Problems using sessions

[dipperdan]

Hi, I'm trying to use sessions to create a login system to administer a website - add new info to database,etc but i'm running into some problems.

The first page login.php seems to work okay, it authenticates the user then takes them to the next page update_db.php but when i get to this page, it seems all the session data is lost :icon_conf

login.php
[PHP]<?php
session_start() ; // we must never forget to start the session

$errorMessage = ''; // set this blank to check back the value later
if (isset($_POST['txtUserId']) && isset($_POST['txtPassword']))
{
//Include our login information
include_once('d b_login.php');

// Let's show all errors
error_reporting (E_ALL);

// initiate connection to the database
$connection = mysql_connect($ db_host, $db_username, $db_password);
if (!$connection)
die("<strong>Co uld not connect to MySQL: </strong> <br />" . mysql_error());

// select the ecflora database
if (!mysql_select_ db($db_database ))
die ("<strong>Co uld not select the database: </strong> <br />". mysql_error());

$userId = mysql_real_esca pe_string($_POS T['txtUserId']);
$password = mysql_real_esca pe_string($_POS T['txtPassword']);

// check if the user id and password combination exist in database
$sql = "SELECT user_id FROM auth_user WHERE user_id = '".$userId." ' AND user_password = PASSWORD('".$pa ssword."')";

$result = mysql_query($sq l) or die('Query failed. '. mysql_error());

if (mysql_num_rows ($result) == 1) // a returned row indicates the password was valid
{
// the user id and password match, set the session
$_SESSION['db_is_logged_i n'] = true;

// store the username as well, just to be user friendly
$_SESSION['username'] = $userId;

// after login we move to the update page
header('Locatio n: update_db.php') ;
exit; // Make sure that code below does not get executed when we redirect
}
else
$errorMessage = 'Sorry, wrong user id / password';

// free the result set memory
mysql_free_resu lt($result);

//close the connection
mysql_close($co nnection);
}
?>[/PHP]

update_db.php
[PHP]<?php
session_start() ; // we must never forget to start the session

// check if the user is logged in and authorised to view this page
if(!isset($_SES SION['db_is_logged_i n']) || $_SESSION['db_is_logged_i n'] != true)
{
header("Locatio n: login.php"); /* Redirect browser */
exit;
}

$greeting = '';
if(isset($_SESS ION['username']))
$greeting = "Logged in as ". $_SESSION['username']. " (<a href='login.php ' onclick='logout User()'>Logout</a>)";

//Include our login information
include_once('d b_login.php');

// Let's show all errors
error_reporting (E_ALL);

// initiate connection to the database
$connection = mysql_connect($ db_host, $db_username, $db_password);
if (!$connection)
die("<strong>Co uld not connect to MySQL: </strong> <br />" . mysql_error());

// select the ecflora database
if (!mysql_select_ db("ecflora_db" ))
die ("<strong>Co uld not select the database: </strong> <br />". mysql_error());
?>[/PHP]

I tried to print_r the SESSIONS array and it was empty on update_db.php, any ideas what could be wrong?

[ronverdonk]

Works fine here. I ran your code, with some change to the userid/password selection, and it runs without error. I can display the $_SESSION array and it contains all expected value. I would, however, not use true and false but 1 and 0 (but that is not important) and the best test for booleans is not $a!=true, but $a!==true.

So what can be the cause?
Another thing: what is your PHP version?

Ronald

[dipperdan]

ok i'm not sure if this is supposed to happen this way but the session data prints ok when i have it in that php block i posted (which comes before any html headers btw), but what i was doin before was trying to output inside a div, and nothing was printing in the array, i have no idea why that would happen this :(

btw i'm using XAMMP 1.6.6a with PHP version 5.2.5

EDIT: I found out why that was happening...

my logout function

function logoutUser()
    {
        <?php
            // if the user is logged in, unset the session
            //if (isset($_SESSION['db_is_logged_in']))
//            {
//                session_unset() ;
//                session_destroy();
                //unset($_SESSION['db_is_logged_in']);
//            }
        ?>
    }

the $_SESSION['db_is_logged_i n'] was being evaluated true and the session was being destroyed my bad heheheh, how could i do a better/safer logout function though?

[ronverdonk]

sometimes you might have problems even if using both session_unset and session_destroy . You have to clear the $_SESSION array. I got it working this way:

session_unset();
session_destroy();
$_SESSION = array();

This is a user log entry from the php documentation. Maybe it's worth doping this, just to be sure.

Ronald

[dipperdan]

This is a user log entry from the php documentation. Maybe it's worth doping this, just to be sure.

Ronald

ok thanks, that seems to be workin, i modified it a bit so when you click to logout u get sent to login.php?do=lo gout and the session gets destroyed then

[ronverdonk]

Okay. Glad it works for you.

See you around.

Ronald