Create login with accesslevels and a remember function

[blodan]

First off, these guides arent for people that just learned PHP, you will probably need acouple of months of coding before you get a grip of everything, but, im trying to make these guides as friendly as possible.

* hash = something that makes the "hashed" string unreadable to the naked eye, for example with sha1() or md5()
* salt = random word inserted into the password to make it brute-force safe

There is plenty of ways of doing a good login-system, what you should take in mind before you start though is where your site is located.

Case 1
If you rent space from some webhosting company you will probably be sharing the same server with hundreds of other costumers. What you should check for here is if you can read files outside your directory, thats done with a simple filebrowser script (which you also can read about in one of our guides). If you can you should probably think about changing hostingcompany, because if you run a popular site and someone in boredom decides to dns your domain and gets the bright idea "hey, that site is on the same ip as my site". He can simply access your whole source code and therefor get your mysql username/password or whatever else information you got there like accesslevels and so on.

Case 2
You have your own server or that you cant browser outside your own directory with scripts on a hosting company server. This is good, this way no one will get hold of your source, except the serveradmin ofc.
One more thing..
Before we jump into the fun there is one more thing you should take in consideration and that is the php flag "magic_quotes_gpc", this should normaly be switched to off, but in some cases hosts do have it switched on. What this built in php function does is adding slashes to _POST, _GET and _COOKIE, whichs means if you have it activated and use a form with a input where you type "Hi, my name is Daniel, what's yours?" and press the submit button your text will then get converted to "Hi, my name is Daniel, what\'s yours?" which is completly nuts because when you then escape it before you insert it to a mysql query it will be double escaped. Lets say you were not gonna use it for a mysql query in the last example, you then would have had an escaped string which you would have had to run stripslashes() on to view it normally, how smart is that?

How do I see if its activated then?
paste this in a file named nfo.php

Line number On/Off | Expand/Contract | Select all

1. <?
2. phpinfo();
3. ?>

then just visit the nfo.php file and search for magic_quotes_gpc and you´ll see if its activated or not.

Well, if its activated, how do i turn it off?
There is two ways of doing this, if your host allows you to use .htaccess files you can just type "php_flag magic_quotes_gpc off" (without the "" ofcourse)

Another way is to mail your hostprovider and tell them to add this line to your apache vhost, that should look something like this:

Line number On/Off | Expand/Contract | Select all

1. <VirtualHost *:80>
2.         DocumentRoot /home/phpguides/
3.         ServerName http://www.phpguides.eu
4.         ServerAlias phpguides.eu
5.         CustomLog /var/log/httpd_access_logs/www.phpguides.eu-access_log combined
6.         php_flag magic_quotes_gpc off
7. </VirtualHost>

So, now when we have passed all that, shall we start?

In this guide i´ll put everything in different functions, named checklogin(), login(), logout(), checklevel(currentlevel), and they are all put in functions.php which is included in index.php. If you dont understand the layout in the end you should probably check out my guide under site layouts, this way all newcomers to php will probably understand what we are doing here because its simple and straight forward instead of making cracy classes and so on.
___________________________________________________________________________________________________________________________________________________________________________________

Ill start with giving you a MySQL table for users and accesslevels we will be working with, in this guide i got no max limits on either username or password, if you want that feel free to add that yourself.

Line number On/Off | Expand/Contract | Select all

1. CREATE TABLE `users` (
2. `id` BIGINT NOT NULL AUTO_INCREMENT PRIMARY KEY ,
3. `username` TEXT NOT NULL ,
4. `password` TEXT NOT NULL ,
5. `mail` TEXT NOT NULL ,
6. `firstname` TEXT NOT NULL ,
7. `lastname` TEXT NOT NULL ,
8. `ip` TEXT NOT NULL ,
9. `banned` LONGTEXT NOT NULL ,
10. `activated` ENUM( '0', '1' ) NOT NULL DEFAULT '0',
11. `lastseen` INT NOT NULL ,
12. `regdate` INT NOT NULL ,
13. `activate_code` VARCHAR( 10 ) NOT NULL
14. ) ENGINE = INNODB;

Line number On/Off | Expand/Contract | Select all

1. CREATE TABLE `accesslevels` (
2.   `id` BIGINT(20) NOT NULL AUTO_INCREMENT,
3.   `uid` BIGINT(20) NOT NULL,
4.   `levels` TEXT NOT NULL,
5.   PRIMARY KEY (`id`)
6. ) ENGINE=INNODB;

Pretty basic infos gathered here, nothing else.
___________________________________________________________________________________________________________________________________________________________________________________

Ill start with showing you the basic site layout before we start adding the login:
index.php

Line number On/Off | Expand/Contract | Select all

1. <?
2. include("config.php");
3. include(incurl."functions.php");
4. include("Mail.php");
5. if(!preg_match('/^[a-z0-9\+\/\=\#\%\_\^\@\.\?\&\-]+$/i', $_SERVER["QUERY_STRING"]) && strlen($_SERVER["QUERY_STRING"]) != 0) {
6.     echo "Invalid string"; exit;
7. }
8. $connect = @mysql_connect(myhost,myuser,mypwd);
9. mysql_select_db(mydb) or die(mysql_error());
10. session_start();
11. ?>
12. <? echo "<?xml version=\"1.0\" encoding=\"iso-8859-1\"?>\n"; ?>
13. <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
14. <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
15. <head>
16. <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
17. <title>Testsite</title>
18. <link rel="stylesheet" type="text/css" href="main.css" />
19. </head>
20.  
21. <body>
22.  
23. </body>
24. </html>
25. <?
26. mysql_close($connect);
27. ?>

config.php

Line number On/Off | Expand/Contract | Select all

1. <?
2.  
3. # mysql info
4. define("myhost", "localhost");
5. define("myuser", "testsite");
6. define("mypwd", "asdasd");
7. define("mydb", "testsitedb");
8.  
9. # Site urls
10. define("url", "http://www.testsite.eu/");       //Adress to the site
11. define("incurl", "/home/testsite/");    // the folder where all files is except index.php
12.  
13. # Mail info
14. $mejl_ip = "mail.testsite.eu";
15. $mejl_port = 25;
16. $mejl_auth = false;
17. $mejl_username = "";
18. $mejl_password = "";
19.  
20. ?>

functions.php

Line number On/Off | Expand/Contract | Select all

1. <?
2. function getresult($query) {
3.     $grek = mysql_fetch_array(mysql_query($query));
4.     return $grek;
5. }
6. function mejla($to, $title, $by, $body) {
7.     global $mejl_ip, $mejl_port, $mejl_auth, $mejl_username, $mejl_password;
8.     $recipients = $to;
9.     $headers["Date"] = date("D").", ".date("d")." ".date("M")." ".date("Y")." ".date("H").":".date("i").":".date("s")." ".date("O");
10.     $headers["From"] = "PHPguides <".$by.">";
11.     $headers["To"] = $to;
12.     $headers["Subject"] = $title;
13.     $headers["Content-Type"] = "text/plain; charset=\"iso-8859-1\"";
14.     $params["host"] = $mejl_ip;
15.     $params["port"] = $mejl_port;
16.     $params["auth"] = $mejl_auth;
17.     $params["username"] = $mejl_username;
18.     $params["password"] = $mejl_password;
19.     $mail_object =& Mail::factory("smtp", $params);
20.     $mail_object->send($recipients, $headers, $body);
21. }
22. ?>

___________________________________________________________________________________________________________________________________________________________________________________

Lets have a look on the login function

Line number On/Off | Expand/Contract | Select all

1. function login() {
2.     global $connect;
3.     //convert username to something secure so we can user it in a db query
4.     $username = md5(strtolower($_POST["username"]));
5.    
6.     //converting the password that the user typed to whatever hash you made on the registration process
7.     $password = sha1("thiswould".md5($_POST["password"])."bepretty");
8.     $saveme = $_POST["saveme"];
9.    
10.     $sql = mysql_query("select id, username, password, mail, activated, banned from users where md5(lower(username))='".$username."'");
11.     if(mysql_num_rows($sql) == 1) {
12.         while($RS = mysql_fetch_array($sql)) {
13.             $real_pwd = $RS["password"];
14.             $real_username = $RS["username"];
15.             $real_mail = $RS["mail"];
16.             $real_banned = $RS["banned"];
17.             $real_activated = $RS["activated"];
18.             $real_uid = $RS["id"];
19.         }
20.         if($real_pwd == $password) {
21.             if(strlen($real_banned) == 0) {
22.                 if($real_activated == 1) {
23.                     if(mysql_result(mysql_query("select count(*) from accesslevels where uid='".$real_uid."'"),0) == 1) {
24.                         $level = mysql_result(mysql_query("select levels from accesslevels where uid='".$real_uid."'"),0);
25.                     }else{
26.                         $level = "";
27.                     }
28.                     $_SESSION["lvl"] = $level;
29.                     $_SESSION["uid"] = $real_uid;
30.                     $_SESSION["pwd"] = $real_pwd;
31.                     if($saveme == 1) {
32.                         $expire = pow(2, 31) -1;
33.                         setcookie("saveme", sha1(strtoupper($real_mail)."your".$real_username."kindof".$real_pwd."lol"), $expire);
34.                         setcookie("uid", $real_uid, $expire);
35.                     }
36.                     if($saveme == 1) {
37.                         mysql_query("update users set lastseen=UNIX_TIMESTAMP(), ip='".$_SERVER["REMOTE_ADDR"]."' where id='".$real_uid."'");
38.                     }else{
39.                         mysql_query("update users set lastseen=UNIX_TIMESTAMP() where id='".$real_uid."'");
40.                     }
41.                     mysql_close($connect);
42.                     header("Location: ".url);
43.                 }else{
44.                     echo "Your account isnt activated yet, please check your mail.";
45.                 }
46.             }else{
47.                 echo "Your banned due to: ".$real_banned;
48.             }
49.         }else{
50.             echo "Password missmatch";
51.         }
52.     }else{
53.         echo "There was no such username";
54.     }
55.     exit;
56. }

So now you might wonder if im nuts or not, why is the dude using both cookies and sessions?
There is one good reason for this, when you are using a shared server all session data is saved on the same place (if you dont specify otherwise) therefor othersites can access your sessiondata and therefor use your login. In this case they cant because they need the cookie too and thats stored on your computer which they dont have access to. The cookie is also used for users that has checked the "Remember me" checkbox so they dont have to login each time they visit the site. You will probably understand more when you check out the checklogin function.
___________________________________________________________________________________________________________________________________________________________________________________

Line number On/Off | Expand/Contract | Select all

1. function checklogin() {
2.     global $connect;
3.     if(isset($_COOKIE["saveme"]) && !isset($_SESSION["uid"]) && strlen($_COOKIE["saveme"]) > 0 && is_numeric($_COOKIE["uid"])) {
4.         $checksave = getresult("select id, mail, username, password from users where md5(id)='".md5($_COOKIE["uid"])."' and ip='".$_SERVER["REMOTE_ADDR"]."'");
5.         if(sha1(strtoupper($checksave["mail"])."your".$checksave["username"]."kindof".$checksave["password"]."lol") == $_COOKIE["saveme"]) {
6.             if(mysql_result(mysql_query("select count(*) from accesslevels where uid='".$checksave["id"]."'"),0) == 1) {
7.                 $level = mysql_result(mysql_query("select levels from accesslevels where uid='".$checksave["id"]."'"),0);
8.             }else{
9.                 $level = "";
10.             }
11.             $_SESSION["lvl"] = $level;
12.             $_SESSION["uid"] = $checksave["id"];
13.             $_SESSION["pwd"] = $checksave["password"];
14.         }else{
15.             mysql_close($connect);
16.             header("Location: ".url."?login=logout&reason=cookiechange");
17.         }
18.     }
19.     if ( isset($_SESSION["uid"]) || isset($_SESSION["lvl"]) || isset($_SESSION["pwd"])  ) {
20.         $id = $_SESSION["uid"];
21.         if (!preg_match('/^[0-9]+$/i', $id)) {
22.             mysql_close($connect);
23.             header("Location: ".url."?login=logout&reason=cookiechange");
24.             exit;
25.         }
26.         $grek = getresult("select username, banned, password, mail, activated from users where id='".mysql_real_escape_string($id)."'");
27.         $asd = getresult("select levels from accesslevels where uid='".mysql_real_escape_string($id)."'");
28.         if ($_SESSION["pwd"] != $grek["password"] || $_SESSION["lvl"] != $asd["levels"] || strlen($grek["banned"]) > 0 || $grek["activated"] == 0) {
29.             mysql_close($connect);
30.             header("Location: ".url."?login=logout&reason=cookiechange");
31.             exit;
32.         }
33.         if(isset($_COOKIE["saveme"]) && sha1(strtoupper($grek["mail"])."your".$grek["username"]."kindof".$grek["password"]."lol") != $_COOKIE["saveme"]) {
34.             mysql_close($connect);
35.             header("Location: ".url."?login=logout&reason=cookiechange");
36.             exit;
37.         }
38.     }
39.  
40. }

That wasnt so complicated, or was it?

Why am i only using ip-check for auto-login/remember me logins? This is because some users do have a load-balanced network using different ips each time they refresh a page, therefor they now have a chance of being logged in without the remember me/auto-login feature.
___________________________________________________________________________________________________________________________________________________________________________________

Now to the even easier part, the logout function.

Line number On/Off | Expand/Contract | Select all

1. function logout() {
2.     global $connect;
3.     $userid = $_SESSION["uid"];
4.     session_unset();
5.     session_destroy();
6.     if(isset($_COOKIE["saveme"])) {
7.         setcookie("uid", "", time());
8.         setcookie("saveme", "", time());
9.     }
10.     $user = getusername($userid);
11.     if(!isset($_GET["reason"])) {
12.         //make some kind of log
13.         mysql_query("insert into log (section, date, line) Values(\"login\",UNIX_TIMESTAMP(), \"$user logged out from ".$_SERVER["REMOTE_ADDR"]." (".gethostbyaddr($_SERVER["REMOTE_ADDR"]).")\")");
14.     }elseif($_GET["reason"] == "cookiechange") {
15.         mysql_query("insert into log (section, date, line) Values(\"login\",UNIX_TIMESTAMP(), \"$user logged out from ".$_SERVER["REMOTE_ADDR"]." (".gethostbyaddr($_SERVER["REMOTE_ADDR"]).") due to changes in his cookie.\")");
16.     }
17.     mysql_close($connect);
18.     header("Location: ".url);
19.  
20. }

___________________________________________________________________________________________________________________________________________________________________________________

Only the accesslevels left now, if you havent understood a thing of this guide, try typing the code yourself and maybe change some stuff to get a feeling for it. But my guess is that most of you are pretty familiar with all this stuff already.

Line number On/Off | Expand/Contract | Select all

1. function checklevel($levelneeded) {
2.     if($_SESSION["lvl"] == "") {
3.         return false;
4.     } else {
5.         $check = strpos($_SESSION["lvl"], $levelneeded);
6.         if(empty($check)) {
7.             return false;
8.         }else{
9.             return true;
10.         }
11.     }
12. }

The accesslevel string looks something like this, ".ADM_USERS, ADM_NEWS, ADM_COVERAGE, ADM_ARTICLES, ADM_COMMENTS", to make this string ill give you a simple example with checkboxes:

Line number On/Off | Expand/Contract | Select all

1. <?
2. if($_GET["update"] == "levels" && is_numeric($_GET["userid"]) && checklevel("ADM_USERS")) {
3.     $levels = ".".implode(", ", $_POST["levels"];
4.     //now just insert $levels into the accesslevels table
5.     if(mysql_result(mysql_query("select count(*) from accesslevels where uid='".$_GET["userid"]."'"),0) == 1) {
6.         mysql_query("update accesslevels set levels='".mysql_real_escape_string($levels)."' where uid='".$_GET["userid"]."'");
7.     }else{
8.         mysql_query("insert into accesslevels (uid, levels) Values('".$_GET["userid"]."', '".mysql_real_escape_string($levels)."')");
9.     }
10.     ?>
11.     <meta http-equiv="Refresh" content="0; URL=<?=url?>whereeveryouwanttobetransfered" />
12.     <?
13. }else{
14.     ?>
15.     <form method="post" action="<?=url?>?p=admin&s=users&userid=<?=$_GET["userid"]?>&update=levels">
16.     <input type="checkbox" name="levels" value="ADM_USERS" /><br />
17.     <input type="checkbox" name="levels[]" value="ADM_NEWS" /><br />
18.     <input type="checkbox" name="levels[]" value="ADM_COMMENTS" /><br />
19.     <input type="submit" value="Update" />
20.     </form>
21.     <?
22. }
23. ?>

___________________________________________________________________________________________________________________________________________________________________________________

That about sums it up, now our index.php looks something like this when we have implemented these functions:

Line number On/Off | Expand/Contract | Select all

1. include("config.php");
2. include(incurl."functions.php");
3. include("Mail.php");
4. if(!preg_match('/^[a-z0-9\+\/\=\#\%\_\^\@\.\?\&\-]+$/i', $_SERVER["QUERY_STRING"]) && strlen($_SERVER["QUERY_STRING"]) != 0) {
5.     echo "Invalid string"; exit;
6. }
7. $connect = @mysql_connect(myhost,myuser,mypwd);
8. mysql_select_db(mydb) or die(mysql_error());
9. session_start();
10. if($_GET["login"] == "logout") {
11.     logout();
12. }
13. if(isset($_POST["username"]) && isset($_POST["password"])) {
14.     login();
15. }
16. checklogin();
17. ?>
18. <? echo "<?xml version=\"1.0\" encoding=\"iso-8859-1\"?>\n"; ?>
19. <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
20. <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
21. <head>
22. <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
23. <title>Testsite</title>
24. <link rel="stylesheet" type="text/css" href="main.css" />
25. </head>
26.  
27. <body>
28. <?
29. if(isset($_SESSION["uid"])) {
30.     ?>
31.     Congrants your logged in.<br />
32.     <a href="<?=url?>?login=logout">Log out</a><br />
33.     <?
34.     if(checklevel("ADM_USERS")) {
35.         echo "<a href=\"".url."?p=admin&s=users\">User admin</a>";
36.     }
37. }else{
38.     ?>
39.     <form method="post" action="<?=url?>">
40.     <input type="text" name="username" value="Username" /><br />
41.     <input type="password" name="password" /><br />
42.     <input type="checkbox" name="saveme" value="1" /><br />
43.     <input type="submit" value="Login" /><br />
44.     </form>
45.     <?
46. }
47. ?>
48. </body>
49. </html>
50. <?
51. mysql_close($connect);
52. ?>

[vault]

Kind of like your style, clean and simple.

I would have hashed/salted the names of the remember me cookie though, so IF someone gets hold of them, they dont really know what the heck it is for.