Session variables

phrenetic

I am trying to perform a basic login to my web site, but am having difficulty in gaining access to session variables.

I have a login HTML file which calls an authentication script (authenticate.php). This script checks the login and password against a mySQL database. If successful it extracts some basic details about the user and then stores them in some session variables.

At the end of the script, I use a Header function to move to another page (home.php) which displays the home screen of the authenticated user.

The home.php file checks to see if valid session variables have been set-up and if not returns to the login page. This prevents people typing in the URL of the home page and getting straight in without logging in.

So, pretty straight forward.

Trouble is, the session variables don't seem to get stored before the home.php file is displayed thus making the session variables inaccessible when the home.php script starts to get processed.

If I press the back key on my browser and resubmit the login form, then everything works as planned - presumably because the session variables have since been saved.

Any ideas how to get round this? What do other people do?

Alistair

yelvington

Here is what I do:

session_start();
session_destroy();

I do this to make sure no stale login data is sitting around.

I then retrieve the user data from the db and assign it to variables. For each variable,

session_register("variablename");

then

header("Location: nextpage.php");

Other than session_destroy, I can't see anything that differs from your description.

Anon

Ensure your using:

session_register("variablename");

or:

session_start()

prior to any HTML output on the page your sending the user to via the header(). That will give the new page access to the session variables set on the previous page.

Excerpt from the manual:

The session support allows you to register arbitrary numbers of variables to be preserved across requests. When a visitor accesses your site, PHP will check automatically (if session.auto_start is set to 1) or on your request (explicitly through session_start() or implicitly through session_register()) whether a specific session id has been sent with the request. If this is the case, the prior saved environment is recreated.

see: http://www.php.net/manual/ref.session.php

for more information.