Ok we are just going to dive right in with the login/index page. The login page is a way for users that have signed up to login in to their account and play the game. We are going to use sessions to save the user's id in the browser and while the are in the game it will bring up information based upon their id which is saved in the session. We will be preserving their information using sessions while they are login.
Index.php
The code that we are going to use for this login isn't very secure for now. In later parts we will talk about security issues such as sql injection.
Step One - Creating the forms for index page.
Like i mentioned before we are not going to concentrate on the design of the pages and this is one of the pages that needs a very good design, You can do that after all everything else is done.
Create a page called Index.php, this is going to contain our login form that we will be using to login users.
add this code to connect to the database like we did in part 2. Make sure it is added before any html on the page.
<? include_once("connect.php"); ?>
We now need some html designs. The standard login have 2 fields (Username and password) with a submit button.
Add this html code in the body part of the page. Feel free to edit it as you see fit.
<form id="form1" name="form1" method="post" action=""><center> GAME LOGIN <br /> <br /> Username: <input type="text" name="Username" id="Username" /> <br /> <br /> Password: <input type="password" name="password" id="password" /> <br /> <br /> <input type="submit" name="Login" id="Login" value="Login" /> </center> </form>
that's just the html design codes.
Step Two - Checking database for the right account
Add this code on top of the html you have just added in the body section of the html.
<?
if(isset($_POST['Login'])) {
$query = "SELECT password,id,login_ip FROM users WHERE name='".mysql_real_escape_string($_POST['Username'])."'";
$result = mysql_query($query) or die(mysql_error());
$row = mysql_fetch_array($result); // Search the database and get the password, id, and login ip that belongs to the name in the username field.
if(empty($row['id'])){
// check if the id exist and it isn't blank.
echo "Account doesn't exist.";
}else{
if(md5($_POST['password']) != $row['password']){
// if the account does exist this is matching the password with the password typed in the password field. notice to read the md5 hash we need to use the md5 function.
echo "Your password is incorrect.";
}else{
echo "Account available";
}
}
}
?>
The php above has comment to explain what is going on at each stage. You can notice that when you get the login details right it will just echo "Account available". this is so for now because we are doing it in bits. So you can understand what is going on at each stage.
Step Three - Validations
In this step we are going to focus on the validations and the errors. such as if the type in nothing in the name field or the password field.
Replace the php you have already added with this.
<?
if(isset($_POST['Login'])) {
if (ereg('[^A-Za-z0-9]', $_POST['name'])) {// before we fetch anything from the database we want to see if the user name is in the correct format.
echo "Invalid Username.";
}else{
$query = "SELECT password,id,login_ip FROM users WHERE name='".mysql_real_escape_string($_POST['Username'])."'";
$result = mysql_query($query) or die(mysql_error());
$row = mysql_fetch_array($result); // Search the database and get the password, id, and login ip that belongs to the name in the username field.
if(empty($row['id'])){
// check if the id exist and it isn't blank.
echo "Account doesn't exist.";
}else{
if(md5($_POST['password']) != $row['password']){
// if the account does exist this is matching the password with the password typed in the password field. notice to read the md5 hash we need to use the md5 function.
echo "Your password is incorrect.";
}else{
echo "Account available";
}
}
}
}
?>
we added simple validation to check if the username is in the right format before any information is fetched from the database.
Step Four - Inside Game.
We are going to try use the information and set a session and redirect the user to another page (Inside the game) using the php header.
Let me break down this step -
- We are going to Create a sample page to redirect to.
- Save the users id in a session
- Log the users ip and if information is typed in correctly redirect to sample page.
First create a sample page. i am going to called mine Sample.php, all i am going to add on sample.php is WELCOME.
Back to index.php. now we want to log their ip (There are many reasons we need to log users ip we will talk about it more on the security section.) and save their user id in session.
Update the php code on the index.php with the one below
<?
if(isset($_POST['Login'])) {
if (ereg('[^A-Za-z0-9]', $_POST['name'])) {// before we fetch anything from the database we want to see if the user name is in the correct format.
echo "Invalid Username.";
}else{
$query = "SELECT password,id,login_ip FROM users WHERE name='".mysql_real_escape_string($_POST['Username'])."'";
$result = mysql_query($query) or die(mysql_error());
$row = mysql_fetch_array($result); // Search the database and get the password, id, and login ip that belongs to the name in the username field.
if(empty($row['id'])){
// check if the id exist and it isn't blank.
echo "Account doesn't exist.";
}else{
if(md5($_POST['password']) != $row['password']){
// if the account does exist this is matching the password with the password typed in the password field. notice to read the md5 hash we need to use the md5 function.
echo "Your password is incorrect.";
}else{
if(empty($row['login_ip'])){ // checks to see if the login ip has an ip already
$row['login_ip'] = $_SERVER['REMOTE_ADDR'];
}else{
$ip_information = explode("-", $row['login_ip']); // if the ip is different from the ip that is on the database it will store it
if (in_array($_SERVER['REMOTE_ADDR'], $ip_information)) {
$row['login_ip'] = $row['login_ip'];
}else{
$row['login_ip'] = $row['login_ip']."-".$_SERVER['REMOTE_ADDR'];
}
}
}
}
}
}
?>
We have added a simple code to store the users ip using the "$_SERVER['REMOTE_ADDR']" Which gets the ip address from the user. If the sure login from another ip address the code will add it to an array with the other ip address (This is useful because we can see all the ip addresses that have gain access to the account in case it gets hacks etc)
For the header to redirect us to Sample you need to start a session on the connect.php
on connect.php add following code on LINE 1 (Make sure nothing is above it.
<? session_start(); ob_start(); ?>
Back on index.php so far the code we have doesn't update the mysql with the information we are going to be using.
Replace the index.php php code with the one below.
<?
if(isset($_POST['Login'])) {
if (ereg('[^A-Za-z0-9]', $_POST['name'])) {// before we fetch anything from the database we want to see if the user name is in the correct format.
echo "Invalid Username.";
}else{
$query = "SELECT password,id,login_ip FROM users WHERE name='".mysql_real_escape_string($_POST['Username'])."'";
$result = mysql_query($query) or die(mysql_error());
$row = mysql_fetch_array($result); // Search the database and get the password, id, and login ip that belongs to the name in the username field.
if(empty($row['id'])){
// check if the id exist and it isn't blank.
echo "Account doesn't exist.";
}else{
if(md5($_POST['password']) != $row['password']){
// if the account does exist this is matching the password with the password typed in the password field. notice to read the md5 hash we need to use the md5 function.
echo "Your password is incorrect.";
}else{
if(empty($row['login_ip'])){ // checks to see if the login ip has an ip already
$row['login_ip'] = $_SERVER['REMOTE_ADDR'];
}else{
$ip_information = explode("-", $row['login_ip']); // if the ip is different from the ip that is on the database it will store it
if (in_array($_SERVER['REMOTE_ADDR'], $ip_information)) {
$row['login_ip'] = $row['login_ip'];
}else{
$row['login_ip'] = $row['login_ip']."-".$_SERVER['REMOTE_ADDR'];
}
}
$_SESSION['user_id'] = $row['id'];// this line of code is very important. This saves the user id in the php session so we can use it in the game to display information to the user.
$result = mysql_query("UPDATE users SET userip='".mysql_real_escape_string($_SERVER['REMOTE_ADDR'])."',login_ip='".mysql_real_escape_string($row['login_ip'])."' WHERE id='".mysql_real_escape_string($_SESSION['user_id'])."'")
or die(mysql_error());
// to test that the session saves well we are using the sessions id update the database with the ip information we have received.
header("Location: Sample.php"); // this header redirects me to the Sample.php i made earlier
}
}
}
}
?>
the code above saves our user id in a session and then if all the information is correct it will redirect us to Sample.php. If you check your browser cookies you can see the PHPSESSID saved and it content is your user id. if you check your database you can see your ip in the users ip and if you login from another ip you can see the ip added to the one on there already.
to recap in this step we saved the ip from the remote ADDR and also we saved their session in the browser.
Step Five - Destroying sessions.
We are going to learn to destroy sessions in case the want to log-out. this may not be the safest/ best way of doing things but it is simple enough to follow and understand.
add this php code on index.php.
<?
if(isset($_SESSION['user_id'])) {
// if already logged in.
session_unset();
session_destroy();
echo "You have been logged out.";
}
?>
The code destroy the session that we have set when we login.
On Sample page add A text like Click here to log out and link it to the index.php like this.
<a href="index.php">LogOut</a>
this is co it will take them to index and destroy their session.
Thats about it for this part. We have created a login page and used session to save the users id in the browser and then we user header to redirect the user to a sample page ( will be the inside game).
In the next tutorial we are going to focus more on the layout of the game and the structure of the game. also in the next step we are going to create a small forum for users to post on it. Things are going to start getting confusing but i will do my best to explain bit by bit.
If you have any questions/ suggestions or you see any grammatical error or any way of improving my code please post below and i will update it.
Thanks.
This post has been edited by Denis1: 15 August 2010 - 02:42 PM
MultiQuote
, changes have been made
| 