I need some advice on the best way of creating a login/account for my project.
here is what I am doing at the moment.
I register the users using a page called register.php. i get the users details and save them in mysql database. and I create a subdomain on my server for that user.
once the subdomain is created, I copy some files from one directory on my server into that subdomain. in those coppied files, I have login page which will ask the user to login so they can access their account( the account is that subdomain that was created for them when they registered).
so...
the user #1 created an account and given this URL: user1.mysite.com/login.php
and
the user #2 created an account and given this URL: user2.mysite.com/login.php
and once they logged in successfully, the will be directed to the index.php of their account which is user1.mysite.com/index.php or user2.mysite.com/index.php depending which user alogs in from which URL/account.
all of these work as they should.
Now, here is the issue that I am facing:
if the user #1 tries to login from the user #2 URL/account (user2.mysite.com/login.php), they will be pointed to their own URL/account which is (user1.mysite.com/login.php)...
HOWEVER,
if the same user (user #1) navigates back to the previous URL which was user2.mysite.com/login.php, they are automatically logged in to that account which doesn't belong to them and it belongs to user #2 even though they used their own login details!
so basically, anyone can login to someone else's account!
I am using SESSION in PHP for my login page. and I am using the following codes:
Login Page:
ob_start();
session_start();
if (isset($_SESSION["manager"])) {
header("location: index.php");
exit();
}
if (isset($_POST["email"]) && isset($_POST["password"])) {
$manager = $_POST["email"]; // filter everything but numbers and letters
$password = (!empty($_POST['password'])) ? sha1($_POST['password']) : ''; // filter everything but numbers and letters
$storenameTable = $_REQUEST['storeShop'];
// Connect to the MySQL database
include "config/connect.php";
$sql = "SELECT members.id, members.email, members.password, members.randKey, members.storeShop, storename.email, storename.password, storename.randKey, storename.storeShop
FROM members
INNER JOIN storename ON members.randKey = storename.randKey
WHERE members.email = '$manager'
AND members.password = '$password'
";
$result = mysqli_query($db_conx,"SELECT storeShop FROM members WHERE email='$manager' AND password='$password'");
while($row = mysqli_fetch_array($result))
{
$email = $row["email"];
$password = $row["password"];
$storeShop = $row["storeShop"];
$_SESSION['email'] = $email;
$_SESSION['password'] = $password;
$_SESSION['storeShop'] = $storeShop;
}
// query the person
// ------- MAKE SURE PERSON EXISTS IN DATABASE ---------
$query = mysqli_query($db_conx, $sql);
if (!$query) {
die(mysqli_error($db_conx));
}
$existCount = mysqli_num_rows($query); // count the row nums
if ($existCount == 1) { // evaluate the count
$row = mysqli_fetch_array($query, MYSQLI_ASSOC);
$_SESSION["id"] = $row["id"];
$_SESSION["manager"] = $manager;
$_SESSION["password"] = $password;
header("location: http://$storeShop.mysite.com/index.php");
exit();
} else {
echo 'That information is incorrect, try again <a href="login">Click Here</a>';
exit();
}
}
<form action="login.php" method="post" enctype="multipart/form-data" name="logform" id="logform" onsubmit="return validate_form ( );">
<div class="lock-holder">
<div class="form-group pull-left input-username">
<div class="input-group">
<input name="email" type="text" class="form-control " id="email" value="email">
<span class="input-group-addon"><i><img src="images/membericon.png" width="22" height="20"></i></span>
</div>
</div>
<div class="form-group pull-right input-password">
<div class="input-group">
<input name="password" type="password" class="form-control " id="password" placeholder="************" >
and my index.php
session_start();
if (!isset($_SESSION["manager"])) {
header("location: login.php");
exit();
}
// Be sure to check that this manager SESSION value is in fact in the database
$managerID = preg_replace('#[^0-9]#i', '', $_SESSION["id"]); // filter everything but numbers and letters
$manager = $_POST["email"]; // filter everything but numbers and letters
$password = (!empty($_POST['password'])) ? sha1($_POST['password']) : ''; // filter everything but numbers and letters
$storenameTable = $_REQUEST['storeShop'];
// Run mySQL query to be sure that this person is an admin and that their password session var equals the database information
// Connect to the MySQL database
include "config/connect.php";
$sql = "SELECT members.id, members.email, members.password, members.randKey, members.storeShop, storename.email, storename.password, storename.randKey, storename.storeShop
FROM members
INNER JOIN storename ON members.randKey = storename.randKey
WHERE members.email = '$manager'
AND members.password = '$password'
"; // query the person
// ------- MAKE SURE PERSON EXISTS IN DATABASE ---------
$query = mysqli_query($db_conx, $sql);
if (!$query) {
die(mysqli_error($db_conx));
}
$result = mysqli_query($db_conx,"SELECT storeShop FROM members WHERE email='$manager' AND password='$password'");
while($row = mysqli_fetch_array($result))
{
$email = $row["email"];
$password = $row["password"];
$storeShop = $row["storeShop"];
$_SESSION['email'] = $email;
$_SESSION['password'] = $password;
$_SESSION['storeShop'] = $storeShop;
}
$existCount = mysqli_num_rows($query); // count the row nums
if ($existCount == 0) { // evaluate the count
while($row = mysqli_fetch_array($query, MYSQLI_ASSOC)){
header("location: login.php");
exit();
}
}
could someone please advice on this issue?
Thank you in advance.
