PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

Implementing Authentication with Session Control
521
The first thing you do in the script is call session_start().This call loads in the
session variable valid_user if it has been created.
In the first pass through the script, none of the if conditions apply, so the user falls
through to the end of the script, where you tell her that she is not logged in and provide
her with a form to do so:
echo ‘’;
echo ‘’;
echo ‘Userid:’;
echo ‘’;
echo ‘Password:’;
echo ‘’;
echo ‘’;
echo ‘’;
echo ‘’;
When the user clicks the submit button on the form, this script is reinvoked, and you
start again from the top.This time, you will have a userid and password to authenticate,
stored as $_POST[‘userid’] and $_POST[‘password’]. If these variables are set, you go
into the authentication block:
if (isset($_POST[‘userid’]) && isset($_POST[‘password’]))
{
// if the user has just tried to log in
$userid = $_POST[‘userid’];
$password = $_POST[‘password’];
$db_conn = new mysqli(‘localhost’, ‘webauth’, ‘webauth’, ‘auth’);
if (mysqli_connect_errno()) {
echo ‘Connection to database failed:’.mysqli_connect_error();
exit();
}
$query = ‘select * from authorized_users ‘
.”where name=’$userid’ “
.” and password=sha1(‘$password’)”;
$result = $db_conn->query($query);
You connect to a MySQL database and check the userid and password. If they are a
matching pair in the database, you create the variable $_SESSION[‘valid_user’], which
contains the userid for this particular user, so you know who is logged in further down
the track:
if ($result->num_rows >0 )