Remove module and connect a new one

Question

I have a file sidebar.php. A module "login.php" is connected to this file.

<!-- Sidebar -->
<aside class="slide">
<?php 
if(!isset($_POST['user'])) {
    require 'login.php'; 
} else {
    require 'authorized.php'; 
}
?>
</aside>

login.php

<div class="login">
  <form method="post" action="../profile.php">
      <p><input type="text" name="log" value="" placeholder="Login or Email"></p>
      <p><input type="password" name="pass" value="" placeholder="Password"></p>
      <p class="remember_me">
        <label>
          <input type="checkbox" name="remember_me" id="remember_me">
          Remember me
        </label>
      </p>
      <p class="submit"><input type="submit" name="sub" value="Login"></p>
  </form>
</div>

When i send a form, i want delete login.php and instead of this add authorized.php.

profile.php

<?php
include("db.php");

$log = $_POST['log'];
$pass = $_POST['pass'];

if(isset($_POST['sub'])) {
  $q = mysql_query("SELECT * FROM user WHERE log='$log'");
  $r = mysql_fetch_array($q);

  if($pass == $r['pass']) {
    header('location: /');
  } else {
    header('location: /');
  }
}
?>

How i can do it?

Put a conditional around the `require` and require the pages as needed. — chris85, Oct 30 '17 at 17:41
Your code is vulnerable to [**SQL injection**](https://en.wikipedia.org/wiki/SQL_injection) attacks. You should use prepared statements with bound parameters, via either the [**mysqli**](https://secure.php.net/manual/en/mysqli.prepare.php) or [**PDO**](https://secure.php.net/manual/en/pdo.prepared-statements.php) drivers. [**This post**](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) has some good examples. — Alex Howansky, Oct 30 '17 at 17:43
Don't use the `mysql_*` functions. They have been deprecated since v5.5 (Jun 2013) and removed since v7.0 (Dec 2015). Instead use the [**mysqli_***](https://secure.php.net/manual/en/book.mysqli.php) or [**PDO**](https://secure.php.net/manual/en/book.pdo.php) functions with [**prepared statements**](https://secure.php.net/manual/en/pdo.prepare.php) and [**bound parameters**](https://secure.php.net/manual/en/pdostatement.bindparam.php). — Alex Howansky, Oct 30 '17 at 17:43

shemaya · Answer 1 · 2017-10-30T18:03:59.727

0

You need to set a condition in the sidebar file, if in the login you have an input named user:

<!-- Sidebar -->
<aside class="slide">
    <?php 
    if(!isset($_POST['user'])) {
        require 'login.php'; 
    } else {
        require 'authorized.php'; 
    }
    ?>
</aside>

Of course, you need also to check if there is a valid value for the user and more validity checks to validate that all your required fields exist and are valid.

edited Oct 30 '17 at 18:03

answered Oct 30 '17 at 17:50

shemaya

156
2
13

mistake: Can't use function return value in write context – Qwerty Oct 30 '17 at 17:58
@Qwerty mistakenly I've used the wrong type of brackets with the POST, I've edited it to use `$_POST['user']` – shemaya Oct 30 '17 at 18:05
As I wrote in my answer you need to have an input field with name 'user' for my example to work, so or change the `name="log"` to `name="user"` or change the condition to `if(!isset($_POST['log']))` – shemaya Oct 30 '17 at 18:34
yes, i changed it, but the page still loads login.php. Maybe can be a problem in my profile.php? – Qwerty Oct 30 '17 at 19:04
Try to debug. add a `var_dump` before the user post check and look out to see what maybe didn't go well there, additionally add a `die(__FILE__)` statement to the beginning of the profile file to see if you get there – shemaya Oct 30 '17 at 19:11
when I submit the form it comes to checking if($pass == $r['pass']), return true, and then go to header('location: /'), where my sidebar.php and if(!isset($_POST['log'])) in any case, returns login.php. Although I entered the correct login and password – Qwerty Oct 30 '17 at 19:24

Remove module and connect a new one

1 Answers1