PHP Login System with Admin Features _ evolt

PHP Login System with Admin Features

Posted on September 22, 2004

in Code

by JP (jpmaster77)

Introduction

I wrote the popular evolt.org tutorial PHP Login Script with Remember Me Feature mainly as an introduction to user

sessions and cookies in PHP. Since it was created as a learning tool, many advanced features were left out of the script.

By popular demand, I have written and am presenting here a complete Login System, with all the features that were left

out of the first script, that can be easily integrated into any website.

Notes

This article is intended primarily for intermediate to advanced users of PHP, as it is not exactly a tutorial, but a

description of the implementation of an advanced Login System. Beginners who are looking to learn about user session

and cookies in PHP are advised to read the above mentioned tutorial before reading this article.

FeaturesHere are some of the features in this Login System that weren't included in the initial tutorial:

Better Security - Passwords are not stored in cookies, randomly generated ids take their place.

Member Levels - Now users can be differentiated by what level they are (user, admin, etc.)

Admin Center - As an admin, you have full control over registered users. You can view user info,

upgrade/demote user levels, delete users, delete inactive users, and ban users.

Visitor Tracking - You can now tell how many guests and users are actively viewing your site, and who those

users are. You also know how many total members your site has.

Account Info - Users can now view their own information, and edit it as well. They can also see the information

of other users.

Form Helper - No more ugly error pages! Now users are redirected to the form they filled out and the errors that

have occurred are displayed.

Forgot Password - Users who forget their password can have a new one generated for them and sent to their

email address.

Email - Now emails can be sent to newly registered users.

Miscellaneous - Much better code design, smooth page transitions, and MORE!

Evolt.org is an all-volunteer resource for web developers made up of a discussionlist, a browser archive, and member-submitted articles. This article is the propertyof its author, please do not redistribute or use elsewhere without checking withthe author.

PHP Login System with Admin Features | evolt.org http://www.evolt.org/php-login-system-with-admin-features

1 of 40 1/12/2011 12:17 PM

DatabaseAll the tables needed for the Login System are written in the file dbtables.sql. You can look at the file and create each

table manually or you can just run the file with mysql and it will create all the necessary tables automatically.

dbtables.sql


2 of 40 1/12/2011 12:17 PM


3 of 40 1/12/2011 12:17 PM


4 of 40 1/12/2011 12:17 PM


5 of 40 1/12/2011 12:17 PM


6 of 40 1/12/2011 12:17 PM


7 of 40 1/12/2011 12:17 PM


8 of 40 1/12/2011 12:17 PM


9 of 40 1/12/2011 12:17 PM


10 of 40 1/12/2011 12:17 PM


11 of 40 1/12/2011 12:17 PM


12 of 40 1/12/2011 12:17 PM


13 of 40 1/12/2011 12:17 PM


14 of 40 1/12/2011 12:17 PM


15 of 40 1/12/2011 12:17 PM


16 of 40 1/12/2011 12:17 PM


17 of 40 1/12/2011 12:17 PM


18 of 40 1/12/2011 12:17 PM


19 of 40 1/12/2011 12:17 PM


20 of 40 1/12/2011 12:17 PM


21 of 40 1/12/2011 12:17 PM

$session $form $database


22 of 40 1/12/2011 12:17 PM


23 of 40 1/12/2011 12:17 PM

well written step-by-step

Submitted by spinhead on September 28, 2004 - 06:53.

I'm still refining my PHP, and this article is a real boost. Makes me feel like even I can do this!

login or register to post comments

And he does it again !

Submitted by saruman on September 28, 2004 - 12:51.


24 of 40 1/12/2011 12:17 PM

Thanks again JP, You truly are great for taking your time to do these scripts, I did manage to get the last one working but have

not really had time to finish the site I was supposed to use it with, maybe ill try upgrade to this one :)

I will try it out when I get a chance and let you know


Question

Submitted by libelle on September 28, 2004 - 16:09.

When I look at the PEAR libraries, I see a fair amount of infrastructure for this kind of application. Any recommendations with

regard to using them? I'm interested in the more general character (e.g., DB-agnosticism) of those libraries, but like the

additional features you implement.


Real cool script

Submitted by wocktu on September 28, 2004 - 16:37.

By scripts work really great. Especially this one. I havnt tried to modify the registration page yet so touch wood I won't stuff it up.

I'm doing a Degree in IT and am building a Squash clubs website with a court booking system, this will help out greatly. Thanks JP


Great

Submitted by domostick on September 28, 2004 - 18:36.

On the other script you could hide html from people that were not logged in. The old php

{

>

^^Did not work. It looks something like that lol. Is there a way to do this again?


Customizing Main.php

Submitted by swattle on September 29, 2004 - 14:35.

I am new to PHP and I am starting a new website and at swattle.com . I am not sure what I am doing wrong. If you visit

http://swattle.com you will see my site. You can login by creating yourself your own account or use the one I have been fooling

around with which is user name: testing password: 12345 You will not that when you login at http://www.swattle.com/index.php

you will be redirected to http://www.swattle.com/usr/main.php This is the folder I placed all of the files from the archive I

downloaded to. Why does it redirect you to the main.php file? I want it to redirect back to http://www.swattle.com/index.php

Where is the script getting this url location from?



25 of 40 1/12/2011 12:17 PM

reply


you must change the redirect link in the file you placed the login box.

also anybody know of the new php code to hide html from non logged in users. i tried the old one, it dont work


Customizing Login


I am not sure where you mean. The login box in my main index.php page and there is no variable listed for a redirect. The only

place I see is a redirect in the process.php file which is the last attempt of logic in the else if statement to determine what the

users is doing with a form.


Process.php and $session object

Submitted by jpmaster77 on September 29, 2004 - 17:14.

swattle,

In the HTML login form at swattle.com/index.php you called it "sublogin2", (it is called "sublogin" in the code provided), so I'm

assuming you are checking for this name in swattle.com/usr/process.php. Because if you aren't, which I don't think you are, it will

redirect to main.php. You need to edit process.php to check for this form name, then log the user in and redirect to either

$session->referrer or just type in "../index.php".

domostick,

There is no global $logged_in variable like in the last script. This new script is more object oriented, you want the

$session->logged_in variable.

Example:

if($session->logged_in){ 

echo "Hey $session->username, you are logged in!"; 

} 

else{ 

echo "You are not logged in."; 

}

Note that this example is seen in main.php.

Good luck,


26 of 40 1/12/2011 12:17 PM

JP


sublogin


JP, That was the problem. I am so silly. I must have looked at that string of characters 3,000 times and never paid any attention

to the 2 One other thing, Maybe because of how I customized the form to login, but now when you log in, the form stays AND it

displays welcome back, username. How can I get it so the login form is no longer shown after the user logs in? My plan is to

create a top header on my finished site which will give the visitor the option to enter his user name and pass right from index.php

Thanks, Chad


sublogin Part 2


If it is any help I posted the actual source, including all php references in my index file. You can view it at

http://www.swattle.com/index2.txt


What else?


swattle,

Your code displays welcome back and then the form because you don't have an else statement. It should be:

if($session->logged_in){ 

... 

}

else{ 

... 

}

So to fix it, add the else statement. It is in the original main.php, so be careful when you edit stuff or just copy and paste code,

you might forget something.

JP


Public Domain?


27 of 40 1/12/2011 12:17 PM

Submitted by fu_fish on September 30, 2004 - 05:35.

Are these scripts released to the public domain for use by anyone, anywhere? They're a whole lot better implemented than my

current login system.


Sure you can


fu_fish,

I wrote this Login System for everyone for use on anything. If you would like to use it, please DO, because that's the whole

purpose of it.

Thanks for checking it out,

JP


reply


sorry but i didnt get it, no exlanation of where it goes lol. just comes up with an error


jpmaster77

Submitted by dirtboy on September 30, 2004 - 18:56.

The Grandmaster of C++ has struck again.................................

awesome script.

Thanks,


reply

Submitted by domostick on October 1, 2004 - 13:39.

hey dirtboy sorry about that night, just angry from school and stuff. can you help me where the php coding goes to hide the html

of people who arent logged in?


main.php

Submitted by jpmaster77 on October 1, 2004 - 16:57.


28 of 40 1/12/2011 12:17 PM

domostick,

I don't get what the problem you're having is. If you look at main.php, it checks whether or not the user is logged in, if so it

displays the HTML for logged in users (basically links to relevant pages), if not it displays the login form.

What more are you looking for? For a general protected page, for users who are logged in you display the protected page HTML,

for users who are not logged in you display an error message. This can be done with an if-else, and the variable you are checking

is $session->logged_in, which can be used when session.php is included.

Let me know if this solves your problem,

JP


Hey jpmaster77

Submitted by Glytch on October 2, 2004 - 01:26.

I'm a newbie to PHP and so far this has been great (the script) and very easy to setup, but I was wondering how to change the

URL after successfully logging in, or including more in main.php after logging in. I tried what you were talking to swattle about,

just replacing $session->referrer with a URL but it didn't work, or is that not what I was supposed to do? Any help would be much

appreciated. Cheers, Glytch


repl


Thanks for trying to help me jp, but I see in the first session the else statment to put my html. But where do I place it? Before or

after }

else{

I tried both but they both come up with an error


domostick

Submitted by dirtboy on October 2, 2004 - 08:54.

My friend open up main.php and just look and read the code.

Do you see the line that says


29 of 40 1/12/2011 12:17 PM

What that code does is it checks to see if the user is logged in and Grandmaster of C++ has added if they are logged in are they

a user or admin. Then the rest of the code after

}

else

{

displays the message to non logged in users

"which is why it displays the login box form"


domostick


You place what message you want logged in users to see before the }else{ statement and what you want non logged in users to

see after the }else{ statement.


reply


like i said before any way i place it, it comes up with a parse code error on line 74.


domostick


why dont you post your code so we can see it ?


reply


got it to work but now i cant logout. You click logout but it just reloads the page and doesnt log out.


domostick



30 of 40 1/12/2011 12:17 PM

I do not know what you have done to the code for that error ..........

But I do know there is nothing wrong with this script straight out of the zip file


Explain


Glytch,

Are you still having a problem? What's the problem exactly. If you want to redirect the user to some specific page after they log

in, you need to modify process.php. Find the function where it processes the login form, then modify the header call. By default it

is:

if($retval){ 

header("Location: ".$session->referrer); 

}

But you can hard code a specific page for it to go to by changing it to:

if($retval){ 

header("Location: somepage.php"); 

}

Hope this helps,

JP


HELP!

Submitted by jaimeharvey on October 3, 2004 - 13:59.

Hi all,

Fantastic script - I am trying to get my head round most of it, but it works like a charm "out the box"!

Really fundamental question here - how do you add other fields like email etc??

Here is what I have tried so far... (only code shown is code that I have changed). Every time I click the register button, it gives

me the 'registration failed page'

Thanks in advance!

register.php and process.php below that


31 of 40 1/12/2011 12:17 PM

<?php

<table align="left" border="0" cellspacing="0" cellpadding="3">

<tr><td>Username:</td><td>value("user");

?>

">error("user"); ?> Password:value("pass"); ?>">error("pass"); ?> Email:value("email"); ?>">error("email"); ?> ?>

process.php

<?php

function procLogin(){

global $session, $form;

/* Login attempt */

$retval = $session->login($_POST['user'], $_POST['pass'], $_POST['email'], isset($_POST['remember']));

/* Login successful */

if($retval){

header("Location: ".$session->referrer);

}

/* Login failed */

else{

$_SESSION['value_array'] = $_POST;

$_SESSION['error_array'] = $form->getErrorArray();

header("Location: ".$session->referrer);

}

}

?>


Stupid me


ok - FORGET EVERYTHING I JUST SAID

Just got totally confused - very sorry!!!


User Account Edit

Submitted by peterc on October 4, 2004 - 03:30.

Excellent script, JP. Thank you. While working through it I have picked up this problem. When useredit.php opens, it shows empty

curpass and newpass fields with the email of the logged on user displayed. Without entering anything, if I click the Edit Account

button, I am advised that the account has been successfully updated. Shouldn't it advise me that both password fields are empty?

When something is entered in either field, it seems to work OK.


32 of 40 1/12/2011 12:17 PM


Account Edit


peterc,

What if you want to just modify your email address and you don't want to change your password? That's how the account edit

page works, if something is entered into either password field, it assumes you want to change your password, so it does error

checking on those two fields. However, if you don't enter anything in either of the two fields, it assumes you don't want to change

your password, just your email.

JP


Protecting Pages


Hi guys, What is the code needed at the top of new pages (that I have created - not in the download) in order to protect them -

i.e. only allow access to users that have logged in? Thanks


Account Edit

Submitted by peterc on October 4, 2004 - 12:35.

JP Yes, I get it. Many thanks again - really good script. Peter


Protected Page


jaimeharvey,

To make protected pages you want to use the $session->logged_in variable, but make sure session.php is included before you

try and use it, or else it will give you an error.

Example: protected.php


33 of 40 1/12/2011 12:17 PM

Make sure the included path to session.php is correct in the page you actually want to protect, and you can insert HTML code into

the if statement to actually display the page and not just a message.

Hope this helps,

JP


Thanks


Thats great - thanks very much!

Ever considered a job in customer service!!


More questions!


Having spent more time working on these pages I have noticed 2 things: 1. The question I asked earlier was really very stupid (!)

and 2 how logically they have been put togther!

One question though, I have modified the database with other fields etc, and what I have done is on the admin page I have

added a link on the users table to go the the userinfo.php page about that user (which works fine).

However, earlier I had modified that page (userinfo) so that anyone other than the user whos details they were could not access

the page (see code). Is there anyway to change the IF statment to IF(session username OR admin)???

Thanks, Jamie

<?php

<?

/* Requested Username error checking */

$req_user = trim($_GET['user']);

if(!$req_user || strlen($req_user) == 0 ||

!eregi("^([0-9a-z])+$", $req_user) ||

!$database->usernameTaken($req_user)){

die("Username not registered");

}


34 of 40 1/12/2011 12:17 PM

/* Logged in user viewing own account */

if(strcmp($session->username,$req_user) == 0){

echo "My Account";

}

/* Visitor not viewing own account */

else{

echo "You are not authorised to view this information";

}

/* Display requested user information */

$req_user_info = $database->getUserInfo($req_user);

/* Usename */

if(strcmp($session->username,$req_user) == 0){

echo "Username: ".$req_user_info['username']." ";

echo "Email: ".$req_user_info['email']." ";

echo "Title: ".$req_user_info['title']." ";

echo "Forename: ".$req_user_info['forename']." ";

echo "Surname: ".$req_user_info['surname']." ";

echo "Address 1: ".$req_user_info['address1']." ";

echo "Address 2: ".$req_user_info['address2']." ";

echo "City: ".$req_user_info['city']." ";

echo "County: ".$req_user_info['county']." ";

echo "Postcode: ".$req_user_info['postcode']." ";

echo "Phone number: ".$req_user_info['telephone']." ";

echo "Mobile number: ".$req_user_info['mobilephone']." ";

}

?>


Great Script

Submitted by paulo61 on October 5, 2004 - 14:57.

This is a great scrip - works out of the box and easy to customise and maintain. I have a question about the logout logic. It

seems that when a user los out they are demoted to guest level and guests expire after 5 minutes by default. Is there anyway to

have logouts take affect immediatly, could I define GUEST_TIMEOUT as 0 for example. The best thing about this code is the

supporting documentation - paul.....


More Answers


35 of 40 1/12/2011 12:17 PM


jaimeharvey,

You want to use the $session->isAdmin() function, it returns true if the user that is logged in has admin priviledges.

paulo61,

I would not recommend setting GUEST_TIMEOUT to 0, because then your site will never know when guests are viewing the site.

You could of course decrease it to 1 perhaps, if you think 5 is too much. What I would suggest you do is remove one line from the

logout() function in session.php, the one that adds the user that just logged out to the active guests table. So find and remove or

comment out this line:

$database->addActiveGuest($_SERVER['REMOTE_ADDR'], $this->time);

Its near the end of the logout() function.

Hope this helps,

JP


HELP.

Submitted by deppie on October 6, 2004 - 12:36.

x__X http://rebel.urban-ducks.net ...All that's on line 14 is a "{" ... Please help. Sorry- I'm kinda new to PHP.. -Rae


Protected pages

Submitted by Brewman on October 6, 2004 - 13:52.

JP .... in the Protected page comment ... you mentioned "you can insert HTML code into the if statement to actually display the

page and not just a message." Could you please show an example of how to insert the HTML correctly. I've tried various ways ...

I'm new to PHP and I'm sure I'm missing the correct coding. I placed the HTML code inside the quote marks after the echo

statement.



36 of 40 1/12/2011 12:17 PM

Help and Protected HTML


deppie,

It tells me you're getting an error when trying to connect to your database, "Access denied", make sure your database name and

password information is specified correctly in constants.php. If you still can't connect after verifying the information, then ask your

web host what you need to put in.

Brewman,

To insert HTML code directly into a php file, you need to close the php tag (insert "?>"). And then open the php tag when you

want to use php again (insert "<?").


Notice that I switched it up in the example, such that the first "if" clause checks if the user is NOT logged in, the reason is most

of the time the HTML code that goes in the "if" statement is a lot shorter than the code that goes in the "else".

JP


37 of 40 1/12/2011 12:17 PM


Protected 2


Brewman,

Sorry the code I gave you was suppose to include HTML tags and they didn't show up, heres what I wanted to show:


JP


Thanks so much!

Submitted by Brewman on October 6, 2004 - 16:29.

JP ... your awesome! The script is now running flawlessly. Thanks so much for your help.

By the way, this script is the best php login script on the web.


38 of 40 1/12/2011 12:17 PM


Well Script.

Submitted by sathiyan_lee on October 6, 2004 - 23:01.

This is really a fanatastic scripts I have ever seen. It looks very simple to undestand. Lot of thanks to you JP


I always get the "Username below 5 characters"

Submitted by robmorin on October 8, 2004 - 06:44.

No matter how many i type?? Any suggestions? When i go to register... for the first time Thanks Rob


Excellent scripts but...

Submitted by gonzalezamado on October 8, 2004 - 08:05.

I am new with PHP and these scripts look like what I was looking for. But my actual case scenario is quite special. I am unable to

access any DBMS from my ISP, so I will need to implement it using a flat file "database" system. Is it possible? What should be

adapted to accomplish that approach? JP, thank you in advance for all the help you can provide


Flat file database


gonzalezamado,

I initially was going to write a flat file database for this Login System, specifically for people in your position, but I quickly

realized that all the features I wanted (tracking active visitors, etc.) could not really be achieved, or at least to the level that I

wanted them to, with a flat-file database. They don't scale to large number of users and you can't write to the same file at the

same time, so that basically means a huge performance decline. But, those are the drawbacks of flat file databases, and you can't

do anything about that.

You have two options, the first is to write a simple flat file database that doesn't support tracking active visitors (just stores user

information and looks it up). This would take some time to get right, but it shouldn't be that hard. The other is to find a

pre-existing flat file database on the web that you can just insert for use on your website. I found this one while searching

google: FFDB. It's pretty advanced so you may get the active visitors thing working. So just think about that, and I'm sorry I don't

have code to give you that I've written.

robmorin,

I'm not sure I understand the problem you're having, it works when you register but just not on the first time you load the page?

It gives you that error. Look at register() function in session.php, that's where it checks the length of the string you entered.

However it trims the string and calls stripslashes() on it before it checks the length. I'd suggest you echo the string it's checking


39 of 40 1/12/2011 12:17 PM

for debugging this problem. I don't know why it wouldn't work on the first try, but on subsequent tries it does.


Using list boxes - How?

Submitted by SunCoder on October 10, 2004 - 03:24.

Hi, Currently, the register/main php scripts are using text boxes, such as: value("pass"); ?>"> for example. But how to use the

php code within a list box, such as: Germany USA UK How exactly must the php code look alike in that listbox? Please let me

know. I tried several possibilities but none seemed to work. Otherwise, the login script is great, it worked out of the box. Unlike

the previous one which does not performed redirection on one of my pc's using IE (but was ok with NS), for whatever reasons, but

worked on other pcs and configurations including IE from me. Never figured out why exactly it had problems with IE. Thanks JP for

developing and sharing the new code with us


Using list boxes - How? (II)

Submitted by SunCoder on October 10, 2004 - 03:31.

Sorry, the text above looks a little bit confusing, not exactly what i have expected after the preview. I should however be clear

what I mean: How must the complete list box (including php code) look alike. A small sample would be much appreciated. Thanks.


List boxes


SunCoder,

You'd have to check every list item and see if the value given by the list name is equal to the list item value, if so, you print out

"selected" inside the option tag. That's what tells the HTML which item is selected.

Example:

Hope this helps,

JP


1 2 3 4 5 6 7 8 9 ... next page last page


40 of 40 1/12/2011 12:17 PM

PHP Login System with Admin Features _ evolt

Documents

Transcript of PHP Login System with Admin Features _ evolt