[PHP] Prevent Multiple Logins

[Carter]

I have a login script so that registered users can login. I also have a logout script....but the problem is everytime I click on the login page and login and I can login everytime. I want to script it so that if I try to login two times or more, then it say something like "You are already logged in". I don't want the user to stay logged in forever or anything like that, so maybe have a session expiration time?

I'm new to PHP, but I can read it and understand it. I'm learning step by step and I'm fascinated by PHP coding.

login form

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Login Form</title>
<link href="loginmodule.css" rel="stylesheet" type="text/css" />
</head>
<body>
<p> </p>
<form id="loginForm" name="loginForm" method="post" action="./login/login-exec.php">
  <table width="300" border="0" align="center" cellpadding="2" cellspacing="0">
    <tr>
      <td width="112"><b>Login</b></td>
      <td width="188"><input name="login" type="text" class="textfield" id="login" /></td>
    </tr>
    <tr>
      <td><b>Password</b></td>
      <td><input name="password" type="password" class="textfield" id="password" /></td>
    </tr>
    <tr>
      <td> </td>
      <td><input type="submit" name="Submit" value="Login" /></td>
    </tr>
  </table>
</form>
</body>
</html>

form function

<?php
	//Start session
	session_start();
	
	//Include database connection details
	require_once('config.php');
	
	//Array to store validation errors
	$errmsg_arr = array();
	
	//Validation error flag
	$errflag = false;
	
	//Connect to mysql server
	$link = mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);
	if(!$link) {
		die('Failed to connect to server: ' . mysql_error());
	}
	
	//Select database
	$db = mysql_select_db(DB_DATABASE);
	if(!$db) {
		die("Unable to select database");
	}
	
	//Function to sanitize values received from the form. Prevents SQL injection
	function clean($str) {
		$str = @trim($str);
		if(get_magic_quotes_gpc()) {
			$str = stripslashes($str);
		}
		return mysql_real_escape_string($str);
	}
	
	//Sanitize the POST values
	$login = clean($_POST['login']);
	$password = clean($_POST['password']);
	
	//Input Validations
	if($login == '') {
		$errmsg_arr[] = 'Login ID missing';
		$errflag = true;
	}
	if($password == '') {
		$errmsg_arr[] = 'Password missing';
		$errflag = true;
	}
	
	//If there are input validations, redirect back to the login form
	if($errflag) {
		$_SESSION['ERRMSG_ARR'] = $errmsg_arr;
		session_write_close();
		header("location: login-form.php");
		exit();
	}
	
	//Create query
	$qry="SELECT * FROM members WHERE login='$login' AND passwd='".md5($_POST['password'])."'";
	$result=mysql_query($qry);
	
	//Check whether the query was successful or not
	if($result) {
		if(mysql_num_rows($result) == 1) {
			//Login Successful
			session_regenerate_id();
			$member = mysql_fetch_assoc($result);
			$_SESSION['SESS_MEMBER_ID'] = $member['member_id'];
			$_SESSION['SESS_FIRST_NAME'] = $member['firstname'];
			$_SESSION['SESS_LAST_NAME'] = $member['lastname'];
			session_write_close();
			header("location: member-index.php");
			exit();
		}else {
			//Login failed
			header("location: login-failed.php");
			exit();
		}
	}else {
		die("Query failed");
	}
?>

 

[Josh]

Use cookies?

 

[Carter]

How exactly would that be coded?

 

[xSilv3rbullet]

http://php.net/setcookie
http://www.php.net/manual/en/reserved.variables.cookies.php

 

[Superfun]

on login(succseeded) => online =1
making a heartbeat via ajax to check if the user is still on the webpage, offline=0

easy as can be

 

[IQstim]

register a session on "//Check whether the query was successful or not", p
by that i mean adding:

//to php function
//add this before those $SESSION['blah'] below.
session_register($member['member_id']); <-- to register a session, obviously. nothing complex.

$_SESSION['SESS_MEMBER_ID'] = $member['member_id'];
$_SESSION['SESS_FIRST_NAME'] = $member['firstname'];
$_SESSION['SESS_LAST_NAME'] = $member['lastname'];

integrate this on the login form:

<?php
//to form
session_start();

if(!session_is_registered($_SESSION['SESS_MEMBER_ID']) {
login form here.....
}
else
{
echo "You're  already logged in.";
}
<?

try it.
simplification of what is simply simplified already. nothing complex.

 

[jM2.me]

BTW do you have to do session_register to each session variable?
I didn't register my session variables on my page and it works fine.