I have a PHP page (area_utenti.php), which can be seen only if you are logged in: in that page there is a welcome message which is "Hello username, you are logged in!". When someone signs up to my website he is asked only for a username, an email and a password. Now I'm adding to the registration page the fields for name and surname, because I want the welcome message to say "Hello Name, etc..", but I want also to ask users that are already registered to insert their names and surnames, so I thought that I could check in the PHP page which logs users in (login2.php), if the name and surname fields in my database's users table are == to a string that I inserted to every user who registered before that change that I'm making in my website, and if that is the case, this PHP page redirects to another which has a form which inserts name and surname in the fields.
So, the problem is: the new part of login2.php seems correct to me so I don't understand why when in the login form I insert my credentials, it does not ask for my name and surname, and goes to area_utenti.php directly, like before, and now a new problem appeared: when I insert wrong credentials it goes to the login_success.php which simply has a string that says "Login successful", problem that wasn't present before.
login2.php
<?php
<... some other things...>
$sql="SELECT * FROM $tbl_name WHERE username='$username' and pwd='$password'";
$result=mysql_query($sql);
$count=mysql_num_rows($result);
if($count==1){
$name=mysql_query("SELECT name FROM users WHERE username = '$username'");
$surname=mysql_query("SELECT surname FROM users WHERE username = '$username'");
$_SESSION['username'] = $username;
$_SESSION['pwd'] = $encryptedpwd;
}
else {
echo "Wrong username and/or password";
}
if(($name == "frghfg") and ($surname == "frghfg")){ // frghfg is the string that I inserted to every user which registered before the change, I chose that string because nobody has this name or surname in the entire world
echo "<html>
<head>
<title>Insert your name and surname</title>
</head>
<body>
<form action=\"nomecognome.php\" method=\"post\"> // nomecognome.php is the page that inserts the fields in the users table and redirects to area_utenti.php when done
<label for=\"nome\">Name</label>
<input type=\"text\" name=\"nome\" size=\"32\" required/>
<label for=\"cognome\">Surname</label>
<input type=\"text\" name=\"cognome\" size=\"32\" required><br><br>
<button type=\"submit\" name=\"nomecognome\" class=\"submit_button\">Submit</button>
</form>
</body>
<html>";
}
else{
header("location:login_success.php");
}
?>
How do I fix this?
Aucun commentaire:
Enregistrer un commentaire