Re: sessions/cookies

others have given good advice, but let's learn to walk before we run shall we. 1. session_start() should be called once per request. 2. checkValidUser() does a select on all the users in the database, this is *wrong* - do a select with a suitable WHERE clause the retrieves the one user that matches the given user name and password. 3. GetAccessLevel() uses an undefined property. 4. all the properties ($UserID, $AdminLevel, etc) are only set during the request where the user's login credentials are checked. subsequent requests will not have that info. 5. use php5? 6. go back and read the other replies regarding seperation of responsibilities and encapsulation. nihilism machine schreef:

I wrote an authentication class in php4. The sessions dont seem to be working with internet explorer, just with FF. here is the code below, a cookies notice pops up when you try and login: <?php class auth {

    var $UserID;
    var $AdminLevel;
    var $FirstName;
    var $LastName;
    var $DateAdded;
    var $MobileTelephone;
    var $LandLineTelephone;

    // Connect to the database
    function auth() {
        mysql_connect('','','') or die('ERROR: Could not connect to database');
        mysql_select_db('') or die('ERROR: Could not select database');
    }

    // Attempt to login a user
    function CheckValidUser($Email,$Password) {
        $result = mysql_query('SELECT * FROM Users');
        $Password = $this->encode($Password);

        if (mysql_num_rows($result) != 0) {
            while($row = mysql_fetch_assoc($result)) {
                if (!strcmp($row['Email'],$Email)) {
                    if (!strcmp($row['Password'],$Password)) {
                        // User info stored in Globals
                        $this->UserID = $row['ID'];
                        $this->AdminLevel = $row['Admin_Level'];
                        $this->FirstName = $row['First_Name'];
                        $this->LastName = $row['Last_Name'];
                        $this->DateAdded = $row['Date_Added'];
                        $this->MobileTelephone = $row['Telephone_Mobile'];
                        $this->LandLineTelephone = $row['Telephone_Land_Line'];
                        // User info stored in Sessions
                        session_start();
                        $_SESSION['Status'] = "loggedIn";
                        $_SESSION['Email'] = $row['Email'];
                        $_SESSION['AdminLevel'] = $row['Admin_Level'];
                        $_SESSION['LandLine'] = $row['Telephone_Land_Line'];
                        $_SESSION['MobileTelephone'] = $row['Telephone_Mobile'];
                        $_SESSION['FirstName'] = $row['First_Name'];
                        $_SESSION['LastName'] = $row['Last_Name'];
                        return true;
                    }
                }
            }
            header("Location: index.php?error=invalidLogin");
        } else {
            die('ERROR: No Users in the database!');
        }
    }
        // Create a new user account
    function CreateUser($Email, $Password, $AdminLevel, $LandLineTelephone, $MobileTelephone, $FirstName, $LastName) {
        $Password = $this->encode($Password);
        $this->AccessLevel = $AdminLevel;
        $DateAdded = date("Y-m-d H:i:s");
        mysql_query("INSERT INTO Users (Email, Password, Admin_Level, Date_Added, First_Name, Last_Name, Telephone_Land_Line, Telephone_Mobile) VALUES ('$Email','$Password','$AdminLevel', '$DateAdded', '$FirstName', '$LastName', '$LandLineTelephone', '$MobileTelephone')") or die(mysql_error());
        return $this->UserID = mysql_insert_id();
    }

    // Update a users access level
    function UpdateAccessLevel($ID,$AdminLevel) {
        mysql_query("UPDATE Users SET Admin_Level='$AdminLevel' WHERE ID=$ID") or die(mysql_error());
        return true;
    }

    // Delete a user
    function DeleteUser($ID) {
        mysql_query("DELETE FROM Users WHERE ID=$ID") or die(mysql_error());
        return true;
    }

    // Get a users access level
    function GetAccessLevel() {
        return $this->AccessLevel;
    }

    // Get a users ID
    function GetUserID() {
        return $this->UserID;
    }
        // Log user out
    function LogOut() {
        session_start();
        session_unset();
        session_destroy();
        header("Location: index.php");
    }
        // Check users access level to see if they have clearance for a certain page
    function CheckUserLevel($RequiredLevel) {
        if ($_SESSION['AdminLevel'] < $RequiredLevel) {
            if ($_SESSION['AdminLevel'] == 2) {
                header("Location: financial.php");
            } else if ($_SESSION['AdminLevel'] == 1) {
                header("Location: user.php");
            } else {
                header("Location: index.php");
            }
        }
    }
        // Check to see if a user is logged in
    function CheckLoggedIn() {
        session_start();
        if ($_SESSION['Status'] != "loggedIn") {
            header("Location: index.php");
        }
    }

    // Private Methods
        function encode($str) {
        return md5(base64_encode($str));
    }

} ?>