There is a login page (login.php) that is coded html form (includes username and password textboxes). The implementation of login page (php-mysql) is shown below:
//php code begins if (!isset($_SESSION)) { session_start(); } $loginFormAction = $_SERVER['PHP_SELF']; if (isset($_GET['accesscheck'])) { $_SESSION['PrevUrl'] = $_GET['accesscheck']; } if (isset($_POST['username'])) { //from form username textbox $loginUsername=$_POST['username']; $password=$_POST['password']; $MM_fldUserAuthorization = "access_level"; // from db user access-level $MM_redirectLoginSuccess = "login_success_page.php"; $MM_redirectLoginFailed = "login_failed_page.php"; $MM_redirecttoReferrer = false; mysql_select_db($DB_NAME, $DB_LINK); $Login_query=sprintf("SELECT username,password, access_level FROM tbl_user WHERE username=%s AND password=%s", GetSQLValueString($loginUsername, "text"), GetSQLValueString($password, "text")); $Login = mysql_query($Login_query, $DB_LINK) or die(mysql_error()); $loginFoundUser = mysql_num_rows($Login); if ($loginFoundUser) { $loginStrGroup = mysql_result($Login,0,'access_level'); if (PHP_VERSION >= 5.1) {session_regenerate_id(true);} else {session_regenerate_id();} //declare two session variables and assign them $_SESSION['MM_Username'] = $loginUsername; $_SESSION['MM_UserGroup'] = $loginStrGroup; if (isset($_SESSION['PrevUrl']) && false) { $MM_redirectLoginSuccess = $_SESSION['PrevUrl']; } header("Location: " . $MM_redirectLoginSuccess ); } else { header("Location: ". $MM_redirectLoginFailed ); } } //php code ends