that I added a session_start to the top of the page although Dreamweaver's original code did not. This helped.

Hope this helps.