Hi,
Can someone please give me some guidance, I have a simple Create an account section that when the user creates and account he can then login and when he is logged in he then gets access to the logged in pages.
I want to add the ability on one page for the logged in user to be able to upload a pdf.
Here is where my issue comes i;
#1 How do I prevent other users and people from seeing it, because if I put all file uploads in the directory /upload then I assume anyone can simply type that in and view all the info.
#2 How can I create an admin side for me to view the user and then the file he uploaded?
==========
Currently my code is as follows on the logged in viewable pages.
dbconfig.php is as follows:
class.user.php is a follows:
Side note:
If you need other code, please let me know and I will edit to show the relative code.
Can someone please give me some guidance, I have a simple Create an account section that when the user creates and account he can then login and when he is logged in he then gets access to the logged in pages.
I want to add the ability on one page for the logged in user to be able to upload a pdf.
Here is where my issue comes i;
#1 How do I prevent other users and people from seeing it, because if I put all file uploads in the directory /upload then I assume anyone can simply type that in and view all the info.
#2 How can I create an admin side for me to view the user and then the file he uploaded?
==========
Currently my code is as follows on the logged in viewable pages.
PHP:
<?php
include_once 'dbconfig.php';
if(!$user->is_loggedin())
{
$user->redirect('index.php');
}
$user_id = $_SESSION['user_session'];
$stmt = $DB_con->prepare("SELECT * FROM users WHERE user_id=:user_id");
$stmt->execute(array(":user_id"=>$user_id));
$userRow=$stmt->fetch(PDO::FETCH_ASSOC);
?>
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1">
<meta name="description" content="">
<meta name="keywords" content="">
<meta name="copyright" content="">
<meta name="author" content="">
<!-- Latest compiled and minified CSS -->
<title>Welcome - <?php print($userRow['user_email']); ?> | Reseller Protected Document</title>
...
...
...dbconfig.php is as follows:
PHP:
<?php
session_start();
$DB_host = "localhost";
$DB_user = "root";
$DB_pass = "";
$DB_name = "dblogin";
try
{
$DB_con = new PDO("mysql:host={$DB_host};dbname={$DB_name}",$DB_user,$DB_pass);
$DB_con->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
}
catch(PDOException $e)
{
echo $e->getMessage();
}
include_once 'class.user.php';
$user = new USER($DB_con);class.user.php is a follows:
PHP:
<?php
class USER
{
private $db;
function __construct($DB_con)
{
$this->db = $DB_con;
}
public function register($fname,$lname,$uname,$umail,$upass)
{
try
{
$new_password = password_hash($upass, PASSWORD_DEFAULT);
$stmt = $this->db->prepare("INSERT INTO users(user_name,user_email,user_pass)
VALUES(:uname, :umail, :upass)");
$stmt->bindparam(":uname", $uname);
$stmt->bindparam(":umail", $umail);
$stmt->bindparam(":upass", $new_password);
$stmt->execute();
return $stmt;
}
catch(PDOException $e)
{
echo $e->getMessage();
}
}
public function login($uname,$umail,$upass)
{
try
{
$stmt = $this->db->prepare("SELECT * FROM users WHERE user_name=:uname OR user_email=:umail LIMIT 1");
$stmt->execute(array(':uname'=>$uname, ':umail'=>$umail));
$userRow=$stmt->fetch(PDO::FETCH_ASSOC);
if($stmt->rowCount() > 0)
{
if(password_verify($upass, $userRow['user_pass']))
{
$_SESSION['user_session'] = $userRow['user_id'];
return true;
}
else
{
return false;
}
}
}
catch(PDOException $e)
{
echo $e->getMessage();
}
}
public function is_loggedin()
{
if(isset($_SESSION['user_session']))
{
return true;
}
}
public function redirect($url)
{
header("Location: $url");
}
public function logout()
{
session_destroy();
unset($_SESSION['user_session']);
return true;
}
}
?>Side note:
If you need other code, please let me know and I will edit to show the relative code.
