Show data to logeados users PHP

Question

Show data to logeados users PHP

Navigation

#1 by (1 votes)

0

I'm making a web page where I have a login and when you log in it takes you to a file called user.php What I want to achieve is that only logged-in users can see the contents of the user.php file I want to avoid that in the search engine of the browser putting route / user.php shows you the data without having logged in, to give more security.

Currently with what I have done, I get that nobody enters the user.php file but neither the users who log in, redirects them all to index.html

This is my login.php

//CAPTURO LOS INPUTS
$user=$_POST["email"];
$passw=$_POST["password"];

//CONECTAMOS CON LA BBDD
$conexion=mysqli_connect("localhost","root","x", "bbdd");    
if(mysqli_connect_errno($conexion)) {
    printf("Falló la conexión: ",mysqli_connect_errno());

}
//comprobamos que exista el usuario
$resultado=mysqli_query($conexion,
    "SELECT * FROM usuarios WHERE 
    correo='$user' and 
    contrasena='$passw'");
$usuExiste=mysqli_num_rows($resultado);

if($usuExiste >0){
    $_SESSION['loggedin'] = true;
    $_SESSION['username'] = $user;
    $_SESSION['start'] = time();
    $_SESSION['expire'] = $_SESSION['start'] + (5 * 60);
    header('location:usuario.php');
    echo "";

} else {
    echo "<script>alert('Usuario y/o Contraseña incorrectas.')
        window.location='index.html'</script>";
}
session_destroy();
?>

and this my user.php

<?php
session_start();


if (isset($_SESSION['loggedin'])) {

} else {
  echo "<script>alert('esta pagina es para administradores')
    window.location='index.html'</script>";

header("location:index.html");

exit;
}

$now = time();

if($now > $_SESSION['expire']) {
session_destroy();

echo "Su sesion a terminado,
<a href='login.html'>Necesita Hacer Login</a>";
exit;
}
?>

seguridad html php css

asked by francisco 10.02.2018 в 13:18

source

1 answer

extra large number rounds? Show data of a Jlist

score 1 · Accepted Answer

In the login.php you also have to put the

session_start();

The session_destroy (); put it inside the else part of the if (I'm paranoid) and close the semicolon of the echo:

} else {
    echo "<script>alert('Usuario y/o Contraseña incorrectas.');
    window.location='index.html'</script>";
    session_destroy();
}

In the same way that you put exit in the user.php, do it in the login.php:

$_SESSION['expire'] = $_SESSION['start'] + (5 * 60);
header('location:usuario.php');
//echo ""; // No vale para nada
exit;

Find and read information about SQL Injection, your code is vulnerable to a well-known attack that everyone can exploit without much knowledge.

With these changes you should work.