I am using PHP to process a form and generate report for mysql database. I have three forms (pages) where users create account (register.php), login page (index.php), home page opens when login successful (home.php) and logout page (logout.php) when users are done with activities.
The table for login is USERS-TABLE which is the primary table for the entire systems. Other tables are linked to USERS-TABLE using accountnumber and phone number.
Actually I did not write the scripts myself because I am entirely new to php so I copied it from online.
The index.php (login page) has a session for userid that is used to identify users and display their names on the homepage and all other pages I have. The USERS-TABLE only have 4 fields and its main purpose is for registration and login purposes.
THE PROBLEM: How do I create session from other tables in addition to the session based on the USERS-TABLE that runs through every-page?
THE CODE BELOW IS THE CODE FOR INDEX PAGE (LOGIN PAGE)
<?php
ob_start();
session_start();
require_once 'dbconnect.php';
// it will never let you open index(login) page if session is set
if ( isset($_SESSION['user'])!="" ) {
header("Location: home.php");
exit;
}
$error = false;
if( isset($_POST['btn-login']) ) {
// prevent sql injections/ clear user invalid inputs
$acctnumber = trim($_POST['acctnumber']);
$acctnumber = strip_tags($acctnumber);
$acctnumber = htmlspecialchars($acctnumber);
$phone = trim($_POST['phone']);
$phone = strip_tags($phone);
$phone = htmlspecialchars($phone);
$acctname = trim($_POST['name']);
$acctname = strip_tags($namer);
$acctname = htmlspecialchars($name);
// prevent sql injections / clear user invalid inputs
if(empty($phone)){
$error = true;
$emailError = "Please Enter Your Phone Number.";
} else if ( !filter_var($email,FILTER_VALIDATE_EMAIL) ) {
$error = false;
$emailError = "<br>Please enter valid account credentials";
}
if(empty($acctnumber)){
$error = true;
$passError = "Please enter your account number.";
}
// if there's no error, continue to login
if (!$error) {
$password = hash('sha256', $pass); // password hashing using SHA256
$res=mysql_query("SELECT userId, acctname, acctnumber, phone FROM userss WHERE acctnumber='$acctnumber' AND phone='$phone'");
$row=mysql_fetch_array($res);
$count = mysql_num_rows($res); // if uname/pass correct it returns must be 1 row
if( $count == 1 && $row['phone']==$phone ) {
$_SESSION['user'] = $row['userId'];
$_SESSION['acctnumber'] = $row['acctnumber'];
header("Location: home.php");
} else {
$errMSG = "Incorrect Credentials, Try again...";
}
}
}
?>
HERE IS THE CODE FOR HOME PAGE AFTER USERS SUCCESSFULLY LOGGED IN.
<?php
ob_start();
session_start();
require_once 'dbconnect.php';
// if session is not set this will redirect to login page
if( !isset($_SESSION['user']) ) {
header("Location: index.php");
exit;
}
// select loggedin users detail
$res=mysql_query("SELECT * FROM userss WHERE
userId=".$_SESSION['user']);
$_SESSION['acctnumber'] = $row['acctnumber'];
$userRow=mysql_fetch_array($res);
?>
HERE IS THE QUERY THAT NEED I TO MAKE REFERENCE TOO A SESSION IN ORDER TO AUTOMATICALLY IDENTIFY THE LOGGED IN USER.
$result = mysql_query("select mydate, preamount, currentdeposit, debit,
currentinterest, totalamount, status from NormalAccount where
acctnumber = '$actno' AND phone = '$pin' ORDER BY mydate DESC LIMIT
5");
Sorry to bother you guys with lots of text but I am total novice to PHP world.
Thanks guys.