A good secure login script

[Red Hap]

A good Lgin script that I made..It might helpful to some Hosting companies.
<?

&#036;dbusername = "username";
&#036;dbpassword = "password";
&#036;db_name = "database";

// This is the page to show when the user has been logged out

// Page with login form
&#036;login_page = "loginpage";

// Page to show if the user enters an invalid login name or password
&#036;invalidlogin_page = "invalid login page";


//DON&#39;T EDIT ANYTHING BELOW THIS&#33;&#33;&#33;

if (&#036;action == "logout")
{
Setcookie("loginpass","",time() -86400);
Setcookie("loginuser","",time() - 86400);
include(&#036;login_page);
exit;
}
else if (&#036;action == "login")
{
if ((&#036;username == "") || (&#036;password == ""))
{
include(&#036;invalidlogin_page);
exit;
}
else {
//connect
mysql_connect( "localhost", "&#036;dbusername", "&#036;dbpassword") or die( "Unable to connect to server&#33;");
mysql_select_db( "&#036;db_name") or die( "Unable to select database");

//some select queries for registering global variables and verifying user
&#036;query = "SELECT member_id, username, password, status FROM users where username=&#39;&#036;username&#39;";
&#036;insert = MYSQL_QUERY(&#036;query);
&#036;number = MYSQL_NUMROWS(&#036;insert);

if(&#036;number &#33;= 0) {

&#036;i = 0;
&#036;member_id = mysql_result(&#036;insert,&#036;i,"member_id");
&#036;user_db = mysql_result(&#036;insert,&#036;i,"username");
&#036;password_db = mysql_result(&#036;insert,&#036;i,"password");
&#036;status = mysql_result(&#036;insert,&#036;i,"status");

if (&#036;password == &#036;password_db) {
&#036;validuser = "true";
}}
}

}
else
{
if ((&#036;HTTP_COOKIE_VARS["loginpass"] == "") || (&#036;HTTP_COOKIE_VARS["loginuser"] == ""))
{
include(&#036;login_page);
exit;
}
else if ((&#036;HTTP_COOKIE_VARS["loginpass"] &#33;= "") || (&#036;HTTP_COOKIE_VARS["loginuser"] &#33;= ""))
{
&#036;username = &#036;HTTP_COOKIE_VARS["loginuser"];
&#036;password = &#036;HTTP_COOKIE_VARS["loginpass"];
//connect
mysql_connect( "localhost", "&#036;dbusername", "&#036;dbpassword") or die( "Unable to connect to server&#33;");
mysql_select_db( "&#036;db_name") or die( "Unable to select database");

//some select queries for registering global variables and verifying user
&#036;query = "SELECT member_id, username, password, status FROM users where username=&#39;&#036;username&#39;";
&#036;insert = MYSQL_QUERY(&#036;query);
&#036;number = MYSQL_NUMROWS(&#036;insert);

if(&#036;number &#33;= 0) {

&#036;i = 0;
&#036;member_id = mysql_result(&#036;insert,&#036;i,"member_id");
&#036;user_db = mysql_result(&#036;insert,&#036;i,"username");
&#036;password_db = mysql_result(&#036;insert,&#036;i,"password");
&#036;status = mysql_result(&#036;insert,&#036;i,"status");

if (&#036;password == &#036;password_db) {
&#036;validuser = "true";
}}
}
else
{
include(&#036;invalidlogin_page);
exit;
}
}
if (&#036;validuser == "true")
{
Setcookie("loginpass",&#036;password,time() + 86400);
Setcookie("loginuser",&#036;username,time() + 86400);
}
else
{
include(&#036;invalidlogin_page);
exit;
}
?>

[eHostSpace]

do a http login

[XKR]

Good, but fairly basic. Not really all that secure, you don&#39;t even use md5() stuff.

BTW, This:

if ((&#036;username == "") || (&#036;password == ""))

Is more efficiently typed like this:

if (&#33;&#036;username || &#33;&#036;password)

Adding a "&#33;" before a variable name states that it doesn&#39;t exist.