Login system and user profile

[peterr]

Hi guys,

I'm trying to let my login script work with the amazing user profile script made by Jacek.

I'm trying to call the $user_info = fetch_user_info($_GET['uid']); in my login.php to grab data about the user from the init.inc.php. BUT, it says: Notice: Undefined index: uid in D:\Program Files\xampp\htdocs\SCRAPLL\profile.php on line 5.

My login.php:

<?php

session_start ();

$username = $_POST["username"];
$password = $_POST["password"];

if ($username&&$password)
{

$connect = mysql_connect ("localhost","root","erohak") or die ("couldn't connect");
mysql_select_db ("phplogin") or die ("Couldn't find db");

$query = mysql_query ("SELECT * FROM users WHERE username='$username'");

$numrows = mysql_num_rows ($query);

if ($numrows !=0)
{

while ($row = mysql_fetch_assoc ($query))
{
	$dbusername = $row ['username'];
	$dbpassword = $row ['password'];
}
//check to see if they match
if ($username==$dbusername&&$password==$dbpassword)
{
	header('Refresh: 0; url=profile.php');
	$_SESSION['username']=$username;
	
}
else
	header('Refresh: 0; url=login_wrong.php');
}
else
	header('Refresh: 0; url=login_wrong.php');
}
else 
	die ("Wrong username/password");

?>

How can I make this script work with the user profile system. When I login, it goes to localhost/scrapll/profile.php, but the rest, so ?uid=... doesn't appear, so I can't login to the right account, or actually the right ID.

Where in this script should I add the line to grab the uid data? If I put

include('core/init.inc.php');

$user_info = fetch_user_info($_GET['uid']);

after session_start() it gives the error I've added in this topic.

Thank in advance!

Regards,
Peter

[jacek]

First, since you are using 0 seconds here

header('Refresh: 0; url=login_wrong.php')

you may as well just use the valid header

header('Location: login_wrong.php')

Since you are using the session, you may as well store the users Id in the session rather than passing it via the URL.

There is also no need to use a while loop to fetch a single row, and you may want to look into sql injection since it would be pretty easy to do with your code.

You should not be using die() to send error messages really either.

[peterr]

I understand, but do you also know how to make this login work with uid?

The first thing I need to do is to check the username and password with:

session_start ();

$username = $_POST["username"];
$password = $_POST["password"];

What should I add to my code to login to the right account?

Please help me on how to make this compatible with the user profile. I just need to do this and after this I want to complete my site and publish it.

Regards,
Peter

[peterr]

I just found something:

In my login script there's a line that says that if the username and password are true, the user gets linked to profile.php. Now, I've found a solution on the PhpAcademy forum. Instead of linking to the profile.php, I can link to profile.php?uid=' . $id. Well, I don't have a variable called id, what should I enter there in the place of $id. I've tried everything, but it keeps giving me errors.

[jacek]

Please help me on how to make this compatible with the user profile. I just need to do this and after this I want to complete my site and publish it.

You need to come up with a better login script before you can publish anything. With your current code someone could log in as any user they wanted.

[peterr]

Can I use your login script and come back for help?

[jacek]

Can I use your login script and come back for help?

You could... it should be easier to combine too since most things are done with functions.

[Muhanned]

        header('Refresh: 0; url=profile.php');
        $_SESSION['username']=$username;
        

you have this in line 29 or 30

when the php start the header will be start first
the the header function work
it going to cancel anything bellow {I think like that }

better 2 user meta refresh {html} better than

        header('Refresh: 0; url=profile.php');
        

[jacek]

it going to cancel anything bellow {I think like that }

Nope, the rest of the script will run.

better 2 user meta refresh {html} better than

Defiantly not !