need help with logout (logout not perfect)

[crescent_au]

Hi all,

I've written a login/logout code. It does what it's supposed to do but
the problem is when I logout and press browser's back button (in
Firefox), I get to the last login page. In IE, when I press back
button, I get to the page that says "Page has Expired" but Firefox does
not do this.

I think it's something to do with sessions not properly unset or
something like that but I haven't been able to figure it out. I am
attaching my codes and database structure below. If you need more info,
please email me. I really want this to be fixed asap. I've played with
this long enough. Thanks!

Login class:
-----------------

class Login {
//var $loginflag;
//var $db_connect;

function Login() {
//$this ->db_connect = $db_connect;

if (!isset($_SESSI ON['uid']) || $_SESSION['uid'] == 0) {
$this->set_session_de faults();
echo "inside login class<br />";
}
}

function check_login($us ername, $password) {
global $db;
$link=$db->connectDB();

if ($_SESSION['logged']) {
$this->check_session( );
echo "logged...< br />";
return true;
} else {
$username = mysql_escape_st ring($username) ;
$query = "SELECT * FROM users WHERE username = '$username' AND
AES_DECRYPT(pas sword, 'dreamfilmslogi n438ismbtsx') = '$password'";
$result = mysql_query($qu ery, $link) or die("Could not select");

if (mysql_num_rows ($result)) {
$this->set_session($u sername = mysql_fetch_ass oc($result), true);
return $username['username'];
} else {
$this->failed = true;
session_destroy ();
return false;
}
}
}

function check_session() {
global $db;
$link=$db->connectDB();

$username = mysql_escape_st ring($_SESSION['username']);
$token = mysql_escape_st ring($_SESSION['token']);
$session = mysql_escape_st ring(session_id ());
$ip = mysql_escape_st ring($_SERVER['REMOTE_ADDR']);

$query = "SELECT * FROM users WHERE username='{$use rname}' AND
token='{$token} ' AND session='{$sess ion}' AND ip='{$ip}'";
$result = mysql_query($qu ery, $link) or die("Could not select");
echo "check session:<br />";
print_r($result );
echo "<br />";
if ($result != false) {
} else {
$this->logout();
}
}

function set_session_def aults() {
//session_start() ;
////session_registe r("logged", "uid", "username") ;
$_SESSION['logged'] = false;
$_SESSION['uid'] = 0;
$_SESSION['username'] = '';
}

function set_session($re sult,$init = true) {
global $db;
$link=$db->connectDB();

if ($init) {
//session_start() ;
$session = mysql_escape_st ring(session_id ());
$ip = mysql_escape_st ring($_SERVER['REMOTE_ADDR']);
$result['token'] = $this->token(); // generate a new token
$query = "UPDATE users SET session='{$sess ion}',
token='{$result['token']}', ip='{$ip}' WHERE uid='{$result['uid']}'";
mysql_query($qu ery, $link) or die("Could not select");
$_SESSION['logged'] = true;
$_SESSION['uid'] = $result['uid'];
$_SESSION['username'] = $result['username'];
echo "set session:<br />";
print_r($result );
echo "<br />";
echo "session: ".$session. "<br />";
echo "ip: ".$ip."<br />";
}
}

function token() {
// generate a random token
for($i=1;$i<33; $i++) {
$seed .= chr(rand(0,255) );
}
return md5($seed);
}

function logout() {
global $db;
$link=$db->connectDB();

$query = "UPDATE users SET session='', token='', ip='' WHERE
uid='{$_SESSION['uid']}'";
mysql_query($qu ery, $link) or die("Could not select");
mysql_close($li nk);
unset($_SESSION['username']);
unset($_SESSION['logged']);
unset($_SESSION['uid']);
// kill session variables
$_SESSION = array(); // reset session array
session_destroy ();

/**$this->set_session_de faults();
session_destroy ();*****/

echo "logged out...<br />";
return true;
}
} // end class Login

DBAccess class
-------------------------
class DBAccess {
var $_login;

// Constructor
function DBAccess() {
$this -_login = array();
$this -_login['db_loginid'] = "testuser";
$this -_login['db_password'] = "";
$this -_login['hostname'] = "localhost" ;
$this -_login['db_name'] = "dblogin";
}

function connectDB() {
if (!($link = @mysql_connect( $this->_login['hostname'],
$this->_login['db_loginid'], $this->_login['db_password']))) {
echo "<strong>Co uld not connect:&nbsp;</strong>".mysql_ error()."<br
/><hr size='1' /><br />";
} else if (!@mysql_select _db($this->_login['db_name'],$link)) {
echo "Could not select database";
}
if ($link) {
return $link;
}
} // end connectDB()
} // end class DB_Access
database structure
----------------------------
CREATE TABLE `users` (
`uid` int(11) NOT NULL auto_increment,
`username` varchar(20) NOT NULL default '',
`password` varchar(50) NOT NULL default '',
`token` varchar(100) NOT NULL default '',
`session` varchar(100) NOT NULL default '',
`ip` varchar(20) NOT NULL default '',
PRIMARY KEY (`uid`),
UNIQUE KEY `username` (`username`)
) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT= 2 ;

[Koncept]

In article <11************ **********@i42g 2000cwa.googleg roups.com>,
<cr*********@ya hoo.comwrote:

Hi all,

I've written a login/logout code. It does what it's supposed to do but
the problem is when I logout and press browser's back button (in
Firefox), I get to the last login page. In IE, when I press back
button, I get to the page that says "Page has Expired" but Firefox does
not do this.

I think it's something to do with sessions not properly unset or
something like that but I haven't been able to figure it out. I am
attaching my codes and database structure below. If you need more info,
please email me. I really want this to be fixed asap. I've played with
this long enough. Thanks!

Just curious what happens if you add these headers to the previous
pages?

( code from docs )

<?php
header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header("Expires : Mon, 26 Jul 1997 05:00:00 GMT"); // Date in the past
?>

And this for the destruction of the session:

<?php
$_SESSION = array();

// Note: This will destroy the session, and not just the session data!
if ( isset( $_COOKIE[session_name()] ) )
setcookie( session_name(), '', time() - 42000, '/' );

// Finally, destroy the session.
session_destroy ();
?>

--
Koncept <<
"The snake that cannot shed its skin perishes. So do the spirits who are
prevented from changing their opinions; they cease to be a spirit." -Nietzsche

[crescent_au]

>Koncept wrote:
Just curious what happens if you add these headers to the previous
pages?

( code from docs )

<?php
header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header("Expires : Mon, 26 Jul 1997 05:00:00 GMT"); // Date in the past
?>

And this for the destruction of the session:

<?php
$_SESSION = array();

// Note: This will destroy the session, and not just the session data!
if ( isset( $_COOKIE[session_name()] ) )
setcookie( session_name(), '', time() - 42000, '/' );

// Finally, destroy the session.
session_destroy ();
?>

No, still the same. I don't have any cookies set. I've only used
sessions in my code but anyway I tried all the above you have suggested
but there is no difference in the outcome. I hope someone can help me
with this.

If you want the codes, I can even email you the codes. Just let me know
by email. I really need to get this fixed.

Thanks

[Jerry Stuckle]

cr*********@yah oo.com wrote:

Hi all,

I've written a login/logout code. It does what it's supposed to do but
the problem is when I logout and press browser's back button (in
Firefox), I get to the last login page. In IE, when I press back
button, I get to the page that says "Page has Expired" but Firefox does
not do this.

I think it's something to do with sessions not properly unset or
something like that but I haven't been able to figure it out. I am
attaching my codes and database structure below. If you need more info,
please email me. I really want this to be fixed asap. I've played with
this long enough. Thanks!

No, Firefox has most probably pulled this from its cache. Disable the
cache (set to 0) and your problem will go away.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

[Jerry Stuckle]

Koncept wrote:

In article <11************ **********@i42g 2000cwa.googleg roups.com>,
<cr*********@ya hoo.comwrote:

>>Hi all,

I've written a login/logout code. It does what it's supposed to do but
the problem is when I logout and press browser's back button (in
Firefox), I get to the last login page. In IE, when I press back
button, I get to the page that says "Page has Expired" but Firefox does
not do this.

I think it's something to do with sessions not properly unset or
something like that but I haven't been able to figure it out. I am
attaching my codes and database structure below. If you need more info,
please email me. I really want this to be fixed asap. I've played with
this long enough. Thanks!

Just curious what happens if you add these headers to the previous
pages?

( code from docs )

<?php
header("Cache-Control: no-cache, must-revalidate"); // HTTP/1.1
header("Expires : Mon, 26 Jul 1997 05:00:00 GMT"); // Date in the past
?>

And this for the destruction of the session:

<?php
$_SESSION = array();

// Note: This will destroy the session, and not just the session data!
if ( isset( $_COOKIE[session_name()] ) )
setcookie( session_name(), '', time() - 42000, '/' );

This line will never do anything. The session_name is the value of the
cookie, not the name. The cookie name is set in the php.ini file
(default: PHPSESSID).

// Finally, destroy the session.
session_destroy ();
?>

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

[Koncept]

In article <nb************ *************** ***@comcast.com >, Jerry
Stuckle <js*******@attg lobal.netwrote:

// Note: This will destroy the session, and not just the session data!
if ( isset( $_COOKIE[session_name()] ) )
setcookie( session_name(), '', time() - 42000, '/' );

This line will never do anything. The session_name is the value of the
cookie, not the name.

That's incorrect. session_name() will return the key (*PHPSESSID* )
which is then used as a key in the $_COOKIE superglobal to point to the
current session id.

http://php.net/session_destroy

You will notice that the code I provided you is directly from the PHP
docs and it is *not* incorrect.

As you can see from the example below, each time I start a new browser
session, I can, in fact, echo out what you suggest to be superfluous.
Perhaps the answer to your problem lies in this simple oversight unless
you have altered the value of "session.use_co okies" in your ini file.

<?php
session_start() ;

if(isset($_COOK IE[session_name()])){
echo $_COOKIE[session_name()];
}
// 72728376dfdd7f3 de60f75111ace5a 6e (first session - browser one)
// 1ce309fbb3bbdd0 d34ed2b73be8cbe 5b (first session - browser two)
?>

--
Koncept <<
"The snake that cannot shed its skin perishes. So do the spirits who are
prevented from changing their opinions; they cease to be a spirit." -Nietzsche

[Jerry Stuckle]

Koncept wrote:

In article <nb************ *************** ***@comcast.com >, Jerry
Stuckle <js*******@attg lobal.netwrote:

>>>// Note: This will destroy the session, and not just the session data!
if ( isset( $_COOKIE[session_name()] ) )
setcookie( session_name(), '', time() - 42000, '/' );

This line will never do anything. The session_name is the value of the
cookie, not the name.

That's incorrect. session_name() will return the key (*PHPSESSID* )
which is then used as a key in the $_COOKIE superglobal to point to the
current session id.

http://php.net/session_destroy

You will notice that the code I provided you is directly from the PHP
docs and it is *not* incorrect.

As you can see from the example below, each time I start a new browser
session, I can, in fact, echo out what you suggest to be superfluous.
Perhaps the answer to your problem lies in this simple oversight unless
you have altered the value of "session.use_co okies" in your ini file.

<?php
session_start() ;

if(isset($_COOK IE[session_name()])){
echo $_COOKIE[session_name()];
}
// 72728376dfdd7f3 de60f75111ace5a 6e (first session - browser one)
// 1ce309fbb3bbdd0 d34ed2b73be8cbe 5b (first session - browser two)
?>

My mistake. But I'm not the one having the problem. And this code
doesn't solve his real problem - which is page caching in Firefox.

--
=============== ===
Remove the "x" from my email address
Jerry Stuckle
JDS Computer Training Corp.
js*******@attgl obal.net
=============== ===

[Steve]

| Koncept <<
| "The snake that cannot shed its skin perishes. So do the spirits who are
| prevented from changing their opinions; they cease to be a
pirit." -Nietzsche

so, does this mean the absense of an opinion or the inability to change an
opinion make an apple cease to be an apple?

[Koncept]

In article <11************ *@newsfe06.lga> , Steve <no****@example .com>
wrote:

so, does this mean the absense of an opinion or the inability to change an
opinion make an apple cease to be an apple?

*Assertion* *1*: The absence of opinion makes an apple cease to be an
apple.

*Assertion* *2*: The inability to change opinion makes an apple cease
to be an apple.

*Answer*
If the apple were capable of formulating opinion in the first place,
then to lose such a noble quality would certainly make the apple less
distinguished amongst its peers; however, considering that the apple
never had such talent, it will simply continue to maintain its status
as an object neither capable of opinion, nor of spiritual nature.

Truth be told, I'd still eat it regardless!

Remember ... An • a day keeps the doctor away.

--
Koncept <<
"The snake that cannot shed its skin perishes. So do the spirits who are
prevented from changing their opinions; they cease to be a spirit." -Nietzsche

[Koncept]

In article <Fb************ *************** ***@comcast.com >, Jerry
Stuckle <js*******@attg lobal.netwrote:

My mistake. But I'm not the one having the problem.

And it was my mistake (realized after posting the reply ) that you were
the original author. Sorry 'bout that.

--
Koncept <<
"The snake that cannot shed its skin perishes. So do the spirits who are
prevented from changing their opinions; they cease to be a spirit." -Nietzsche