Script question

[Anon]

Hi Guys,
Why wont the script below goto the index.php page if the condition is reached. At the moment it goes to th warning.php page.
Any ideas?

<?
ob_start();
session_start();

if ($userid && $password)
{
// if the user has just tried to log in

$db_conn = mysql_connect('localhost', '', '');
mysql_select_db("psp", $db_conn);
$query = "SELECT * FROM members WHERE login_name='$userid' AND password='$password' AND admin='yes'";
$result = mysql_query($query, $db_conn);
if (mysql_num_rows($result) >0 )
{
// if they are in the database register the user id
$valid_user = $userid;
session_register("valid_user");
$userdata = mysql_fetch_array($result);
}
}

if (session_is_registered("valid_user"))
{
// logged in successfully
if ($userdata['admin'] == "yes")
header ("Location: membership.php");
else
header ("Location: index.php");
}
else
{
if (isset($userid))
{
// if they've tried and failed to log in
header ("Location: warning.php ");
}
else
{
// they have not tried to log in yet or have logged out
header ("Location: warning.php ");

}

}
ob_end_flush();
?>

[Anon]

One guess: the sessions are using cookies, and cookies don't become visible until the next page (sessioning a variable is done when the response is sent back to the server); so until then session_is_registered('valid_user') is still false.

Try this: set a flag $validated to indicate that the user has indeed been validated - do this at the same time as $valida_user=$userid. Then instead of checking to see if the $valid_user variable has been sessioned, you check the value of $validated.

In fact, you could probably get away with replacing if(session_is_registered('valid_user')) with if($valid_user==$userid) - if you can do so depends on the bigger picture.