SESSION lost when submitting form

[Jeigh]

Hello,

I've been testing my site and have ran into a problem, I have a page in which members can make a portfolio, giving other members the ability to rate it, recommend it, favourite it etc.

All my pages the pages have the same structure, all include the same files such as session.php etc. The session works fine until they submit a form, when the form is submitted it logs them out, and as guests can not use these functions it shows them a message saying they need an account to do this.

I'm not exactly sure where to start looking for this, I'd post an example of my code but I don't know what to post and can't really post the whole thing. If anybody needs me to post anything specific up I'll be happy to.

Thanks,
Jeigh

[Atli]

If the sessions are working everywhere else, it is most likely that you simply overlooked something somewhere in your form process code.

Do you use the function session_unset() anywhere in you code?

You could try searching for all instances of the word 'session' in you code and see if there is something that shouldn't be there.

[pbmods]

Heya, Jeigh.

Try adding this to the top of each page:

session_start();
 
// Debug
echo session_id();
 

The value that it outputs should be the same for each page. If it is different, you need to check your session cookie settings in your php.ini file.

[Jeigh]

Sorry for the late reply, I used that and it showed up properly on every page except after I submitted a form on the profile page, which is when it logged me out so the session was lost. There's absolutely nothing that I can see that would get rid of the session, the form is very basic. So slightly confused on this one :P

[ak1dnar]

Better to post the codes here, which the occurs the problem. and then we'll be able to look at it closely.

[Jeigh]

I'm not exactly sure where the problem is occuring but this is the form:

echo "<form action=\"$PHP_SELF?user=$fuser\" method=\"post\">
<input type=\"hidden\" name=\"type\" value=\"$type\" />
<input type=\"hidden\" name=\"fuser\" value=\"$fuser\" />
<input type=\"hidden\" name=\"display\" value=\"$display\" />
<input type=\"hidden\" name=\"rate2\" value=\"$rate\" />
<input type=\"hidden\" name=\"rec\" value=\"$rec\" />
<input type=\"hidden\" name=\"style\" value=\"$style\" />
<input type=\"hidden\" name=\"name\" value=\"$name\" />
<input type=\"hidden\" name=\"favourite\" value=\"1\" />
<input type=\"image\" src=\"images/favourite.gif\" name=\"submit\" value=\"Favourite\" />
</form>";
 

And to process it:

if($_POST['favourite']){
 
$fdate = date('Y-m-d H:i:s', time());
$ffuser = $_POST['fuser'];
$fdisplay = $_POST['display'];
$frate = $_POST['rate2'];
$frec = $_POST['rec'];
$fstyle = $_POST['style'];
$fname = $_POST['name'];
 
$count = "SELECT COUNT(*) FROM favourites WHERE username='$fusername' AND fuser='$ffuser'";
$countq = mysql_query($count);
 
$countq2 = mysql_fetch_row($countq);
 
$countq3 = $countq2[0];
 
if($countq3 >= 1){
echo "You already have this profile in your favourites.";
}
else
{
$query = "INSERT INTO favourites VALUES('', '$fusername', '$fdate', 'profile', 'T', '$ffuser', '$fdisplay', '', '', '', '', '', '', '', '', '', '$frate', '$frec', '$fstyle', '$fname')";
mysql_query($query);
 
echo "This profile has been sucessfully added to your favourites.";
}
}
 

[pbmods]

Heya, Jeigh.

Where do you check to see if the User is logged in?

[ak1dnar]

I didn't see anything related to session in the coding. If you already created this On a previous page try to print the session ids in each and every page.
If there is mismatch on the session id then we can find it.

[Weisbartb]

Are you sending output to the browser (Other then headers) before you trigger a
[PHP]session_start();[/PHP]

[ak1dnar]

session_start();

Ah Is it not there?

[Jeigh]

I have session_start(); right at the top and nothing is sent before that, but I just found somthing odd. It's actually happening just on refreshing the page, not submitting a form. But if I'm viewing my own profile which would be:

/profile.php?user=me

I can refresh without losing the session however ever if it's someone elses which would be:

/profile.php?user=someoneelse

It loses the sesion once it's refreshed.

[pbmods]

Heya, Jeigh.

Let's have a look at profile.php.

[Jeigh]

Sorry for the late reply again, here's some of profile.php, it's very long so I'll take out a lot of the irrelevant code:

 
<?
session_start();
include('include/session.php');
 
$fusername = $_SESSION['username'];
$sendername = $_SESSION['username'];
 
/* Requested Username error checking */
$req_user = trim($_GET['user']);
if(!$req_user || strlen($req_user) == 0 ||
   !eregi("^([0-9a-z])+$", $req_user) ||
   !$database->usernameTaken($req_user)){
   die("Username not registered");
}
 
/* Display requested user information */
$req_user_info = $database->getUserInfo($req_user);
 
include('headeruserinfo.php');
include('navigation.php');
include('content.php');
 
?>
<table cellspacing="10" cellpadding="3" class="profile">
<tr>
<td class="profile">
<?
 
 
 
 
 
/* Logged in user viewing own account */
if(strcmp($session->username,$req_user) == 0){
   echo "<div class=\"profilehead\" align=\"center\"><h3>My Profile</h3></div><img src=\"uploads/photo/" .$userphoto. "\" /><br /><a href=\"changephoto.php?user=$session->username\">Change Display Picture</a>";
}
/* Visitor not viewing own account */
else{
   echo "<div class=\"profilehead\" align=\"center\"><h3>";
   echo $username;
   echo "'s Profile</h3></div>";
   echo "<img src=\"uploads/photo/";
   echo $userphoto; 
   echo " \" />";
}
 
echo "</td>
</tr>
</table>";
 
/* If logged in user viewing own account, give link to edit */
if(strcmp($session->username,$req_user) == 0){
   echo "<br><a href=\"changeprofile.php\">Edit Profile</a><br>";
}
 
/* Link back to main */
echo "<br>Back To <a href=\"index.php\">Index</a><br />";
 
include('endcontent.php');
include('footer.php');
 
?>
 

[MrGamma]

Figures you would stump them after they get a look at the code... What version of php are you using?

There can be serious mis configurations with the server as I am experiencing now... it is hard to convince people that php could be at fault butit happens... perhaps you should ask your server admin to make sure that your php installation is working as expected...

<?php

print(phpinfo());

?>

If it helps I am having serious session problems with php 5.2.5 right now... I can not pin it down to anything with code... it is specific to the server... and perhaps the php distribution itself... it is not a random problem... it is always reproducible in a location... but copy the code to a different folder / location... and your problem may be solved... hope this helps...

[MrGamma]

Make sure your not running php as a cgi ( opposed to an apache module)

and make sure you have no php.ini files over riding the default php.ini...

It took me forever to pinpoint the problem... but that's what broke sessions accross folders for me... hope this helps...

[zabsmarty]

put this code on the top of the page where form is redirect after submit.

 session_start(); 

[Atli]

Hi Jeigh.

Could we see the 'include/session.php' file?
There doesn't seem to be any session code in the profile.php page itself, so the problem could be in the session.php file.

I would also recommend using <?php ?> tags rather than the <? ?> tags, just to avoid any possible problem if you ever switch servers. It's only 3 chars more, and can potentially save a lot of trouble ;)