nicht angemeldet
Die Session startet doch beim index.php schon??
index.php
<?php
error_reporting(E_ALL);
session_start();
// Verbindung zu MySQL Aufbauen
@mysql_connect('localhost', 'root', '') OR die(mysql_error());
mysql_select_db('test') OR die(mysql_error());
include "inc/config.php"; // die Konfigurationsdateien lesen.
// Session starten wenn ?section=admin geöffnet wurde
if(isset($_GET['section']) AND ("admin" == $_GET['section'])) {
if(!isset($_SESSION['IP'])) {
$_SESSION['IP'] = $_SERVER['REMOTE_ADDR'];
}
if($_SESSION['IP'] != $_SERVER['REMOTE_ADDR']) {
echo "<p class=\"error\">\n";
echo " Sie dürfen nicht die Session von einem\n";
echo " anderen user Benutzten. Bitte benutzen sie\n";
echo " folgenden Link um zur Homepage zu gelangen.\n";
echo " <a href=\"/\">Zurück zur Homepage</a>\n";
echo "</p>\n";
die(); // Aus Sicherheitsgründen die Abarbeitung sofort beenden
}
}
if(get_magic_quotes_gpc()) {
array_stripslashes($_GET);
array_stripslashes($_POST);
array_stripslashes($_COOKIE);
}
echo "<!DOCTYPE html PUBLIC \"-//W3C//DTD XHTML 1.0 Strict//EN\"\n";
echo " \"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd\">\n";
echo "<html>\n";
echo " <head>\n";
echo " <title>Meine Seite</title>\n";
echo " <link rel=\"stylesheet\" type=\"text/css\" href=\"page.css\" />\n";
echo " <meta http-equiv=\"Content-Type\" content=\"text/html; charset=ISO-8859-1\" />\n";
echo " </head>\n";
echo " <body>\n";
echo " <div id=\"root\">\n"; // ganz oberer Div-Holder
echo " <div id=\"banner\">\n"; // banner
include "banner.php";
echo " </div>\n";
echo " <div id=\"links\">\n"; // linkes Menu
include "menu.php";
echo " </div>\n";
echo " <div id=\"mitte\">\n"; // In der Mitte der Inhalt
include "inhalt.php";
echo " </div>\n";
echo " <br style=\"clear:both;\" />\n"; // css-float beenden
echo " </div>\n";
echo " </body>\n";
echo "</html>\n";
?>
admin.php
<?php
@mysql_connect('localhost', 'root', '') OR die(mysql_error());
mysql_select_db('test') OR die(mysql_error());
// die admin.php
if(isset($_GET['action']) AND ("logout" == $_GET['action'])) {
session_destroy();
echo "<p>\n";
echo " Sie haben sich ausgeloggt. Um wieder in den Adminbereich\n";
echo " zu kommen müssen sie sich wieder Einloggen\n";
echo "</p>\n";
} else {
if(isset($_POST['UserID']) AND '0' == $_POST['UserID']) {
echo "<p>\n";
echo " Bitte wählen sie einen Benutzernamen aus.\n";
echo "</p>\n";
} else {
if(isset($_POST['UserID'], $_POST['Password']) AND
login_right(addslashes($_POST['UserID']),
addslashes($_POST['Password']))) {
$_SESSION['ID'] = $_POST['UserID'];
}
if(isset($_SESSION['ID'])) {
if(isset($_GET['site']) AND isset($admin_site[$_GET['site']])) {
include $admin_site[$_GET['site']];
} else {
include "admin_menu.php";
// Das Hauptmenu vom Adminbereich laden
}
} else {
// Login-Formular mit der if(isset()) abfrage
}
if(isset($_SESSION['ID'])) {
echo "<p>\n";
echo "Willkommen im Adminbereich <br />\n";
// Die Session-ID nicht vergessen
echo " <a href=\"index.php?section=admin&'.SID.'\">Repeat</a>\n";
echo " <a href=\"index.php?section=admin&action=logout&'.SID.'\">Ausloggen</a>\n";
echo "</p>\n";
} else {
if(isset($_POST['submit'])) {
// Der Submit-Button wurde gedrückt
// aber der Login ist falsch. Deshalb
// erstellen wir eine Fehlermeldung
echo "<p>\n";
echo " Ungültiges Password.\n";
echo "</p>\n";
}
echo "<form action=\"index.php?section=admin\" method=\"post\" class=\"formular\">\n";
echo " <p>\n";
echo " Adminbereich\n";
echo " </p>\n";
echo " <ol>\n";
echo " <li>\n";
echo " <label for=\"name\">Name</label>\n";
$sql = "SELECT
ID,
Name
FROM
users
ORDER BY
Name ASC;";
$result = mysql_query($sql) OR die(mysql_error());
echo " <select size=\"1\" name=\"UserID\" id=\"name\">\n";
echo " <option value=\"0\" selected=\"selected\">Bitte wählen</option>\n";
while($row = mysql_fetch_assoc($result)) {
echo "<option value=\"".$row['ID']."\">".$row['Name']."</option>\n";
}
echo " </select>\n";
echo " </li>\n";
echo " <li>\n";
echo " <label for=\"password\">Password</label>\n";
echo " <input type=\"password\" name=\"Password\" id=\"password\" />\n";
echo " </li>\n";
echo " <li>\n";
echo " <input type=\"submit\" name=\"submit\" value=\"Speichern\" />\n";
echo " <input type=\"reset\" name=\"submit\" value=\"Zurücksetzen\" />\n";
echo " </li>\n";
echo " </ol>\n";
echo "</form>\n";
}
}
}
?>
admin_menu.php
<?php
echo "<h2>Adminbereich</h2>\n";
echo "<p>\n";
echo " <a href=\"index.php?section=admin&site=self&'.SID.'\">\n";
echo " Eigenen Account bearbeiten\n";
echo " </a>\n";
echo "</p>\n";
?>
admin_self.php
<?php
// Verbindung zu MySQL Aufbauen
@mysql_connect('localhost', 'root', '') OR die(mysql_error());
mysql_select_db('test') OR die(mysql_error());
$sql = "SELECT
Name,
Email
FROM
users
WHERE
ID = '".$_SESSION['ID']."';";
$result = mysql_query($sql) OR die(mysql_error());
$row = mysql_fetch_assoc($result);
echo "<form action=\"index.php?section=admin&site=self\" method=\"post\" class=\"formular\">\n";
echo " <p>\n";
echo " Eigene Daten bearbeiten\n";
echo " </p>\n";
echo " <ol>\n";
echo " <li>\n";
echo " <label for=\"name\">Name</label>\n";
echo " <input type=\"text\" name=\"name\" id=\"name\" value=\"".$row['Name']."\"/>\n";
echo " </li>\n";
echo " <li>\n";
echo " <label for=\"email\">Emailadresse</label>\n";
echo " <input type=\"text\" name=\"email\" id=\"email\" value=\"".$row['Email']."\"/>\n";
echo " </li>\n";
echo " <li>\n";
echo " <input type=\"submit\" name=\"submit\" value=\"Speichern\" />\n";
echo " <input type=\"reset\" name=\"submit\" value=\"Zurücksetzen\" />\n";
echo " <input type=\"hidden\" name=\"".session_name()."\" value=\"".session_id()."\" />\n";
echo " </li>\n";
echo " </ol>\n";
echo "</form>\n";
echo "<p>\n";
echo " <a href=\"index.php?section=admin&'.SID.'\">Zurück</a>\n";
echo "</p>\n";
?>
variablen.php
<?php
// variablen.php
$dateien = array();
$dateien['news'] = "news.php";
$admin_site = array();
$admin_site['self'] = "admin_self.php";
?>
constant.php
<?php
// constant.php
define('MYSQL_HOST', 'localhost');
define('MYSQL_USER', 'root'); // kann ich ja schlecht für
// eure MySQL wissen
define('MYSQL_PASS', ''); // s.o.
define('MYSQL_DATABASE', 'test'); // s.o.
?>
variables.php
<?php
// zum Beispiel in der variables.php angelegt
$dateien = array();
$dateien['news'] = 'news.php';
$dateien['forum'] = 'forum.php';
$dateien['downloads'] = 'dl.php';
$dateien['login'] = 'login.php';
// ...
?>
functions.php
<?php
function login_right($id, $pass)
{
$sql = "SELECT
COUNT(*) as Anzahl
FROM
users
WHERE
ID = '".$id."' AND
Password = MD5('".$pass."');";
$result = mysql_query($sql) OR die(mysql_error());
$row = mysql_fetch_assoc($result);
mysql_free_result($result);
return $row['Anzahl'];
}
?>
config.php
<?php
include 'constant.php';
include 'variablen.php';
include 'functions.php';
include 'admin.php';
// wir haben keine eigenen Funkionen
?>