Acount lock out after 5 tries

How do you lock out a user after the get their password wrong 5 times?

Alright I have found a site that uses this system to build upon but I can't seem to blend them together perfect.

http://www.webcheatsheet.com/PHP/blocking_system_access.php

im working on it...

Thank you! I have been trying to figure this out for days and I got nothing to show for it.

Alright so after hours of work today I finally figured it out with this system!

Step 1: Run this code in your database:

CREATE TABLE login_attempts (
ip varchar(20),
attempts int default 0,
lastlogin datetime default NULL

Since this is a very long procedure I will just upload all the files that needed modifying....


Actually how do you upload attachments here?

actually, at this time you cant attach things.
i am working to get this resolved, but its kinda just looks like i'll be creating a whole new site for this (and many other?) login systems ...of course free time is a factor so i dont exactly know when that will be happening. until then im afraid you have to just post all your code.

ive got bits and pieces of this working, but im eager to see what you were able to do!!

Well I heavily have mine modified but I will post what I can. I just got home from work so I will do it tomorrow afternoon.

very cool. sounds good.

Alright I tried to make it as stock as I could.

constants.php

Code:

<?php

include ("../config.php");
define("DB_SERVER", "db854.perfora.net");
define("DB_USER", "dbo283875085");
define("DB_PASS", "XjT.WtgW");
define("DB_NAME", "db283875085");
define("TBL_USERS", "users");
define("TBL_ACTIVE_USERS",  "active_users");
define("TBL_ACTIVE_GUESTS", "active_guests");
define("TBL_BANNED_USERS",  "banned_users");
define("ADMIN_NAME", "admin");
define("GUEST_NAME", "Guest");
define("ADMIN_LEVEL", 9);
define("REGUSER_LEVEL", 2);
define("USER_LEVEL",  1);
define("GUEST_LEVEL", 0);
define("TRACK_VISITORS", true);
define("USER_TIMEOUT", 10);
define("GUEST_TIMEOUT", 5);
define("COOKIE_EXPIRE", 60*60*24*100);  //100 days by default
define("COOKIE_PATH", "/");  //Avaible in whole domain
define("EMAIL_FROM_NAME", "YourName");
define("EMAIL_FROM_ADDR", "balint2005@gmail.com");
define("EMAIL_WELCOME", true);
define("ALL_LOWERCASE", false);
?>


session.php

Code:

<?php

include("database.php");
include("mailer.php");
include("form.php");

class Session
{
  var $username;    //Username given on sign-up
  var $userid;      //Random value generated on current login
  var $userlevel;    //The level to which the user pertains
  var $time;        //Time user was last active (page loaded)
  var $logged_in;    //True if user is logged in, false otherwise
  var $userinfo = array();  //The array holding all user info
  var $url;          //The page url current being viewed
  var $referrer;    //Last recorded site page viewed
    var $ip;                  //Remote IP address

  function Session(){
        $this->ip = $_SERVER["REMOTE_ADDR"];
      $this->time = time();
      $this->startSession();
  }

  /**
    * startSession - Performs all the actions necessary to
    * initialize this session object. Tries to determine if the
    * the user has logged in already, and sets the variables
    * accordingly. Also takes advantage of this page load to
    * update the active visitors tables.
    */
  function startSession(){
      global $database;  //The database connection
      session_start();  //Tell PHP to start the session

      /* Determine if user is logged in */
      $this->logged_in = $this->checkLogin();

      /**
      * Set guest value to users not logged in, and update
      * active guests table accordingly.
      */
      if(!$this->logged_in){
        $this->username = $_SESSION['username'] = GUEST_NAME;
        $this->userlevel = GUEST_LEVEL;
        $database->addActiveGuest($_SERVER['REMOTE_ADDR'], $this->time);
      }
      /* Update users last active timestamp */
      else{
        $database->addActiveUser($this->username, $this->time);
      }
     
      /* Remove inactive visitors from database */
      $database->removeInactiveUsers();
      $database->removeInactiveGuests();
     
      /* Set referrer page */
      if(isset($_SESSION['url'])){
        $this->referrer = $_SESSION['url'];
      }else{
        $this->referrer = "/";
      }

      /* Set current url */
      $this->url = $_SESSION['url'] = $_SERVER['PHP_SELF'];
  }

 
  function checkLogin(){
      global $database;  //The database connection
      /* Check if user has been remembered */
      if(isset($_COOKIE['cookname']) && isset($_COOKIE['cookid'])){
        $this->username = $_SESSION['username'] = $_COOKIE['cookname'];
        $this->userid  = $_SESSION['userid']  = $_COOKIE['cookid'];
      }

      /* Username and userid have been set and not guest */
      if(isset($_SESSION['username']) && isset($_SESSION['userid']) &&
        $_SESSION['username'] != GUEST_NAME){
        /* Confirm that username and userid are valid */
        if($database->confirmUserID($_SESSION['username'], $_SESSION['userid']) != 0){
            /* Variables are incorrect, user not logged in */
            unset($_SESSION['username']);
            unset($_SESSION['userid']);
            return false;
        }

        /* User is logged in, set class variables */
        $this->userinfo  = $database->getUserInfo($_SESSION['username']);
        $this->username  = $this->userinfo['username'];
        $this->userid    = $this->userinfo['userid'];
        $this->userlevel = $this->userinfo['userlevel'];
        return true;
      }
      /* User not logged in */
      else{
        return false;
      }
  }

 
  function login($subuser, $subpass, $subremember){
      global $database, $form;  //The database and form object
    
     $result = $database->confirmIPAddress($this->ip);

      if($result == 1){
        $error_type = "access";
        $form->setError($error_type, "Access denied for ".TIME_PERIOD." minutes");
      }
    
     if($form->num_errors > 0){
        return false;
      }
    
     $error_type = "attempt";

      /* Username error checking */
      $field = "user";  //Use field name for username
      if(!$subuser || strlen($subuser = trim($subuser)) == 0){
        $form->setError($field, "* Username not entered");
      }
      else{
        /* Check if username is not alphanumeric */
        if(!eregi("^([0-9a-z])*$", $subuser)){
            $form->setError($field, "* Username not alphanumeric");
        }
      }

      /* Password error checking */
      $field = "pass";  //Use field name for password
      if(!$subpass){
        $form->setError($field, "* Password not entered");
      }
     
      /* Return if form errors exist */
      if($form->num_errors > 0){
        return false;
      }

      /* Checks that username is in database and password is correct */
      $subuser = stripslashes($subuser);
      $result = $database->confirmUserPass($subuser, md5($subpass));

      /* Check error codes */
      if($result == 1){
        $field = "user";
        $form->setError($field, "* Username not found");
      }
      else if($result == 2){
        $field = "pass";
        $form->setError($field, "* Invalid password");
       $database->addLoginAttempt($this->ip);
      }
     
      /* Return if form errors exist */
      if($form->num_errors > 0){
        return false;
      }

      /* Username and password correct, register session variables */
      $this->userinfo  = $database->getUserInfo($subuser);
      $this->username  = $_SESSION['username'] = $this->userinfo['username'];
      $this->userid    = $_SESSION['userid']  = $this->generateRandID();
      $this->userlevel = $this->userinfo['userlevel'];
     
      /* Insert userid into database and update active users table */
      $database->updateUserField($this->username, "userid", $this->userid);
      $database->addActiveUser($this->username, $this->time);
      $database->removeActiveGuest($_SERVER['REMOTE_ADDR']);
    
       $database->clearLoginAttempts($this->ip);

   
      if($subremember){
        setcookie("cookname", $this->username, time()+COOKIE_EXPIRE, COOKIE_PATH);
        setcookie("cookid",  $this->userid,  time()+COOKIE_EXPIRE, COOKIE_PATH);
      }

      /* Login completed successfully */
      return true;
  }

 
  function logout(){
      global $database;  //The database connection
   
      if(isset($_COOKIE['cookname']) && isset($_COOKIE['cookid'])){
        setcookie("cookname", "", time()-COOKIE_EXPIRE, COOKIE_PATH);
        setcookie("cookid",  "", time()-COOKIE_EXPIRE, COOKIE_PATH);
      }

      /* Unset PHP session variables */
      unset($_SESSION['username']);
      unset($_SESSION['userid']);

      /* Reflect fact that user has logged out */
      $this->logged_in = false;
     
      /**
      * Remove from active users table and add to
      * active guests tables.
      */
      $database->removeActiveUser($this->username);
      $database->addActiveGuest($_SERVER['REMOTE_ADDR'], $this->time);
     
      /* Set user level to guest */
      $this->username  = GUEST_NAME;
      $this->userlevel = GUEST_LEVEL;
  }

  /**
    * register - Gets called when the user has just submitted the
    * registration form. Determines if there were any errors with
    * the entry fields, if so, it records the errors and returns
    * 1. If no errors were found, it registers the new user and
    * returns 0. Returns 2 if registration failed.
    */
  function register($subuser, $subpass, $subemail){
      global $database, $form, $mailer;  //The database, form and mailer object
     
      /* Username error checking */
      $field = "user";  //Use field name for username
      if(!$subuser || strlen($subuser = trim($subuser)) == 0){
        $form->setError($field, "* Username not entered");
      }
      else{
        /* Spruce up username, check length */
        $subuser = stripslashes($subuser);
        if(strlen($subuser) < 5){
            $form->setError($field, "* Username below 5 characters");
        }
        else if(strlen($subuser) > 30){
            $form->setError($field, "* Username above 30 characters");
        }
        /* Check if username is not alphanumeric */
        else if(!eregi("^([0-9a-z])+$", $subuser)){
            $form->setError($field, "* Username not alphanumeric");
        }
        /* Check if username is reserved */
        else if(strcasecmp($subuser, GUEST_NAME) == 0){
            $form->setError($field, "* Username reserved word");
        }
        /* Check if username is already in use */
        else if($database->usernameTaken($subuser)){
            $form->setError($field, "* Username already in use");
        }
        /* Check if username is banned */
        else if($database->usernameBanned($subuser)){
            $form->setError($field, "* Username banned");
        }
      }

      /* Password error checking */
      $field = "pass";  //Use field name for password
      if(!$subpass){
        $form->setError($field, "* Password not entered");
      }
      else{
        /* Spruce up password and check length*/
        $subpass = stripslashes($subpass);
        if(strlen($subpass) < 4){
            $form->setError($field, "* Password too short");
        }
        /* Check if password is not alphanumeric */
        else if(!eregi("^([0-9a-z])+$", ($subpass = trim($subpass)))){
            $form->setError($field, "* Password not alphanumeric");
        }
        /**
          * Note: I trimmed the password only after I checked the length
          * because if you fill the password field up with spaces
          * it looks like a lot more characters than 4, so it looks
          * kind of stupid to report "password too short".
          */
      }
     
      /* Email error checking */
      $field = "email";  //Use field name for email
      if(!$subemail || strlen($subemail = trim($subemail)) == 0){
        $form->setError($field, "* Email not entered");
      }
      else{
        /* Check if valid email address */
        $regex = "^[_+a-z0-9-]+(\.[_+a-z0-9-]+)*"
                ."@[a-z0-9-]+(\.[a-z0-9-]{1,})*"
                ."\.([a-z]{2,}){1}$";
        if(!eregi($regex,$subemail)){
            $form->setError($field, "* Email invalid");
        }
        $subemail = stripslashes($subemail);
      }

      /* Errors exist, have user correct them */
      if($form->num_errors > 0){
        return 1;  //Errors with form
      }
      /* No errors, add the new account to the */
      else{
        if($database->addNewUser($subuser, md5($subpass), $subemail)){
            if(EMAIL_WELCOME){
              $mailer->sendWelcome($subuser,$subemail,$subpass);
            }
            return 0;  //New user added succesfully
        }else{
            return 2;  //Registration attempt failed
        }
      }
  }
 
  /**
    * editAccount - Attempts to edit the user's account information
    * including the password, which it first makes sure is correct
    * if entered, if so and the new password is in the right
    * format, the change is made. All other fields are changed
    * automatically.
    */
  function editAccount($subcurpass, $subnewpass, $subemail){
      global $database, $form;  //The database and form object
      /* New password entered */
      if($subnewpass){
        /* Current Password error checking */
        $field = "curpass";  //Use field name for current password
        if(!$subcurpass){
            $form->setError($field, "* Current Password not entered");
        }
        else{
            /* Check if password too short or is not alphanumeric */
            $subcurpass = stripslashes($subcurpass);
            if(strlen($subcurpass) < 4 ||
              !eregi("^([0-9a-z])+$", ($subcurpass = trim($subcurpass)))){
              $form->setError($field, "* Current Password incorrect");
            }
            /* Password entered is incorrect */
            if($database->confirmUserPass($this->username,md5($subcurpass)) != 0){
              $form->setError($field, "* Current Password incorrect");
            }
        }
       
        /* New Password error checking */
        $field = "newpass";  //Use field name for new password
        /* Spruce up password and check length*/
        $subpass = stripslashes($subnewpass);
        if(strlen($subnewpass) < 4){
            $form->setError($field, "* New Password too short");
        }
        /* Check if password is not alphanumeric */
        else if(!eregi("^([0-9a-z])+$", ($subnewpass = trim($subnewpass)))){
            $form->setError($field, "* New Password not alphanumeric");
        }
      }
      /* Change password attempted */
      else if($subcurpass){
        /* New Password error reporting */
        $field = "newpass";  //Use field name for new password
        $form->setError($field, "* New Password not entered");
      }
     
      /* Email error checking */
      $field = "email";  //Use field name for email
      if($subemail && strlen($subemail = trim($subemail)) > 0){
        /* Check if valid email address */
        $regex = "^[_+a-z0-9-]+(\.[_+a-z0-9-]+)*"
                ."@[a-z0-9-]+(\.[a-z0-9-]{1,})*"
                ."\.([a-z]{2,}){1}$";
        if(!eregi($regex,$subemail)){
            $form->setError($field, "* Email invalid");
        }
        $subemail = stripslashes($subemail);
      }
     
      /* Errors exist, have user correct them */
      if($form->num_errors > 0){
        return false;  //Errors with form
      }
     
      /* Update password since there were no errors */
      if($subcurpass && $subnewpass){
        $database->updateUserField($this->username,"password",md5($subnewpass));
      }
     
      /* Change Email */
      if($subemail){
        $database->updateUserField($this->username,"email",$subemail);
      }
     
      /* Success! */
      return true;
  }
 
  /**
    * isAdmin - Returns true if currently logged in user is
    * an administrator, false otherwise.
    */
  function isAdmin(){
      return ($this->userlevel == ADMIN_LEVEL ||
              $this->username  == ADMIN_NAME);
  }
 
  /**
    * generateRandID - Generates a string made up of randomized
    * letters (lower and upper case) and digits and returns
    * the md5 hash of it to be used as a userid.
    */
  function generateRandID(){
      return md5($this->generateRandStr(16));
  }
 
  /**
    * generateRandStr - Generates a string made up of randomized
    * letters (lower and upper case) and digits, the length
    * is a specified parameter.
    */
  function generateRandStr($length){
      $randstr = "";
      for($i=0; $i<$length; $i++){
        $randnum = mt_rand(0,61);
        if($randnum < 10){
            $randstr .= chr($randnum+48);
        }else if($randnum < 36){
            $randstr .= chr($randnum+55);
        }else{
            $randstr .= chr($randnum+61);
        }
      }
      return $randstr;
  }
};


/**
 * Initialize session object - This must be initialized before
 * the form object because the form uses session variables,
 * which cannot be accessed unless the session has started.
 */
$session = new Session;

/* Initialize form object */
$form = new Form;

?>


database.php

Code:

<?php

include("constants.php");
     
class MySQLDB
{
  var $connection;        //The MySQL database connection
  var $num_active_users;  //Number of active users viewing site
  var $num_active_guests;  //Number of active guests viewing site
  var $num_members;        //Number of signed-up users
 
  function MySQLDB(){
      /* Make connection to database */
      $this->connection = mysql_connect(DB_SERVER, DB_USER, DB_PASS) or die(mysql_error());
      mysql_select_db(DB_NAME, $this->connection) or die(mysql_error());
     
 
      $this->num_members = -1;
     
      if(TRACK_VISITORS){
        /* Calculate number of users at site */
        $this->calcNumActiveUsers();
     
        /* Calculate number of guests at site */
        $this->calcNumActiveGuests();
      }
  }

 
  function confirmUserPass($username, $password){
      /* Add slashes if necessary (for query) */
      if(!get_magic_quotes_gpc()) {
         $username = addslashes($username);
      }

      /* Verify that user is in database */
      $q = "SELECT password FROM ".TBL_USERS." WHERE username = '$username'";
      $result = mysql_query($q, $this->connection);
      if(!$result || (mysql_numrows($result) < 1)){
        return 1; //Indicates username failure
      }

      /* Retrieve password from result, strip slashes */
/* Retrieve password and userlevel from result, strip slashes */
$dbarray = mysql_fetch_array($result);
$dbarray['password'] = stripslashes($dbarray['password']);
$dbarray['userlevel'] = stripslashes($dbarray['userlevel']);
$password = stripslashes($password);

/* Validate that userlevel is greater than 1 */
if($dbarray['userlevel'] < 2){
  return 3; //Indicates account has not been activated
}

      /* Validate that password is correct */
      if($password == $dbarray['password']){
        return 0; //Success! Username and password confirmed
      }
      else{
        return 2; //Indicates password failure
      }
  }
 
 
  function confirmUserID($username, $userid){
      /* Add slashes if necessary (for query) */
      if(!get_magic_quotes_gpc()) {
         $username = addslashes($username);
      }

      /* Verify that user is in database */
      $q = "SELECT userid FROM ".TBL_USERS." WHERE username = '$username'";
      $result = mysql_query($q, $this->connection);
      if(!$result || (mysql_numrows($result) < 1)){
        return 1; //Indicates username failure
      }

      /* Retrieve userid from result, strip slashes */
      $dbarray = mysql_fetch_array($result);
      $dbarray['userid'] = stripslashes($dbarray['userid']);
      $userid = stripslashes($userid);

      /* Validate that userid is correct */
      if($userid == $dbarray['userid']){
        return 0; //Success! Username and userid confirmed
      }
      else{
        return 2; //Indicates userid invalid
      }
  }
 
  function usernameTaken($username){
      if(!get_magic_quotes_gpc()){
        $username = addslashes($username);
      }
      $q = "SELECT username FROM ".TBL_USERS." WHERE username = '$username'";
      $result = mysql_query($q, $this->connection);
      return (mysql_numrows($result) > 0);
  }
 
 
  function usernameBanned($username){
      if(!get_magic_quotes_gpc()){
        $username = addslashes($username);
      }
      $q = "SELECT username FROM ".TBL_BANNED_USERS." WHERE username = '$username'";
      $result = mysql_query($q, $this->connection);
      return (mysql_numrows($result) > 0);
  }
 
 
  function addNewUser($username, $password, $email){
      $time = time();
      /* If admin sign up, give admin user level */
      if(strcasecmp($username, ADMIN_NAME) == 0){
        $ulevel = ADMIN_LEVEL;
      }else{
        $ulevel = USER_LEVEL;
      }
      $q = "INSERT INTO ".TBL_USERS." VALUES ('$username', '$password', '0', $ulevel, '$email', $time)";
      return mysql_query($q, $this->connection);
  }
 
 
  function updateUserField($username, $field, $value){
      $q = "UPDATE ".TBL_USERS." SET ".$field." = '$value' WHERE username = '$username'";
      return mysql_query($q, $this->connection);
  }
 
 
  function getUserInfo($username){
      $q = "SELECT * FROM ".TBL_USERS." WHERE username = '$username'";
      $result = mysql_query($q, $this->connection);
      /* Error occurred, return given name by default */
      if(!$result || (mysql_numrows($result) < 1)){
        return NULL;
      }
      /* Return result array */
      $dbarray = mysql_fetch_array($result);
      return $dbarray;
  }
 
 
  function getNumMembers(){
      if($this->num_members < 0){
        $q = "SELECT * FROM ".TBL_USERS;
        $result = mysql_query($q, $this->connection);
        $this->num_members = mysql_numrows($result);
      }
      return $this->num_members;
  }
 
  /**
    * calcNumActiveUsers - Finds out how many active users
    * are viewing site and sets class variable accordingly.
    */
  function calcNumActiveUsers(){
      /* Calculate number of users at site */
      $q = "SELECT * FROM ".TBL_ACTIVE_USERS;
      $result = mysql_query($q, $this->connection);
      $this->num_active_users = mysql_numrows($result);
  }
 
  /**
    * calcNumActiveGuests - Finds out how many active guests
    * are viewing site and sets class variable accordingly.
    */
  function calcNumActiveGuests(){
      /* Calculate number of guests at site */
      $q = "SELECT * FROM ".TBL_ACTIVE_GUESTS;
      $result = mysql_query($q, $this->connection);
      $this->num_active_guests = mysql_numrows($result);
  }
 
 
  function addActiveUser($username, $time){
      $q = "UPDATE ".TBL_USERS." SET timestamp = '$time' WHERE username = '$username'";
      mysql_query($q, $this->connection);
     
      if(!TRACK_VISITORS) return;
      $q = "REPLACE INTO ".TBL_ACTIVE_USERS." VALUES ('$username', '$time')";
      mysql_query($q, $this->connection);
      $this->calcNumActiveUsers();
  }
 
  /* addActiveGuest - Adds guest to active guests table */
  function addActiveGuest($ip, $time){
      if(!TRACK_VISITORS) return;
      $q = "REPLACE INTO ".TBL_ACTIVE_GUESTS." VALUES ('$ip', '$time')";
      mysql_query($q, $this->connection);
      $this->calcNumActiveGuests();
  }
 
  /* These functions are self explanatory, no need for comments */
 
  /* removeActiveUser */
  function removeActiveUser($username){
      if(!TRACK_VISITORS) return;
      $q = "DELETE FROM ".TBL_ACTIVE_USERS." WHERE username = '$username'";
      mysql_query($q, $this->connection);
      $this->calcNumActiveUsers();
  }
 
  /* removeActiveGuest */
  function removeActiveGuest($ip){
      if(!TRACK_VISITORS) return;
      $q = "DELETE FROM ".TBL_ACTIVE_GUESTS." WHERE ip = '$ip'";
      mysql_query($q, $this->connection);
      $this->calcNumActiveGuests();
  }
 
  /* removeInactiveUsers */
  function removeInactiveUsers(){
      if(!TRACK_VISITORS) return;
      $timeout = time()-USER_TIMEOUT*60;
      $q = "DELETE FROM ".TBL_ACTIVE_USERS." WHERE timestamp < $timeout";
      mysql_query($q, $this->connection);
      $this->calcNumActiveUsers();
  }

  /* removeInactiveGuests */
  function removeInactiveGuests(){
      if(!TRACK_VISITORS) return;
      $timeout = time()-GUEST_TIMEOUT*60;
      $q = "DELETE FROM ".TBL_ACTIVE_GUESTS." WHERE timestamp < $timeout";
      mysql_query($q, $this->connection);
      $this->calcNumActiveGuests();
  }
 
 
  function query($query){
      return mysql_query($query, $this->connection);
  }
};

/* Create database connection */
$database = new MySQLDB;

?>


process.php

Code:

<?php

include("include/session.php");

class Process
{
  /* Class constructor */
  function Process(){
      global $session;
      /* User submitted login form */
      if(isset($_POST['sublogin'])){
        $this->procLogin();
      }
      /* User submitted registration form */
      else if(isset($_POST['subjoin'])){
        $this->procRegister();
      }
      /* User submitted forgot password form */
      else if(isset($_POST['subforgot'])){
        $this->procForgotPass();
      }
      /* User submitted edit account form */
      else if(isset($_POST['subedit'])){
        $this->procEditAccount();
      }
      /**
      * The only other reason user should be directed here
      * is if he wants to logout, which means user is
      * logged in currently.
      */
      else if($session->logged_in){
        $this->procLogout();
      }
      /**
      * Should not get here, which means user is viewing this page
      * by mistake and therefore is redirected.
      */
      else{
          header("Location: main.php");
      }
  }

  /**
    * procLogin - Processes the user submitted login form, if errors
    * are found, the user is redirected to correct the information,
    * if not, the user is effectively logged in to the system.
    */
  function procLogin(){
      global $session, $form;
      /* Login attempt */
      $retval = $session->login($_POST['user'], $_POST['pass'], isset($_POST['remember']));
     
      /* Login successful */
      if($retval){
        header("Location: ".$session->referrer);
      }
      /* Login failed */
      else{
        $_SESSION['value_array'] = $_POST;
        $_SESSION['error_array'] = $form->getErrorArray();
        header("Location: ".$session->referrer);
      }
  }
 
  /**
    * procLogout - Simply attempts to log the user out of the system
    * given that there is no logout form to process.
    */
  function procLogout(){
      global $session;
      $retval = $session->logout();
      header("Location: main.php");
  }
 
  /**
    * procRegister - Processes the user submitted registration form,
    * if errors are found, the user is redirected to correct the
    * information, if not, the user is effectively registered with
    * the system and an email is (optionally) sent to the newly
    * created user.
    */
  function procRegister(){
      global $session, $form;
      /* Convert username to all lowercase (by option) */
      if(ALL_LOWERCASE){
        $_POST['user'] = strtolower($_POST['user']);
      }
      /* Registration attempt */
      $retval = $session->register($_POST['user'], $_POST['pass'], $_POST['email']);
     
      /* Registration Successful */
      if($retval == 0){
        $_SESSION['reguname'] = $_POST['user'];
        $_SESSION['regsuccess'] = true;
        header("Location: ".$session->referrer);
      }
      /* Error found with form */
      else if($retval == 1){
        $_SESSION['value_array'] = $_POST;
        $_SESSION['error_array'] = $form->getErrorArray();
        header("Location: ".$session->referrer);
      }
      /* Registration attempt failed */
      else if($retval == 2){
        $_SESSION['reguname'] = $_POST['user'];
        $_SESSION['regsuccess'] = false;
        header("Location: ".$session->referrer);
      }
  }
 
  /**
    * procForgotPass - Validates the given username then if
    * everything is fine, a new password is generated and
    * emailed to the address the user gave on sign up.
    */
  function procForgotPass(){
      global $database, $session, $mailer, $form;
      /* Username error checking */
      $subuser = $_POST['user'];
      $field = "user";  //Use field name for username
      if(!$subuser || strlen($subuser = trim($subuser)) == 0){
        $form->setError($field, "* Username not entered<br>");
      }
      else{
        /* Make sure username is in database */
        $subuser = stripslashes($subuser);
        if(strlen($subuser) < 5 || strlen($subuser) > 30 ||
            !eregi("^([0-9a-z])+$", $subuser) ||
            (!$database->usernameTaken($subuser))){
            $form->setError($field, "* Username does not exist<br>");
        }
      }
     
      /* Errors exist, have user correct them */
      if($form->num_errors > 0){
        $_SESSION['value_array'] = $_POST;
        $_SESSION['error_array'] = $form->getErrorArray();
      }
      /* Generate new password and email it to user */
      else{
        /* Generate new password */
        $newpass = $session->generateRandStr(8);
       
        /* Get email of user */
        $usrinf = $database->getUserInfo($subuser);
        $email  = $usrinf['email'];
       
        /* Attempt to send the email with new password */
        if($mailer->sendNewPass($subuser,$email,$newpass)){
            /* Email sent, update database */
            $database->updateUserField($subuser, "password", md5($newpass));
            $_SESSION['forgotpass'] = true;
        }
        /* Email failure, do not change password */
        else{
            $_SESSION['forgotpass'] = false;
        }
      }
     
      header("Location: ".$session->referrer);
  }
 
  /**
    * procEditAccount - Attempts to edit the user's account
    * information, including the password, which must be verified
    * before a change is made.
    */
  function procEditAccount(){
      global $session, $form;
      /* Account edit attempt */
      $retval = $session->editAccount($_POST['curpass'], $_POST['newpass'], $_POST['email']);

      /* Account edit successful */
      if($retval){
        $_SESSION['useredit'] = true;
        header("Location: ".$session->referrer);
      }
      /* Error found with form */
      else{
        $_SESSION['value_array'] = $_POST;
        $_SESSION['error_array'] = $form->getErrorArray();
        header("Location: ".$session->referrer);
      }
  }
};

/* Initialize process */
$process = new Process;

?>

now those should be all the files that needed editing. Just remember to run the code in my third or so post in MSQL.

I am having errors with

Code:

      $result = $database->confirmIPAddress($this->ip);


In session.php - have I missed something out?