Posted by J.O. Aho on 06/10/06 16:28

webmechanic wrote:
> I have a photo gallery site and would like to
> 1. validate login information(username & password)
> 2. logout user due to inactivity for certain amount of time
> 3. Create logout button
>
> Please provide tutorial or thorough explanation. Thanks.

You need a table with the user names and passwords, and use a one way coding
for the password, this makes it more difficult to figure out the passwords if
someone manages to get some access to the user table.


UserTable
username (primary key)
password (md5sum this one)

In the login script, you md5('password') and then make a query

$query="SELECT * FROM UserTable WHERE username='$user' AND
password='".md5('password')."'";

http://www.php.net/manual/en/function.md5.php


or with plain SQL
$query="SELECT * FROM UserTable WHERE username='$user' AND
password=MD5('$password')";

http://dev.mysql.com/doc/refman/5.0/en/extensions-to-ansi.html


Use mysql_num_rows() to see how many rows you got in your mysql_query($query),
if your result is 1, then the user name and password was right, if it's only
0, then the password or the user name wasn't right.
If the login was correct, then set a session, you can set a time limit on it,
which makes users to be logged out after X minutes, each time you load a new
page, you check for the session and if it's there the user is still logged in,
update the session cookie to last another X minutes. This way you have the X
minutes as an inactivity time.
http://www.php.net/manual/en/ref.session.php

For the logout button, you just make a simple form with the submit button,
this loads a script where the session cookie is killed. A nice feature is to
use a if-statement where you have the login form on your page, if no session
cookie, then show the login form, if session cookie then show the logout button.

I hope you can manage to write your code from this.


//Aho

[Back to original message]