PHP | User System - login & register

PHP | User System - login & register

index.php

<?php
require 'core.inc.php';
require 'connect.inc.php';

if (loggedin()) {
    $firstname = getuserfield('firstname');
    $surname = getuserfield('surname');

    echo 'You\'re logged in, '.$firstname.' '.$surname.' ';
    echo '<a href="logout.php">Logout</a>';
} else {
    include 'loginform.inc.php';
}


?>

connect.inc.php

<?php

$mysql_host = 'localhost';
$mysql_user = 'root';
$mysql_pass = '';

$mysql_db = 'a_database';

if (!mysql_connect($mysql_host, $mysql_user, $mysql_pass) || !mysql_select_db($mysql_db)) {
    die(mysql_error());
}

?>

core.inc.php

<?php
ob_start();
session_start();

$current_file = $_SERVER['SCRIPT_NAME'];
if (isset($_SERVER['HTTP_REFERER'])&&!empty($_SERVER['HTTP_REFERER'])) {
    $http_referer = $_SERVER['HTTP_REFERER'];
}

function loggedin(){
    if (isset($_SESSION['user_id']) && !empty($_SESSION['user_id'])) {
        return true;
    } else {
        return false;
    }   
}

function getuserfield($field){
    $query = "SELECT $field FROM users WHERE id = '".$_SESSION['user_id']."'";
    if ($query_run = mysql_query($query)) {
        if ($query_result = mysql_result($query_run, 0, $field)) {
            return $query_result;
        }
    }
}

?>

loginform.inc.php

<?php

if (isset($_POST['username']) && isset($_POST['password'])) {
    $username = $_POST['username'];
    $password = $_POST['password'];

    $password_hash = md5($password);

    if (!empty($username) && !empty($password)) {
       
        $query = "SELECT id FROM users WHERE username = '".mysql_real_escape_string($username)."' AND password = '".mysql_real_escape_string($password_hash)."'";
        if ($query_run = mysql_query($query)) {
            $query_num_rows = mysql_num_rows($query_run);
            if ($query_num_rows==0) {
                echo "Invalid username/password combination.";
            } else if ($query_num_rows==1) {
                $user_id = mysql_result($query_run, 0, 'id');
                $_SESSION['user_id'] = $user_id;
                header('Location: index.php');
            }
           
        }

    } else {
        echo "You must supply username and password.";
    }
   
}

?>
<form action="<?php echo $current_file; ?>" method="POST">
    Username: <input type="text" name="username" value="<?php if (isset($username)) { echo $username; } ?>">
    Password: <input type="password" name="password">
    <input type="submit" value="Login">
</form>

logout.php

<?php
require 'core.inc.php';
session_destroy();
header('Location: '.$http_referer);
?>

register.php

<?php
require 'core.inc.php';
require 'connect.inc.php';

if (!loggedin()) {
    if (isset($_POST['username'])&&isset($_POST['password'])&&isset($_POST['password_again'])&&isset($_POST['firstname'])&&isset($_POST['surname'])) {
        $username = $_POST['username'];

        $password = $_POST['password'];
        $password_again = $_POST['password_again'];
        $password_hash = md5($password);

        $firstname = $_POST['firstname'];
        $surname = $_POST['surname'];
        if (!empty($username)&&!empty($password)&&!empty($password_again)&&!empty($firstname)&&!empty($surname)) {
            if ($password!=$password_again) {
                echo 'Passwords do not match.';
            } else {
                $query = "SELECT username FROM users WHERE username = '".mysql_real_escape_string($username)."'";
                $query_run = mysql_query($query);

                if (mysql_num_rows($query_run)==1) {
                    echo $username.' is already exists.';
                } else {
                    $query = "INSERT INTO users VALUES ('', '".mysql_real_escape_string($username)."', '".mysql_real_escape_string($password_hash)."', '".mysql_real_escape_string($firstname)."', '".mysql_real_escape_string($surname)."')";
                    if ($query_run = mysql_query($query)) {
                        header('Location: register_success.php');
                    } else {
                        echo 'Sorry, we couldn\'t register you at this time. Try again later.';
                    }
                   
                }
               
            }
           
        } else {
            echo 'All fields are required.';
        }
       
    }
?>
<form action="register.php" method="POST">
    <table>
        <tr>
            <td>Username:</td>
            <td><input type="text" name="username" maxlength="30" value="<?php if (isset($username)) { echo $username; } ?>"></td>
        </tr>
        <tr>
            <td>Password:</td>
            <td><input type="password" name="password"></td>
        </tr>
        <tr>
            <td>Pass again:</td>
            <td><input type="password" name="password_again"></td>
        </tr>
        <tr>
            <td>Firstname:</td>
            <td><input type="text" name="firstname" maxlength="40" value="<?php if (isset($firstname)) { echo $firstname; } ?>"></td>
        </tr>
        <tr>
            <td>Surname:</td>
            <td><input type="text" name="surname" maxlength="40" value="<?php if (isset($surname)) { echo $surname; } ?>"></td>
        </tr>
        <tr>
            <td></td>
            <td></td>
            <td><input type="submit" value="Register"></td>
        </tr>
    </table>
</form>
<?php
} else if (loggedin()) {
    echo 'You\'re already registered and logged in.';
}


?>