Session variable is not getting saved.

[resullivan]

So I have done sessions before and never had problems with them. For some reason the session variable 'login' is not being passed to the next page. Any suggestions?

<?php
session_start();
if (isset($_GET['user'])) {
    include 'yyy.php';
    if ($_GET['user'] == $username && $_GET['password'] == $password) {
        $_SESSION['login'] = 'a';
    } else {
        echo 'ERROR: Username/Password combination incorrect.<br><br>';
    }
}
if (!isset($_SESSION['login'])) {
print '<form name="input" action="#" method="get">
    Username: 
    <input type="text" name="user">
    <br>
    Password: 
    <input type="password" name="password">
    <input type="submit" value="Submit">
    </form>
    ';
} elseif ($_SESSION['login'] == 'a') {
    if ($_GET['page'] == 'logout') {
        unset($_SESSION['login']);
        include 'main.php';
    } else {
        $file = $_GET['page'] . ".php";
        if ($file == ".php") { $file = "main.php"; }
        include $file;
    }
}
?>
 

[pbmods]

Changed thread title to better describe the problem.

[adamalton]

Is the code you've put there the code of just the first page, or it that both pages one after the other? If it's just the first page, can we see the second one?

[kovik]

So I have done sessions before and never had problems with them. For some reason the session variable 'login' is not being passed to the next page.

Are you sure the variable is being created? On the second page, print_r($_SESSION);

Any suggestions?

Yes, a HUGE one. Do NOT -- I repeat, DO NOT -- send a password through the GET method! The POST method is vulnerable enough, but to use the GET method not only leaves the password as vulnerable server-side as POST, but displays the user's password *to their screen*! Browsers don't hide password fields for fun. What if you were at an ATM machine, inputted your PIN, and then the screen had your PIN printed up top the entire time, as people are behind you in line? That's basically what you are doing to your users.

Also, don't blindly include files from the URL like that. I could set the page variable in the URI to whatever page on the entire internet that I want to, and your page would accept it as it's own. Sound safe?