Firstly, this is an extremely weak logon script. I wouldn't use it as is. There's also no data validation, so you're completely open to sql injection if magic quotes is off on the server.
If the logon form is an on-page include (as you've indicated), the form should have 2 states, one as the form, the other as a welcome message. If the logon form is a separate webpage, then the site links to the logon page should have 2 states, one as 'Login' and the other as 'Logout'.
Here's your script tweaked to make it a little more robust. You just need to put all the files in root and include_once the form_logon.php file into your webpages.
config.php
PHP Code:
<?php
//connect to db
$host = "localhost"; //mysql host
$db_user = ""; //mysql username
$db_pass = ""; //mysql password
$db_name = ""; //mysql database name
$admin_mail = "malchikk@gmail.com"; //admin mail
$login_table = 'site_users';
$login_user_column = 'username';
$login_pass_column = 'password';
$login_last_logon_column = 'last_login';
//start session if required
if( !headers_sent() && !isset($_SESSION) ) session_start();
//validation functions
function is_basicchars ($text)
{
$text = str_replace(' ', '', $text);
$Bad1 = $this->strip_letters($text);
$Bad2 = $this->strip_numbers($Bad1);
$text = $Bad2;
if(empty($text))
{
return true;
}
return false;
}
function is_allnumbers ($text)
{
if( (gettype($text)) == "integer") { return true; }
$Bad = $this->strip_numbers($text);
if(empty($Bad))
{
return true;
}
return false;
}
function strip_numbers ($text)
{
$Stripped = eregi_replace("([0-9]+)","",$text);
return ($Stripped);
}
function is_allletters ($text)
{
$Bad = $this->strip_letters($text);
if(empty($Bad))
{
return true;
}
return false;
}
function strip_letters ($text)
{
$Stripped = eregi_replace("([a-zA-Z]+)","",$text);
return $Stripped;
}
?>
user_auth.php
PHP Code:
<?php
include_once('config.php');
//error messages
$errors = '';
$logged = (isset($_SESSION['logged'])) ? true : false;
//process logon request
if( !empty($_POST['logon']) && !$logged ) {
//long to short to null if required
$user_name = (!empty($_POST['username'])) ? $_POST['username'] : NULL;
$user_pass = (!empty($_POST['password'])) ? $_POST['password'] : NULL;
//check empoty fields
if ($user_name == NULL) $errors .= 'Username is required.<br />';
if ($user_pass == NULL) $errors .= 'Password is required.<br />';
//allowed chars a-z A-Z 0-9 and spaces
if (!is_basicchars($user_name)) $errors .= 'Username contains invalid characters.<br />';
if (!is_basicchars($user_pass)) $errors .= 'Password contains invalid characters.<br />';
//proceed to process logon if error free
if ( $errors == '' ) {
//check the login
mysql_connect($host, $db_user, $db_pass) or die('Could not connect: ' . mysql_error());
mysql_select_db($db_name) or die('Could not select database');
$db_username = mysql_real_escape_string($user_name);
$db_password = mysql_real_escape_string($user_pass);
$qry_user = mysql_query("SELECT $login_user_column FROM $login_table
WHERE $login_user_column = '$db_username'
AND $login_pass_column = '$db_password'") or die(mysql_error());
$row_user = mysql_fetch_assoc($qry_user);
if( $row_user ){
$_SESSION['logged'] = true;
$_SESSION['user'] = $user_name;
//update last_login
$h = "3";
$hm = $h * 60;
$ms = $hm * 60;
$date = gmdate("m/d/Y", time()-($ms));
$result = mysql_query("UPDATE $login_table SET $login_last_logon_column = '$date' WHERE $login_user_column = '$db_username'")
or die(mysql_error());
} else {
$errors .= 'Invalid Username/Password combination, try again.<br />';
}
}//end error free processing
} //end logon request
//logout
$logout = ( isset($_GET['logout']) ) ? true : false;
if ($logout){
$_SESSION['user'] = NULL;
$_SESSION['logged'] = NULL;
unset($_SESSION['user']);
unset($_SESSION['logged']);
session_destroy();
$logged = false;
}
?>
form_logon.php
PHP Code:
<?php
include_once('user_auth.php');
$url_frm_action = $_SERVER['PHP_SELF'];
$url_logout = $url_frm_action.'?logout=true';
if ( $logged ) {
$username = $_SESSION['user']; ?>
<br />
<table>
<tr>
<td>Welcome Back <?php echo $username; ?>!</td>
</tr>
<tr>
<td><a href="<?php echo $url_logout; ?>">Click Here to log out</a></td>
</tr>
</table>
<br />
<?php } else { ?>
<br />
<form method='post' action=''>
<table>
<tr>
<td>Username:</td>
<td><input type='text' class='input_login' name='username'></td>
</tr>
<tr>
<td>Password:</td>
<td><input type='password' class='input_login' name='password'> <a href='forgotpass.php'>Forgot Password?</a></td>
</tr>
<tr>
<td><a href='signup.php'>Register</a></td>
<td> <input name="logon" type='submit' class='input_login' id="logon" value='Login'></td>
</tr>
<?php if ($errors != '') { ?>
<tr>
<td>ERROR</td>
<td><?php echo $errors; ?></td>
</tr>
<?php } //end error display ?>
</table>
</form>
<br/>
<?php }//end $logged if else ?>
These scripts are untested but the logic, syntax and security are sound.
Before you post, read our: 
Integrating Login Script into Website.
