Inlogsysteem - Eerste OOP script
index.php
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
<?php
include('includes/config.php');
include('includes/user.class.php');
$user = new User();
$user->isLoggedIn();
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>
<body>
Hier content
</body>
</html>
include('includes/config.php');
include('includes/user.class.php');
$user = new User();
$user->isLoggedIn();
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>
<body>
Hier content
</body>
</html>
login.php
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
<?php
include('includes/config.php');
include('includes/user.class.php');
$user = new User();
$user->isLoggedIn('login');
if(!empty($_POST))
$user->logIn($_POST['email'], $_POST['password']);
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>
<body>
<?php
$user->showError();
$user->showForm();
?>
</body>
</html>
include('includes/config.php');
include('includes/user.class.php');
$user = new User();
$user->isLoggedIn('login');
if(!empty($_POST))
$user->logIn($_POST['email'], $_POST['password']);
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>
<body>
<?php
$user->showError();
$user->showForm();
?>
</body>
</html>
logout.php
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
2
3
4
5
6
7
8
9
10
11
12
13
14
15
<?php
include('includes/config.php');
include('includes/user.class.php');
$user = new User();
$user->logout();
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>
<body>
</body>
</html>
include('includes/config.php');
include('includes/user.class.php');
$user = new User();
$user->logout();
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>
<body>
</body>
</html>
register.php
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
<?php
include('includes/config.php');
include('includes/user.class.php');
$user = new User();
if(!empty($_POST))
$user->register($_POST['email'], $_POST['password'], $_POST['password_c']);
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>
<body>
<?php
$user->showError('register');
$user->showForm('register');
?>
</body>
</html>
include('includes/config.php');
include('includes/user.class.php');
$user = new User();
if(!empty($_POST))
$user->register($_POST['email'], $_POST['password'], $_POST['password_c']);
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>
<body>
<?php
$user->showError('register');
$user->showForm('register');
?>
</body>
</html>
user.class.php
Code (php)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
<?php
class User {
private $password;
private $password_c;
private $email;
private $salt = 'yoursalt';
private $ip;
private function getFormData($email, $password, $password_c = null) {
$this->ip = $_SERVER['REMOTE_ADDR'];
if(isset($email)) $this->email = mysql_real_escape_string($email);
if(isset($password)) $this->password = mysql_real_escape_string(hash('sha512', $password . $this->salt));
if($password_c != null) $this->password_c = mysql_real_escape_string(hash('sha512', $password . $this->salt));
}
public function logIn($email, $password) {
$this->getFormData($email, $password);
$this->query = mysql_query("SELECT * FROM users WHERE email = '$this->email' AND password = '$this->password'");
$this->row = mysql_fetch_assoc($this->query);
$this->id = $this->row['id'];
$this->count = mysql_num_rows($this->query);
if($this->count == 1) {
setcookie('id', $this->id, time()+3600);
mysql_query("INSERT sessions SET id = '".$this->row['id']."', ip = '$this->ip'");
header('location: index.php');
} else
header('location: login.php?error=1');
}
public function register($email, $password, $password_c) {
$this->getFormData($email, $password, $password_c);
$this->query = mysql_query("SELECT * FROM users WHERE email = '$this->email'");
$this->result = mysql_fetch_assoc($this->query);
$this->count = mysql_num_rows($this->query);
if($this->count == 0) {
mysql_query("INSERT users (email, password) VALUES ('$this->email', '$this->password')");
} else {
header('location: register.php?error=1');
}
}
public function showForm($type = 'login') {
echo "<form method='post' action=''>
<input type='text' name='email' />
<input type='password' name='password' />";
if($type == 'register') echo "<input type='password' name='password_c' />";
echo "
<input type='submit' value='Log in' />
</form>
";
}
public function showError($type = 'login') {
if($type == 'register') {
if(!empty($_GET)) {
if($_GET['error'] == 1)
echo "This email address is already used.";
}
}
elseif($type == 'login') {
if(!empty($_GET)) {
if($_GET['error'] == 1)
echo "Wrong email or password";
}
}
}
public function isLoggedIn($page = null) {
$this->ip = $_SERVER['REMOTE_ADDR'];
$this->cookie = mysql_real_escape_string($_COOKIE['id']);
$this->query = mysql_query("SELECT * FROM sessions WHERE id = '$this->cookie' AND ip = '$this->ip'");
$this->count = mysql_num_rows($this->query);
if($this->count != 1)
header('location: login.php');
elseif($this->count == 1 && $page == 'login')
header('location: index.php');
}
public function logout() {
$this->ip = $_SERVER['REMOTE_ADDR'];
if(!empty($_COOKIE['id'])) {
$this->cookie = mysql_real_escape_string($_COOKIE['id']);
$this->query = mysql_query("DELETE FROM sessions WHERE id = '$this->cookie' AND ip = '$this->ip'");
setcookie('id', '', time()-3600);
}
}
}
?>
class User {
private $password;
private $password_c;
private $email;
private $salt = 'yoursalt';
private $ip;
private function getFormData($email, $password, $password_c = null) {
$this->ip = $_SERVER['REMOTE_ADDR'];
if(isset($email)) $this->email = mysql_real_escape_string($email);
if(isset($password)) $this->password = mysql_real_escape_string(hash('sha512', $password . $this->salt));
if($password_c != null) $this->password_c = mysql_real_escape_string(hash('sha512', $password . $this->salt));
}
public function logIn($email, $password) {
$this->getFormData($email, $password);
$this->query = mysql_query("SELECT * FROM users WHERE email = '$this->email' AND password = '$this->password'");
$this->row = mysql_fetch_assoc($this->query);
$this->id = $this->row['id'];
$this->count = mysql_num_rows($this->query);
if($this->count == 1) {
setcookie('id', $this->id, time()+3600);
mysql_query("INSERT sessions SET id = '".$this->row['id']."', ip = '$this->ip'");
header('location: index.php');
} else
header('location: login.php?error=1');
}
public function register($email, $password, $password_c) {
$this->getFormData($email, $password, $password_c);
$this->query = mysql_query("SELECT * FROM users WHERE email = '$this->email'");
$this->result = mysql_fetch_assoc($this->query);
$this->count = mysql_num_rows($this->query);
if($this->count == 0) {
mysql_query("INSERT users (email, password) VALUES ('$this->email', '$this->password')");
} else {
header('location: register.php?error=1');
}
}
public function showForm($type = 'login') {
echo "<form method='post' action=''>
<input type='text' name='email' />
<input type='password' name='password' />";
if($type == 'register') echo "<input type='password' name='password_c' />";
echo "
<input type='submit' value='Log in' />
</form>
";
}
public function showError($type = 'login') {
if($type == 'register') {
if(!empty($_GET)) {
if($_GET['error'] == 1)
echo "This email address is already used.";
}
}
elseif($type == 'login') {
if(!empty($_GET)) {
if($_GET['error'] == 1)
echo "Wrong email or password";
}
}
}
public function isLoggedIn($page = null) {
$this->ip = $_SERVER['REMOTE_ADDR'];
$this->cookie = mysql_real_escape_string($_COOKIE['id']);
$this->query = mysql_query("SELECT * FROM sessions WHERE id = '$this->cookie' AND ip = '$this->ip'");
$this->count = mysql_num_rows($this->query);
if($this->count != 1)
header('location: login.php');
elseif($this->count == 1 && $page == 'login')
header('location: index.php');
}
public function logout() {
$this->ip = $_SERVER['REMOTE_ADDR'];
if(!empty($_COOKIE['id'])) {
$this->cookie = mysql_real_escape_string($_COOKIE['id']);
$this->query = mysql_query("DELETE FROM sessions WHERE id = '$this->cookie' AND ip = '$this->ip'");
setcookie('id', '', time()-3600);
}
}
}
?>
Gewijzigd op 21/01/2013 23:00:07 door Max Hendriks
- data beveiligen
- database calls maken
- form echo'en
- errors echo'en
- log in check uitvoeren
- parameters uitlezen uit GET
- cookie uitlezen
- server parameter uitlezen
- user uitloggen
Nog even en je hebt de hele applicatie in deze ene class gestopt.
Als alleenstaande class kan je het waarschijnlijk best gebruiken en wellicht ook wel vaker in meerdere applicaties. Maar met zoveel verantwoordelijkheden in 1 class kan je het echt geen OOP meer noemen.
Bedankt voor de feedback.
Gebruik verder geen echo's in je methods, maar return statements.