In this tutorial I finish the PHP Forum. If you missed the first part it is here PHP Forum Part 1.
This forum isn’t just built in PHP however. It also uses MySQL, JavaScript and JQuery. Watching this tutorial is a great way to see if you understand how to program more complicated sites.
In part 5 of my PHP Message Board Tutorial, I show you how to create a proper login system.
This isn’t a simple system though. It is multi-layered and very secure. I specifically cover how to:
And, a whole bunch more. All of the code follows the video like always.
This is a more advanced script and you may need help with the following topics:
Code From the Video
<?php
include(‘header.html’);
?>
<style>
#recaptcha_image img {
width: 185px;
height: 28.5px;
border: 1px solid gainsboro;
}
#recaptcha_widget {
height:400;
}
</style>
<script type=”text/javascript”>
// Changes the styling for the Captcha image
var RecaptchaOptions = {
theme : ‘custom’,
custom_theme_widget: ‘recaptcha_widget’
};
</script>
<?php
if (isset($_POST[‘submitted’])) { // Check if the form has been submitted.
// Security check for a valid username
if (preg_match (‘%^[A-Za-z0-9]\S{8,20}$%’, stripslashes(trim($_POST[‘userid’])))) {
// Scrub username with function in header.php
$u = escape_data($_POST[‘userid’]);
} else {
$u = FALSE;
echo ‘<p><font color=”red” size=”+1″>Please enter a valid User ID!</font></p>’;
}
// Security check for a valid password
if (preg_match (‘%^[A-Za-z0-9]\S{8,20}$%’, stripslashes(trim($_POST[‘pass’])))) {
// Scrub password with function in header.php
$p = escape_data($_POST[‘pass’]);
} else {
$p = FALSE;
echo ‘<p><font color=”red” size=”+1″>Please enter a valid Password!</font></p>’;
}
// PHP Code for the CAPTCHA System
$captchchk = 1;
$privatekey = “Public Key Here”;
$resp = recaptcha_check_answer ($privatekey,
$_SERVER[“REMOTE_ADDR”],
$_POST[“recaptcha_challenge_field”],
$_POST[“recaptcha_response_field”]);
if (!$resp->is_valid) {
// What happens when the CAPTCHA was entered incorrectly
echo ‘<p><font color=”red” size=”+1″>The CAPTCHA Code wasn\’t entered correctly!</font></p>’;
$captchchk = 0;
}
// Query the database. Verify the username, password and captcha
if ($u && $p && $captchchk) {
$query = “SELECT user_id, first_name, last_name, email, username, passwd, active FROM users WHERE username=’$u’ AND passwd=SHA(‘$p’)”;
$result = mysql_query ($query) or trigger_error(“Either the Userid or Password are incorrect 1”);
if (mysql_affected_rows() == 1) { // A match was made
$row = mysql_fetch_array ($result, MYSQL_NUM);
mysql_free_result($result);
// If they haven’t activated the account redirect
if ($row[6] != NULL)
{
header(“Location: http://localhost/msgbrd/mbforgotpass.php”);
mysql_close(); // Close the database connection.
exit();
}
$_SESSION[‘first_name’] = $row[1];
$_SESSION[‘userid’] = $row[4];
// Create Second Token for security
$tokenId = rand(10000, 9999999);
$query2 = “update users set tokenid = $tokenId where username = ‘$_SESSION[userid]'”;
$result2 = mysql_query ($query2);
$_SESSION[‘token_id’] = $tokenId;
// Reset session id for security
session_regenerate_id();
// Redirect the user
header(“Location: http://localhost/msgbrd/mblogin.php”);
mysql_close(); // Close the database connection.
exit();
}
} else { // No match was made.
echo ‘<br><br><p><font color=”red” size=”+1″>Either the Userid or Password are incorrect 2</font></p>’;
mysql_close(); // Close the database connection
exit();
}
} // End of SUBMIT
?>
<body>
<div id=”header”><h2>Message Board</h2></div>
<div id=”login”>
<?php
echo ‘<h1>Welcome’;
if (isset($_SESSION[‘first_name’])) {
echo “, {$_SESSION[‘first_name’]}!”;
}
echo ‘</h1>’;
// Display links based upon the login status
// If user is on the logout page disable the login
if (isset($_SESSION[‘userid’]) AND (substr($_SERVER[‘PHP_SELF’], -10) != ‘logout.php’)) {
echo ‘<a href=”logout.php”>Logout</a><br />
<a href=”change_password.php”>Change Password</a><br />’;
} else { // Not logged in.
echo ”
<form action=’mblogin.php’ method=’post’>
<p><b>Userid:</b> <input type=’text’ name=’userid’ size=’20’ maxlength=’20’ /></p>
<p><b>Password:</b> <input type=’password’ name=’pass’ size=’16’ maxlength=’30’ /></p>”;
// Captcha stuff from Google
echo ”
<div id=’recaptcha_widget’ style=’display:none’>
<div id=’recaptcha_image’></div>
<div class=’recaptcha_only_if_incorrect_sol’ style=’color:red’>Incorrect please try again</div>
<span class=’recaptcha_only_if_image’>Enter the words above:</span><br />
<span class=’recaptcha_only_if_audio’>Enter the numbers you hear:</span>
<input type=’text’ id=’recaptcha_response_field’ name=’recaptcha_response_field’ />
<div><a href=’javascript:Recaptcha.reload()’>Get another CAPTCHA</a></div>
<div class=’recaptcha_only_if_image’><a href=’javascript:Recaptcha.switch_type(\’audio\’)’>Get an audio CAPTCHA</a></div>
<div class=’recaptcha_only_if_audio’><a href=’javascript:Recaptcha.switch_type(\’image\’)’>Get an image CAPTCHA</a></div>
<div><a href=’javascript:Recaptcha.showhelp()’>Help</a></div>
</div>
<script type=’text/javascript’
src=’http://www.google.com/recaptcha/api/challenge?k=Public Key Here’>
</script>
<noscript>
<iframe src=’http://www.google.com/recaptcha/api/noscript?k=Public Key Here’
height=’300′ width=’500′ frameborder=’0′></iframe><br>
<textarea name=’recaptcha_challenge_field’ rows=’3′ cols=’40’>
</textarea>
<input type=’hidden’ name=’recaptcha_response_field’
value=’manual_challenge’>
</noscript>
“;
echo “<div align=’left’><input type=’submit’ name=’submit’ value=’Login’ /></div>
<input type=’hidden’ name=’submitted’ value=’TRUE’ />
</form>”;
echo ‘<a href=”register.php”>Register</a><br />
<a href=”forgot_password.php”>Forgot Password</a><br />’;
}
?>
</div>
</body>
</html>
In part 4 of my PHP Message Board tutorial I show you how to create an account activation script.
In the previous video PHP Message Board pt 3, I created a user registration script. As an added security measure it sent an email with a link to this activation script. The new user will only be able to login if they click on that link.
At that point we check that the userid and 32 character key are the same. If they are we activate the account.
A few articles ago I started creating a PHP Message Board, but then I got side tracked. Here is the original video PHP Message Board. You must watch it before you watch this one.
In this video tutorial I’ll start explaining how to create a new user registration system for the message board. You can also use this as a review of all I taught on PHP, MySQL, CSS, HTML, JavaScript and JQuery. If you click on those links you can see all of my tutorials on those subjects as well.