Darn it., PHP help, please Options

[Mikeplyts]

Alright, so I'm doing some stuff for a new project of mine and this project includes a member login system and all. I have a lot of stuff set up and logging in was fine, but for some strange reason, now that I try to login, the coding sends me to the activation page. The problem is, my account is already activated.

Here's the file that handles the login process, login.php:

CODE

<?php
require ('../includes/functions.php');
url();

// Set parameters
$username = $_POST['username'];
$password = $_POST['password'];
$safe_password = md5($password);
$remember = $_POST['remember'];
$database['server'] = 'localhost';
$database['username'] = 'username';
$database['password'] = 'password';
$database['name'] = 'database';

// Protect against MySQL Injection
$username = stripslashes($username);
$password = stripslashes($password);

// Connect to MySQL Database
mysql_connect($database['server'], $database['username'], $database['password']);
mysql_select_db($database['name']);

// See if user is valid
function valid_user() {
global $username, $password, $safe_password;

if (mysql_num_rows(mysql_query("SELECT ID FROM users WHERE username = '$username' AND password = '$password' AND safe_password = '$safe_password'")) > 0) return true;
}

// Log in the user
if (count($_POST) > 0) {
$grab_id = mysql_query("SELECT ID FROM users WHERE username = '$username' AND password = '$password' AND safe_password = '$safe_password'");
$id = mysql_fetch_row($grab_id);

if (!valid_user()) {
header ('Location: ' . root . '/login?error=invalid');
}

else if (valid_user() && activated()) {
if ($remember) setcookie('hyfb_user', $username, time() + 31556926, '/');
else {
setcookie ('hyfb_user', $username, 0, '/');
setcookie ('hyfb_id', $id[0], 0, '/');
}
header ('Location: ' . root . '/account/dashboard');
}

else {
header ('Location: ' . root . '/account/activate');
}
}

else {
header ('Location: ' . root . '/login?error=invalid');
}
?>

And here's the function to check if a user is activated, activated():

CODE

function activated() {
    $id = $_COOKIE['hyfb_id'];
    $username = $_COOKIE['hyfb_user'];
    $database['server'] = 'localhost';
    $database['username'] = 'username';
    $database['password'] = 'password';
    $database['name'] = 'database';

    $connection = mysql_connect($database['server'], $database['username'], $database['password']);
    mysql_select_db($database['name'], $connection);

    $activation_find = mysql_query("SELECT activation_key FROM users WHERE ID = '$id' AND username = '$username'");
    $activation_key = mysql_fetch_row($activation_find);
    $status_find = mysql_query("SELECT status FROM users WHERE ID = '$id' AND username = '$username'");
    $status = mysql_fetch_row($status_find);

    if ($activation_key[0] == '' && $status[0] == 'verified') return true;

    mysql_close($connection);
}

Okay, so, the weird thing is, if you look in the activated() function where it says:

CODE

if ($activation_key[0] == '' && $status[0] == 'verified') return true;

it's telling me that my account is activated, yet if I go into phpMyAdmin, I see that my "activation_key" field is " " (or empty, as intended) and my "status" field is "verified".

So, I'm wondering if it could be login.php file, specifically around the part where it's setting the cookies and everything.

Help?

[mipadi]

So, I'm wondering if it could be login.php file, specifically around the part where it's setting the cookies and everything.

Could be. You don't set the cookie until after you have made the called to activated(), but activated grabs the username from a cookie. You should probably pass the required into into the activated() function anyway, rather than relying on cookies and global variables to grab that data.

And, of course...you shouldn't be storing your passwords in plaintext in the database.

[Mikeplyts]

Could be. You don't set the cookie until after you have made the called to activated(), but activated grabs the username from a cookie. You should probably pass the required into into the activated() function anyway, rather than relying on cookies and global variables to grab that data.

And, of course...you shouldn't be storing your passwords in plaintext in the database.

Ah, well, okay. Thanks, Michael.

[manny-the-dino]

Topic Closed, and Moved to Resolved Topics. Please PM a moderator if you would like this reopened.