Whats wrong with this php code that goes directly in without having log in first?

66 Views Asked by At

I have a form that only opens if you're logged in, or at least thats what I'm trying to do, but it opens without having to do it. When I go to the log in page it sends me to the other page like if I was logging in, but it doesn't even show me the login page, heres the code:

this one is for the log in:

<?php
  include ("conexion/conexion.php");
  include("usuarios.class.php");

$usuario= $_POST['usuario'];
$clave= $_POST['clave'];

$objUsuario = new usuarios;
    $srt= $objUsuario->autenticar_usuario($usuario,$clave,1);
    $num =mysql_num_rows($srt);

if($usuario=="" || $clave==""){
 $mensaje="campos en blanco";
 header("location:loginusuario.php?mensaje=$mensaje");  
}else 
{
    $objUsuario = new usuarios;
    $srt= $objUsuario->autenticar_usuario($usuario,$clave,1);
    $num =mysql_num_rows($srt);
    }
if($num <= 0){
        $mensaje="Usuario y/o clave Incorrectos";
         header("location:loginusuario.php?mensaje=$mensaje");  
    }else{

        $row=mysql_fetch_array($srt);
        session_start();
        $_SESSION['log'] = 's'; 
        $_SESSION['nombre'] = $row['nombre'];
         header("location:contrataciones.php"); 

    }

?>

this is for the security file:

<?php
    session_start();
    if($_SESSION['log']!= 's'){ 
        $mensaje="Iniciar sesion";
 header("location:loginusuario.php?mensaje=$mensaje");  

        }

?>

and this is the class I'm using

<?php 
  class usuarios
  {

    function usuarios() {

    } 
    function autenticar_usuario($usuario,$clave){
        $sel="select usuario,clave from usuarios where usuario='".$usuario."' and clave='".$clave."' ";
        $srt=mysql_query($sel) or die($sel);
        return $srt;

    }
?>

please tell me what am I doing wrong I'm a noob in this so I dont really get whats the problem

1

There are 1 best solutions below

0
On

Why don't you try with

if(isset($_SESSION)){
    //statement

    //statement
}

or

if(isset($_SESSION['session_var_name'])){
    //statement

    //statement
}