mtWeb  Home > PHP > PHP Login Script - FAQSitemap  Search

PHP Login Script - FAQ

Posted by martin on 28 Sep 2002.

Frequently asked and answered questions about the PHP login script and login scripts in general.

This is a list of questions that I have answered many times reguarding my Secure PHP Login Script (also available for download), Jester's Creating a Login Script with PHP 4, and Creating a Login Script with PHP 4 - Part II.

Note: I called my login script secure because it is more secure than the average PHP login scripts that are available. It is not 100% secure and I don't think there can be such a script at all - you have to choose between security and ease of use, portability, etc.

How to expire the logins in 30 minutes (for example)
Set session.gc_maxlifetime and session.cookie_lifetime to 1800.
How to redirect to another page after the user is logged in
Use header("Location: /foobar") before any output (or turn on output buffering)
Users without cookies cannot log in
For PHP versions before 4.2.0 recompile PHP with --enable-trans-sid, newer versions enable it by default. Then add session.use_trans_sid = on in your php.ini.
I get an already exists error when a user signs up
Modify your id column so that it is auto generated - use auto_increment for MySQL and serial for PostgreSQL.
How to get the IP of the visitor without the last part (the C class network)
Use the following code:
$ip = explode('.', $_SERVER['REMOTE_ADDR']);
array_pop($ip);
$ip = implode('.', $ip);
How to generate a cookie for remember-me logins
Set $uid to the id of the current user and then execute the following code:
$cookie = md5(uniqid(mt_rand(1, mt_rand_getmax())));
$cookie = serialize(array($uid, $cookie));

For versions of PHP before 4.2.0 you have to call mt_srand() before using the random number generator.

To send the cookie use setcookie(). Make sure you keep the cookie value in your database.

Note that in my article I have used the username instead of the id but as computers deal with numbers better than strings I recommend using the id.

How do I ensure that queries to the database are safe
Use $db->quote('value') where $db is a PEAR::DB instance or if you are using native MySQL functions mysql_escape_string(). If you deal with numbers always cast them explicitely: $value = (int) $value.
How do I ensure that user supplied information I display on the site is secure
Use htmlspecialchars() on the value to escape HTML code.
What does the session_id() function do
It returns the current session id or if it a new session the newly generated id.
I get an error that says I don't have DB.php
Download and install PEAR or ask your system administrator to do it for you, the packages you need to download are PEAR and DB. The files that are required by PEAR::DB are DB.php, PEAR.php, DB/common.php, and DB/mysql.php for MySQL database or another for your database respectively. Make sure that you add the PEAR installation directory to your include_path.
How do I change my PHP configuration
Read Make Your PHP Code Portable for a quick start, more detailed information can be found in the PHP manual.

Comments

another way to save cookie string
by guillem on 3 Oct 2002 6:18pm GMT

if like me you can't understand the serialize thing u can try this. We make the string of the cookie and separate it with | char.

$cookie = $_SESSION['username']."|". $_SESSION['cookie'];

then in the _checkRemembered we use
list($username, $cookie) = explode("|",$cookie);

to get the vars back

it's another way

Suppress notices
by martin on 3 Oct 2002 7:58pm GMT

Just to make sure you don't get any notices if you're using PHP with error_reporting set to E_ALL use this:

@list($username, $cookie) = explode('|', $cookie)

You'll need a check like !empty($username) too.

User & Password login
by TC (info@infoboks.dk) on 15 Jan 2003 6:41pm GMT

As I am not a pro-programmer, I was directed to you by a friend who said U will be glad to help.

Anyway, doesn´t your login script require all sorts off agreements with the admin´s server?

Or can it be easily integreted into a html document and subsequently uploaded?

uri_self() in login.php and others
by mvrks (rmanda@silicainc.com) on 22 Jan 2003 5:42am GMT

I found html_form.php and included it. Now when I pull up login.php in the browser, it says undefined function uri_self() in login.php. I see that it is called as $form = new Form(uri_self());

There is no other reference in this site or anywhere else.

Please help!!!!!!!!!!!

uri_self() in login.php and others - WORKS!
by Ravi Manda (rmanda@silicainc.com) on 22 Jan 2003 7:54pm GMT

I fgured it out. Needed to include functions.php and global.php in login.php. I actually saw the user account form! I started learning PHP two days ago! Good Stuff! I havent done the whole thing yet, and might need some pointers as I go down the line. Thanks again!

html_form.php
by Erectus (j.ollas@home.se) on 8 Feb 2003 10:31am GMT

dont know much about much so i need some help :-), when i try to run the login.php page it says that:

Warning: main(html_form.php) [function.main]: failed to create stream: No such file or directory in /www/htdocs/php-login-script/login.php on line 8

Fatal error: main() [function.main]: Failed opening required 'html_form.php' (include_path='.:/usr/local/lib/php') in /www/htdocs/php-login-script/login.php on line 8

Where can i get an html_form.php??

Thanks.

html_form.php
by Erectus (j.ollas@home.se) on 8 Feb 2003 10:35am GMT

I found it, but know he says:

Fatal error: Call to undefined function: uri_self() in /www/htdocs/php-login-script/login.php on line 9

see that Ravi Manda, has figured it out, needed to include functions.php and global.php in login.php but how do i write that.

undefined function
by helpfznetworks (dawg868@fznetworks.com) on 11 Mar 2003 6:44pm GMT

Fatal error: Call to undefined function: begin_html() in /www/d/dawg868/cgi-bin/login/signup.php on line 4

not working.
by JM (jm5@pandora.be) on 28 Mar 2003 5:06pm GMT

same problem here ...

Fatal error: Call to undefined function: begin_html() in /home/wetteren/www.standaardwetteren.com/login/index.php on line 4

response to JM and dwag868
by nana () on 30 Mar 2003 5:35pm GMT

just comment out begin_html() fuction call.

Also, inform if you got it to work.

cool login
by php wiz (notachange@hotmail.com) on 30 Apr 2003 12:20pm GMT

I got it working after three days of errors. Configured and rearanged some of the code. Works a treat!

This is now getting funny
by BB (sqedude@yahoo.com) on 9 May 2003 2:37am GMT

May I suggest a clear description be written (because I have the same issue) about how, where and what needs to be in what directory in relation to htdocs on an apache server? and where does pear go and - geez there are such a snaggle of parts, but, I am a newbie and only desire clarity from those who know and have suffered before me.

How can I write Login Script in php
by Amrens (amrens_raaj@hotmail.com) on 26 May 2003 3:06pm GMT

Sir,

Now i want to know about the session register and unset. How can I use this ? Please send me some script to know about that.

Thanks !

Amrens Raaj

uri_self()
by Stelian (stelian@ziua-shop.ro) on 3 Jun 2003 6:25am GMT

Help me, it ghive`s me a error at this line ...

$form = new Form(uri_self());

in login.php

what can i do to work?

PLZZ HELP MEE!!!

Fatal Error
by adrian (toadiadrian@yahoo.com) on 4 Jun 2003 2:49am GMT

please help me :

Fatal error: Call to undefined function: begin_html() in /home/adrian/public_html/login/index.php on line 4

HELP
by (webguru18@yahoo.com) on 21 Jun 2003 4:04am GMT

Fatal error: Call to undefined function: begin_html() in D:\wwwroot\cmoretv\index.php on line 4

READ! READ!
by () on 23 Jul 2003 10:24am GMT

why cant you people read comments???

same thing asked million time and million answers and no you ask it again!!!! WHY?

An alternative site to this one!
by XUhybrid (chriswhite31@hotmail.com) on 30 Jul 2003 8:15pm GMT

http://www.evolt.org/article/comment/17/27093/

Good Luck. I know some and i can figure out the rest. If you find this useful, good for you! ;)

-Peace, Chris

Session Not Working in PHP Function
by vivek (thapliyal_vivek@rediffmail.com) on 31 Jul 2003 9:09am GMT

Hi all,

I am trying to print a session variable inside a function but no result.Can you please help.

Here is what i am doing

//////// file.php

include ("file2.php");

view($items);

////////File2.php

$HTTP_SESSION_VARS['test']=1;

function view($item)

{

print $HTTP_SESSION_VARS['test'];

}

Thanks

Vivek

check ip of aol user
by () on 20 Aug 2003 8:22pm GMT

How to get the IP of the visitor without the last part (the C class network)

Use the following code:

$ip = explode('.', $_SERVER['REMOTE_ADDR']);

array_pop($ip);

$ip = implode('.', $ip);

---

this does not work with aol 7.0. any ideas to get it to work?

what the hell...
by ryan neri(pogi) (madhacker001@yahoo.com) on 4 Sep 2003 1:59pm GMT

grabe ang hrap.. ive used the code and it worked fine.. after a few days though.. hello to jobert and webmaster louie[KUPZ]..

What if i have suspended account
by nullimit (chan13th@mail.com) on 1 Oct 2003 10:46am GMT

hello what about active or suspended member,i want to alert the user that login if their account being suspended or their password wrong or their user name is wrong?

login_php and functions
by bapuka on 2 Oct 2003 4:17am GMT

You can do it before begin_html() :

require_once("global.php");

function uri_self()

{

$_SERVER['PHP_SELF'];

}

and how found html_form.php?

Page Not Parsing
by Dark Lord Rising on 28 Oct 2003 7:07pm GMT

Hey All,

PHP is pretty new to me, but I have to admit that I just read through Martin's site and got almost everything working.

I thought I had most of this thing figured out, then hit a snag. From what I can tell, the pages are finding everything they need, the MySQL db is running but as soon as I try to load the index.php page all I get are the headers and footers for the html and body. No errors and now visual help.

I know I have php running because I have phpmyadmin running, and a few other php apps.

I have looked everywere I can think of. I have double checked my permissions, checked paths and manually logged into the db. Everything is working.. except I can't see the page(s).

If anyone can throw me a bone on this I would really appreciate it.

Thanks everyone!

PS: Thanks Martin

login script
by Anthony (imfromdownsouth@yahoo.com) on 1 Dec 2003 4:59pm GMT

I just downloaded your login script but i could not find any install and configure docs on the site.

login script - complete download humm
by Jamie Scott (jamie_scott@yhaoo.com) on 11 Dec 2003 9:28pm GMT

The global.php references a config file. I assume this contains the connection string to the mysql database.. Can anyone confirm that format of this file?

Restrict login to specific IP
by Dexter F. Stowers (dexter@clemson.edu) on 14 Dec 2003 1:29pm GMT

Hi Martin,

Thank you for your great work. I am a programmer but a newbie to scripting. I want to use your script to restrict access to a web page from a particular machine/IP address. Could you help me with the please. Your assistance will be greatly appreciated.

-- Dexter F. Stowers

new in php
by mae (mae_82my@yahoo.com.sg) on 24 Dec 2003 7:54am GMT

hi i still new in this php thing, so i need a guide..recenly i need to do login in password, but i don't know how to do...so anyone know abt it??

This script really sucks.
by Harry (hshin21@yahoo.com) on 25 Dec 2003 10:08pm GMT

Folks, if you are not a well experienced oop programmer, don't try this script. It has too many bugs, and I suspect this guy, martin, intents to waste your time. Or, he is unbelievably irresponsible person.

I have more than ten years of experience in oop. I am struggling with this garbage-like script. Now it's almost done anyway. You will hardly succeed with this script unless you are not really good since this script really sucks.

example of suitable config.php
by Eric Hawkins (erichawkins_2000@yahoo.com) on 31 Dec 2003 1:13am GMT

Does someone have an example of a suitable config.php that is called from global.php?

how do i intsall
by anime (thabugly@yahoo.com) on 1 Jan 2004 5:30am GMT

how do i intsall

redirect function not defined
by Philip () on 2 Jan 2004 2:18am GMT

After some hours of editing the code, so that it would work, still the redirect()-function, as in login.php:

redirect('/user/');

did not work because it is not defined.

What is the redirect()-function(the code)?

Totally Lost
by Debbie (dimsumyummi@juno.com) on 4 Jan 2004 3:08am GMT

umm... if someone figures out how to install every would you mind helping me. i have no idea what anything means and i can't find html_form.php.

begin_html() error
by Coco (webmaster@diabcomputers.com) on 9 Jan 2004 11:32am GMT

Call to undefined function: begin_html() what is the cause problem. please help. i am trying to make login software in php. need it badly

User.php
by alf (adpaster@hotmail.com) on 21 Jan 2004 4:55pm GMT

Help!!

Keep getting the error:

Fatal error: Call to a member function on a non-object in /var/www/html/php-login-script/user.php file.

Line is:

result = $this->db->getRow($sql);

User.php
by alf (adpaster@hotmail.com) on 21 Jan 2004 4:58pm GMT

Correction

Line is:

$result = $this->db->getRow($sql);

Installation instructions?
by Ethan Alpert (ethan@audio-crusade.com) on 27 Jan 2004 11:26pm GMT

I'm plowing through this and got some parts working.

Don't know if it's buggy like people say but it appears that some installation instructions would be helpful. Considering all the requires you have to set up.

I read through all the questions above and it appears no one cares about actually answering the valid questions.

Hotmail login...
by Nav (brar100@canton.edu) on 5 Feb 2004 11:32pm GMT

Hello all,

would appreciate any help with this...

i basically want to create a start page

from which i can login to my hotmail among other things...

so how would i go about doing that...

creating a from that takes username and password and once i hit enter it would direct me into my hotmail inbox...

email me any help/suggestions...

thanks...

Nav

Login Script with PHP
by Segundo Bethencourt (segundobethencourt@hotmail.com) on 28 Feb 2004 12:11am GMT

I have no idea how this code work.

I have installed my apache, mysql, and php4.

I have created the tables into a database... I dont know how to fix my problem... even more I dont really know where are my bugs.

thank you for your support

Fatal error
by dory (doriangi@tin.it) on 23 Mar 2004 9:11am GMT

Help!!

Keep getting the error:

PHP Fatal error: Call to a member function on a non-object in c:\appserv\www\progetto\php\login.php on line 20

Line is:

$figlio2 = $figlio1->next_sibling();

Thank you

WHERE IS config.php ???
by stigmand on 1 Apr 2004 6:30pm GMT

You are referred to this -

* From the PHP Login Script site, download config.php and put it in the directory above html/, in most cases www/.

But I cant find it ??? It is not there

Do anyone know where I can find it and thus I download it ???

Does this great script work fine on WAP phone?
by Cuong Nguyen (wood_flower@hn.vnn.vn) on 4 Apr 2004 1:06pm GMT

I want a script to let my user log in and out on my WAP site! Does this script do fine?

Yes
by shmookey on 29 Apr 2004 12:14pm GMT

Yes it does, Cuong

DB error
by dewman (venum069@stny.rr.com) on 1 Jun 2004 1:54pm GMT

I got it all configured and rolling except any page i goto says "DB Error: not found" The DB is up and working I can log into it. I used the included sql script and created the database and tables. what did I miss?

P.S. Most you noobs arn't downloading pear and setting it up thats 1/2 the questions I see on here. SO GET IT AND SHUT UP.

PHP script not so secure
by Amwoyo M. Kennedy (mbagoken@yahoo.com) on 2 Jun 2004 6:48am GMT

I'm not so old in the PHP-MySQL field. A few tips from your website is worth mentioning.My PHP Login script doesn't track sessions. Once a user logs out and another one comes immediately to use the same browser that he was using and the, he is able to view the prohibited pages without. Why cant the script refer him to the logon page.

non-existent class: form
by Rob (robmc5@hotmail.com) on 11 Jun 2004 1:18pm GMT

Its taken a while but I have gotten past a lot of errors, I added

require_once('../functions.php');

to login.php and but the PEAR package HTML_form in the root of my login folder and this helped a lot of my problems, this is really a great learning exercize for PHP.

My problem now is

non-existent class: form on

$form = new Form(uri_self());

I hope someone is checking this forum.

db error
by Slugball () on 20 Jun 2004 4:27pm GMT

I've got the same problem as dewman, theres a db error, I know have I have to enter my database name, but how do I get my database name? where is it?

How to identify user login once ?
by Martin Cheng (tim@mail.joding.com.tw) on 29 Jul 2004 8:36am GMT

How to identify user login once , the same user account only once at the same time !

config.php
by Matthew (m_a_t_t1988@hotmail.com) on 26 Sep 2004 2:53pm GMT

hello, in q.6 it says i need to download config.php, where is this?

where to i download it from?

config.php
by h van ledden (hvledden@zonnet.nl) on 1 Oct 2004 12:56am GMT

Where can i find config.php?

needed: instructions for a moron
by Paul (Paul_m3@hotmail.com) on 1 Oct 2004 7:38am GMT

Hi.. After several days of trying to get this script to work I have decided to give it away as a waste of time. Being brand new to website design, php, mysql, pear etc etc it is all too difficult. I am somewhat disappointed because from what I could make out it seems like a good script but it is just too difficult to install for a complete newbie. If someone out there who has managed to get it to work can write a morons guide to installing this thing I might give it another try but the problem is the more we know the more we assume others know and start to leave out important details like a clear directory structure, a complete list of needed files and where they go, file names that this code goes into, maybe even a brief overview of why each file is called to better understand what is happening. I for one wouldn’t be insulted by someone stating something really really obvious because at the shallow end of web designing pool it would help immensely. Anyway good luck to those that follow I wish you better luck than I had.

Lesson is...
by rdc_uk () on 1 Oct 2004 3:05pm GMT

Don't require a specific extra API (PEAR) for your example to work.

Suggest rewrite to use text file...