here is the whole script before it was edited to fit my needs I need mysqli as my server uses PHP Version 5.4.45
MySQL Version 5.5.51-38.2 the script I download used an earlier version of php and my_sql
Script 1 named adminpage.php
<?php
//Resume existing session:
session_start();
//If user isn't logged in, redirect to login page:
if (!isset($_SESSION['user'])) {
header('Location: login.php');
}
?>
Login 1.0
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<link href="css/style.css" rel="stylesheet">
</head>
<body>
<div id="container">
<h2>Welcome <?php echo $_SESSION['user']; ?></h2>
<p>You are now logged in!</p>
<p>[ <a href="includes/logout.inc.php">Log out</a> ]</p>
</div>
</body>
Script 2 named login.php
<?php
include ("includes/loginproc.inc.php");
?>
Login 1.0
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<link href="css/style.css" rel="stylesheet">
</head>
<body>
<div id="container">
<?php echo $errormsg; ?>
<h2>Login</h2>
<form method="post" action="login.php">
<label>Username:</label><br>
<input type="text" size="25" name="usern" value=""><br>
<label>Password:</label><br>
<input type="password" size="25" name="pass" value=""><br>
<input type="submit" value="Login">
</form>
</div>
</body>
Script 3 named config.inc.php
<?php
$hostname = 'localhost'; //Your MySQL hostname (usually named as 'localhost').
$dbname = 'dbname'; //Your database name.
$username = 'dbuser'; //Your database username.
$password = ''; //Your database password (if your database has no password, leave it empty).
//Let's connect to host:
mysql_connect($hostname, $username, $password) or DIE('Connection to host failed, perhaps the service is down!');
//Select the database:
mysql_select_db($dbname) or DIE('Database name is not available!');
?>
Script 4 named loginproc.inc.php
<?php
//Start session:
session_start();
//Include db settings and create a connection:
include("config.inc.php");
//Create variable for username input and prevent sql injections:
$username = mysql_real_escape_string($_POST['usern']);
//Create variable for password input, prevent sql injections and hash it with md5:
$password = mysql_real_escape_string(md5($_POST['pass']));
//Select matching username and password from admin table based on input:
$sql = "SELECT * FROM admin WHERE username = '$username' AND password = '$password'";
//Execute query to db:
$execute = mysql_query($sql);
//If user input doesn't match a user in db:
if (mysql_num_rows($execute) != 1 && $_SERVER["REQUEST_METHOD"] == "POST") {
//Create error message:
$errormsg = "
The username and/or password you entered was incorrect!
";
}
//Else if user exists in db:
else if (mysql_num_rows($execute) == 1) {
//Set username session variable based on username input:
$_SESSION['user'] = $username;
}
//If user is already logged in, redirect to admin page:
if (isset($_SESSION['user'])) {
header('Location: adminpage.php');
}
Script 5 named logout.inc.php
<?php
//Resume existing session:
session_start();
//Destroy current session:
unset($_SESSION['user']);
//Redirect to logged out page:
header('Location: ../loggedout.html');
?>
and 1 html page named loggedout.html
Login 1.0
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<link href="css/style.css" rel="stylesheet">
</head>
<body>
<div id="container">
<h2>Logged out page</h2>
<p>This is just a HTML page which is not password-protected.</p>
<p>[ <a href="login.php">Login</a> ]</p>
</div>
</body>
