I posted a really simple authentication script with sessions and cookies on another forum a while ago. This doesn't use a database but its not the best way for login scripts, its hardcoded in so its best for one or two people.
login.php
<?php
if($action=="login") { // If the url is set to login.php?action=login
$user = $_POST['user']; // Get entered username
$pass = $_POST['pass']; // Get entered pass
if(($user == "user1" && $pass == "pass1") || ($user == "user2" && $pass == "pass2")) { // Checking to see if they match, || means or, && means and. You can have more usernames and passwords.
$pw = md5($pass); // Encrypt the password
setcookie ("auth",$user-$pw,time()+1957240,"/"); // Create the cookie, storing the username and encrypted pass.
session_register("auth"); // Set a session in case cookies are disabled
header(Location:frontpage.php); // Redirect to frontpage.php
}
else // If its anything else (Doesn't match)
{
header(Location:failed.php); // Redirect to failed.php
}
}
else {
// Show form
?>
<form action="<?php echo $_SERVER["PHP_SELF"]; ?>?action=login" method="post">
<p>Username:
<input type="text" name="user">
</p>
<p>Password:
<input type="password" name="pass">
<input type="submit" value="Login" name="Submit">
</p>
</form>
<?php
}
?>
Put this on the top of all the pages you want protected. Must be on the very top.
<?php
$cookie = $_COOKIE['auth'];
session_start(); // You need this to read session variables
if (empty($cookie) || !isset($cookie)) // if the cookie is empty or not set
{
// Read the session
if (empty($_SESSION['auth']) || !isset($_SESSION['auth'])) // the session is empty or not set
{
header("Location: login.php"); // Redirect to login.php
exit; // Stop any further coding
}
?>
Logout script
<?php
setcookie ("auth",$user-$pw,time()-1957240,"/"); // Setting a cookie with the same name but setting it so it expires 1957240 seconds before the current time which means its already destroyed
session_destroy(); // Destroy the session
echo "You are logged out"; // Print the message
?>
Its really messy i know, I didn't bother indenting it. Sorry ^^0
If you want to use a database, its just as easy. Just create a table with fields for the usernames and passwords and change login.php to
if($action=="login") { // If the url is set to ?action=login
$user = $_POST['user']; // Get entered username
$pass = $_POST['pass']; // Get entered pass
$q = "SELECT * from table WHERE username='$user' AND password='$pass' "; // Select rows in the table where the $user and $pass are in the username and password fields
$r = mysql_query($q) or die
("Could not execute query : $q." . mysql_error());
if(mysql_num_rows($r) = 1) { // If there's one and only one row which has that username and pass
$pw = md5($pass); // Encrypt the password
setcookie ("auth",$user-$pw,time()+1957240,"/"); // Create the cookie, storing the username and encrypted pass. Just in case you want to retrieve it later on.
session_register("auth"); // Set a session in case cookies are disabled
header(Location:frontpage.php); // Redirect to frontpage.php
}
Again, sorry for the messiness.