Login Script
This PHP code gets the login user name and password from a user, checks it with the data in the "members" table, and admits users with valid data into the PSB™ page. Note that everyone in a group uses the administrator's user name (which can be thought of as their group's name) and the users password to login. No one but the administrator has to sign up for a PSB™ on the host's Registration page, so there are no other user names in any one group, even though their group's MySQL PSB™ table includes all members' first names, their statuses, and their comments.
Users and administrators never see the file below—only the PSB™ host sees it, so he will have to replace the "$psbhostusername", "$psbhostpassword", and "$psbhostdatabasename" in the "configure.php" file referenced below with legitimate names that will enable the MySQL connection to be made and the database to be chosen. Only one database will be used to host all PSB™s, and each administrator's data will be entered into the host's "members" table (that contains users password, administrator password, administrator user name, email address, date of joining, and IP of administrator).
<html><head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=windows-1252">
<TITLE>Login Script</TITLE>
<meta name="description" content="Login Script">
<meta name="keywords" content="Login Script,login,Personal Status Board,PSB,PHP empowered communication,PHP and Javascript based web pages,parenting,social evolution,social connectedness,php,javascript, dhtml, DHTML">
The function validatepassword() is a standard form validation script for passwords and user names. If unacceptable characters are entered, the regular expressions detect it, the function returns false, and the user gets a do-over.
function validatepassword(){
var ck_password = /^[A-Za-z0-9!@#$%^&*()_]{4,20}$/;
if (document.formpw.txtPassword.value.search(ck_password)==-1)
{alert("Please only enter letters, numbers and these for password: !@#$%^&*()_");return false}
var ck_username = /^[A-Za-z0-9_]{1,20}$/;
if (document.formpw.txtUsername.value.search(ck_username)==-1)
{alert("Please only enter letters, numbers and underline for user name.");return false}
return true;}
</script>
</head>
<body>
Below, we grab the POSTed value entry, flag, username, password, and table. In truth, once the password and username have been entered, the form that solicits these values POSTs the page right back to itself. The script then looks at whether this is the correct password (the "users password") and user name (the administrator's user name which is also this GROUP's user name), and even whether or not such a user name exists. If the user has submitted the form, the $Entry flag will be set and his group's administrator-entered data will be located in the "members" table as long as this administrator user name exists—a warning will pop up if it is not found, or if the username/password pair is invalid. Note that in checking through the "members" table for the record in which the user's group user name matches the one entered into the form, we use MySQL's SELECT statement in PHP. The $N flag is set if their entry attempt is NO GOOD—which returns them to try again. $Z temporarily gets the table's users password to compare with their input.
<?php
include_once"configure.php";
$Entry=$_POST['entry'];
$FLAG=$_POST['flag'];
$U=$_POST['username'];
$P=$_POST['password'];
$N=0;
$Z='';
if($Entry==1){
$check_user_data = mysql_query("SELECT * FROM members WHERE username = '$U'") or die(mysql_error());
if(mysql_num_rows($check_user_data) == 0)
{echo '<script language="javascript">alert("This user name does not exist. Please try again.")</script>;';$N=1;unset($U);}
else {$get_user_data = mysql_fetch_array($check_user_data);}
}
if($N==0 && $Entry==1){$Z=$get_user_data['admin_password'];}
if($Z != $P && $Entry==1)
{echo '<script language="javascript">alert("Username/password pair is invalid. Please try again.")</script>;';$N=1;unset($U);}
if(($N==1||$Entry==0) && empty($FLAG)){ ?>
<h1>Login</h1>
<div id='pw' style='position:absolute;top:410px;left:200px;width:300px'><table style="background-color:#8aa;border-color:#00f" border='6' cellspacing=0 cellpadding=6><tr><td>
<form id='formpw' name="formpw" method="post" action="psb.php" onsubmit="return validatepassword()">
<label for="User Name"><b>User Name: </b><input type="text" name="username" size="20" maxlength="30" value=""></label>
<label for="Password"><b>Password: </b><input type="password" name="password" size="20" maxlength="20" value=""></label><br><br>
<input type="hidden" name="flag" value="0">
<input type="hidden" name="entry" value="1">
<input type="submit" value="Submit">
<input type="reset" value="Reset"></form></td></tr></table>
</div>
<div id='pw' style='position:absolute;top:410px;left:570px;width:300px'><BR>
<a href="http://www.css-resources.com/">Home</a><BR>
<a href="http://www.css-resources.com/contact.html">Contact us</a><BR>
<a href='forgot-password.php'>I forgot my password</a><BR>
<a HREF='forgot-user-name.php'>I forgot my user name</a><BR>
<a HREF="http://www.css-resources.com/Administrator-PHP-Code-for-Multiple-PSB-Hosts.html">Administrator PHP Code for Multiple PSB™ Hosts</a>
</div>
<?php
} else { ?>
<?php
form name="MyForm" method="POST" action="administrator-page.php">
<input type="hidden" name="username" value=" ">
</form>
<script language="javascript">
var u = <?php echo json_encode($U); ?>;
document.MyForm.username.value=u;
document.MyForm.submit();
</script>
<?php
}
?>
</body></html>
Above is the form that receives the user input for logging in. Note the hidden fields that are used to POST flags to the PHP POST function, requiring a page reload. It's very convenient that forms can send data to their own pages like this, since JavaScript cannot send data to PHP without POST, GET, or cookies. PHP, on the other hand, can send anything to JavaScript on the same page with JSON, or if it's simple numbers, without need of JSON. Note that JSON was used to get the POSTed username converted from its PHP variable $U. This value was stuck in the hidden field named username in the form named "MyForm" before submission.
Note the links to pages to help you recover lost user names or passwords. It's important to give users options if they forget something, and this automatic way requires no administrative work at your end, answering emails with "forgot password" stories of woe.