session works only in IE not in firefox

[poopsy]

Hello all,
I am using sessions to authenticate users and to store their information (username n password).

login_pro.php page:

<?php 
session_start();
include("db_connect.php");
 
    $Rs=mysql_query("SELECT Pcc_username,Pcc_password,Pcc_fname,Pcc_lname FROM pcc WHERE Pcc_username='$pcclog' AND Pcc_password='$pccpwd'");
 
    $count=mysql_num_rows($Rs);
 
    if($count==1){
 
 
        $_SESSION['username']=$_POST["txt_plogin"]; 
        $_SESSION['password']=$_POST["txt_pwd"];   
 
        $row=mysql_fetch_array($Rs);
?>
html..
etc
 
 

and in my others pages i check if a session variable exist else i redirect the user to the login page

setup.php page:

<?php
session_start();
 
if ((!$_SESSION['username']) || (!$_SESSION['password'])){
header ('Location: pcclogin.php');
}
?>
html...
etc
 

if the user has not login through the login page, then he will not be able to view the other pages and will be redirected to
pcclogin.php. This works perfectly fine in IE but not in firefox!! I can visit the other pages even if i have not login. I think that in firefox it stores the sessions..sumthing like that..
so what do i need to do to make it work in firefox too??? i have tried using session_register but still it does not work in firefox! plzz help

[eihabisaac]

try using this.. it works fine with me using firefox and IE

<?php 
session_start(); 
 
if (($_SESSION['username']!= null) || ($_SESSION['password']!=null))
{ 
  //do what ever you want
} 
else
{
header ('Location: pcclogin.php'); 
}
?> 
html... 
etc 
 
 

[poopsy]

No it still does not work in firefox, I can still visit the pages even though i have not logged in.
Plzz help! what part is wrong in my code?

[Markus]

I cannot replicate your problem, unfortunately.

Does FF have cookies enabled?

[poopsy]

Yeah cookies are enabled. I found out when i clear data in firefox, it clears authenticated sessions also. I can clear it to make it work each time. But the problem is I am doing this for a project, and it needs to work on any browser. Any idea about how i can implement this in some other way? i.e only members who have logged in can visit some pages and redirect others users to the login page??

[TheServant]

I think the general feeling is there is something wrong with your firefox. Have you tried it on any other browsers? Opera, Chrome, Safari?
You see if the control is from PHP, which it is, if it works on one browser, it is not your PHP, unless you have bad html output from it. Try it on other browsers, and if there are still problems, I suggest reinstalling FF.

[dlite922]

@TheServant
If I may, I have to disagree with Servant this one time only,

I had this same exact issue a few months ago. Funny thing was, all other sites worked fine. i.e FF was handling sessions for bytes, my bank, and all other sites, except my code.

I eventually got it to work, but don't remember what I did off the top of my head, I'll dig it up and post it here, if I find it.

All I know it wasn't any of the typical problems (e.g. sending http_header/data before start of session, etc)

It would be interesting to know if reinstalling FF does actually fix it for you thought. (Remember to disable/uninstall all addons/plugins)





Dan

[TheServant]

@dlite922
Interesting Dan, I hope you can find out what the problem was, because it could be a worth while piece of info if I, or anyone else come by a similar problem. More ideas of things to check is always worth remembering.

[secmazec]

Guys, unfortunately I can't see any problem in any code in here.

Also talking about cookies is irrelevant, I don't see any command working with it.

Fix your browser or replace invalid user :)

No offense, good mood ;)

You can simply test if your session works with this little code:

<?
session_start();
$_SESSION['tester'] = 1;
if(!$_SESSION['tester'])
 echo "session doesnt work";
?>
 

[secmazec]

Oh and I've forgotten, don't forget ! :)

To put session_start(); on top of each page, or @session_start(); to semi-include pages, to suppress exit; or die;

[Markus]

Cookies are required to be enabled because, typically, a programmer will use cookie based sessions. The information is not stored in the cookie, but the session id is. That id is then used to access the information stored at the server. This is why cookies are required, unless you are using a session id in the url, for example.

Also, you should use isset() to check that a variable exists, not only is that the intended use of the function, but what if $_SESSION['tester'] had a value of (int) 0? The if() conditional would read that as false, giving a wrong (but technically right) answer.

Furthermore, instead of using the slow error suppression '@', it would be logical to check the session is set, via something like:

if ( ! isset ( $_SESSION ) ) session_start();
 

Then again, you should have such an understanding of your code and it's 'flow' that you shouldn't need to restart a session that is already present.

- Markus.

[secmazec]

Don't fix what is not broken, please. I respect your oppinion and would be nice to see the same.

PHP is not exact language and there are always many ways to do some things. That's why I love it and I can programme in my own style.