Question

admin_menu.php (files are separate just wanted to fit both in picture) <?php // TODO: protect this page // only admins who have logged in are allowed; otherwise, // send Mallory back to the login page, login page is simple dummy login page. ?> <!DOCTYPE html> <html> <head> <meta charset="UTF-8"> <title></title> </head> <body> Administrator Menu <ul> <li>TODO: Create</li> <li>TODO: Read</li> <li>Update</li> <li>Delete</li> </ul> </body> </html> authenticate.php (second file) <?php session_start(); // FIXME: PHP Form Validation (see the example under Validate Form Data With PHP) // FIXME: get the username/password from the POST superglobal // FIXME: // select password from users where username = '$uname' // if no rows are returned (the username must not be in the table) // else show page below // compare $pwd to the password from the users table // if $pwd is good: // put the username into the session with a the key: 'user' // redirect browser to admin_menu.php // else show page below (don't give Mallory any clues) // WARNING! // Don't confuse the username (root) and password (empty string) for // the MySQL database with the username/password from the form!! ?> <!DOCTYPE html> <html> <body> Invalid username and/or password.  <a href="index.php">Homepage</a> </body>

          admin_menu.php (files are separate just wanted to fit both in picture)
<?php
// TODO: protect this page
// only admins who have logged in are allowed; otherwise,
// send Mallory back to the login page, login page is simple dummy login page.
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title></title>
</head>
<body>
Administrator Menu
<ul>
<li>TODO: Create</li>
<li>TODO: Read</li>
<li>Update</li>
<li>Delete</li>
</ul>
</body>
</html>
authenticate.php (second file)
<?php session_start();

// FIXME: PHP Form Validation (see the example under Validate Form Data With PHP)

// FIXME: get the username/password from the POST superglobal
// FIXME:
// select password from users where username = '$uname'
// if no rows are returned (the username must not be in the table)
// else
show page below
// compare $pwd to the password from the users table
// if $pwd is good:
// put the username into the session with a the key: 'user'
// redirect browser to admin_menu.php
// else show page below (don't give Mallory any clues)
// WARNING!
// Don't confuse the username (root) and password (empty string) for
// the MySQL database with the username/password from the form!!
?>
<!DOCTYPE html>
<html>
<body>
Invalid username and/or password.
<!-- just loops back to index.php if username wrong, username is admin, password is fido in database-->
<a href="index.php">Homepage</a>
</body>

adminmenu.php (files are separate just wanted to fit both in picture)
<?php
// TODO: protect this page
// only admins who have logged in are allowed; otherwise,
// send Mallory back to the login page, login page is simple dummy login page.
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title></title>
</head>
<body>
Administrator Menu
<ul>
<li>TODO: Create</li>
<li>TODO: Read</li>
<li>Update</li>
<li>Delete</li>
</ul>
</body>
</html>
authenticate.php (second file)
<?php sessionstart();

// FIXME: PHP Form Validation (see the example under Validate Form Data With PHP)

// FIXME: get the username/password from the POST superglobal
// FIXME:
// select password from users where username = 'uname'
// if no rows are returned (the username must not be in the table)
// else
show page below
// comparepwd to the password from the users table
// if pwd is good:
// put the username into the session with a the key: 'user'
// redirect browser to adminmenu.php
// else show page below (don't give Mallory any clues)
// WARNING!
// Don't confuse the username (root) and password (empty string) for
// the MySQL database with the username/password from the form!!
?>
<!DOCTYPE html>
<html>
<body>
Invalid username and/or password.
<!– just loops back to index.php if username wrong, username is admin, password is fido in database–>
<a href="index.php">Homepage</a>
</body>

Added by Manuel H.

Question

Please give Ace some feedback