Login Script Problems

[munkynpunky]

hey guys,

I have a script which is :



<?php
include "connection.php";

// Connect to server and select databse.
if (!$con)
{
die('Could not connect: ' . mysql_error() );
}
mysql_select_db($db, $con);

// username and password sent from signup form
$user=$_POST['myusername'];
$pass=$_POST['password'];

$sql="SELECT * FROM our_info WHERE username='$user' and password='$pass'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if($count==1){
// Register $user, $pass and redirect to file "failed.html"
session_register("$user");
session_register("$pass");
header("location:../main.php");
}
else {
header("location:../failed.html");
}
?>

and then on the next page i have this:



<?
session_start();
$t = date("h:i:s", time());
$_SESSION['admin_login_time'] = $t;
$_SESSION['myusername'] = $user;
if(!session_is_registered(myusername)){
header("location:index.php");
}
?>


Why doesnt it display the $user and how do i get it to show the login time rather than the current time?

[munkynpunky]

can anyone help?

[Twey]

session_register() is pretty much deprecated now. Just call session_start() and write to the $_SESSION array.
$user=$_POST['myusername'];
$pass=$_POST['password'];

$sql="SELECT * FROM our_info WHERE username='$user' and password='$pass'"; SQL injection vulnerability. You forgot to validate your input.
header("location:../main.php"); The value of the Location header must be an absolute URL.