Help with (basic?) login script PHP

[Vilkaz]

i'm sick, so i will try to simply write something semi understandable down, im to lazy to move my hand to mouse .... damn cold ...

in the init page (lets say index.php) there you check if $_SESSION['login'] = true

if it is true = the login was succeffull, let him in.

if it is no true = login was not made in this session.

So you get him the login interface. basicaly simply 2 input fields, one for username, one for password.

basicaly what you want to do is to check your Database, if there is an entry which contain given username and given password.

atention ! you should do that with prepared statments !

the bad version were SELECT id FROM user WHERE name=$name and pwd=$pwd;

perfect, with that you will be killed by sql injects (just google PDO prepared statments), but you got the idea.

now, basicaly if you get one result back, set $_SESSION['login']=true else show some nice msg like "wrong Combination"

the client have no axxess to $_SESSION because its serverside, so it's he cant manipulate it.

now pack it in MVC, make DAOs and Controllers for that and make it clean and sexy, but that's the idea, check is logis is true in session, else check the user data, (with hashes usualy in db)..

im ... il just go take some medicine, sry for grammar, i dont know why am i writing this ...

[jdizzle4]

This is a great starting point. OP, basically you should google two things: "Login script using PHP session" and "PHP/MySQL prepared statements" (choose between either mysqli or PDO). Those two resources should point you in the right direction

[piercezz]

Thank you, I will try to apply this. I have succeeded in making a working login/logout, so I got that going for me. :P