Need Help With Session Code

_PQ3_RogeR

I'm trying to make a session script that will only allow people to load a page if they visted the page with this code on it:

<?php

// Start the session and pass the visitor the ticket
session_start();
$ticket = "admitone";
session_register($_SESSION["ticket"]);

Ok, so someone loads that page and clicks the link. If they tried to visit that link with out first loading the page starting the session they would see a message saying they are illegally linking. Here's the ticket1code.php code:

<?php

// ticket1code.php

session_start();

// Check to see if the visitor has the right ticket
if ( $_SESSION["ticket"] == "admitone" ) {

echo "This script works: $filename "; 

} else {

echo "you are illegally linking";

}

Whenever I run this code, the "you are illegally linking" message always appears even though I visit the page starting the session which I posted at the top of this message.

I would really like to know what I'm doing wrong. I'm using PHP 4.1.1. Any help would be greatly appreciated.

RogeR

douceur

I may be mistaken, but I believe the correct way to do it would be:

$ticket = 'admitone';
session_register('ticket');

ajmoore

The problem is with how you're registering your session variable. You can not use session_register and $SESSION together...that seems to be a common mistake. Which one you need to use depends on how your version of php is configured. If the register globals directive is set to ON you will use session register, if it's off, you'll use $SESSION.

To register a session variable with register globals off:

$_SESSION["variableName"] = "data";

It can then be accessed on subsequent pages with $_SESSION["variableName"].
To register the same variable with register globals on:

$variableName = "data";
session_register("variableName");

hope that explanation helps

_PQ3_RogeR

It works! Thanks ajmoore & douceur.

One other question, to limit the amount of time a certian id can be used I would type:

session.gc_maxlifetime "1440"

correct?

RogeR

_PQ3_RogeR

Why am I getting a mySQL error with this code:

Warning: Supplied argument is not a valid MySQL result resource

<?php 

session_start(); 


$link = mysql_connect( "localhost", "user", "pass" ) or die( "Could not connect to database: " . mysql_error () );
mysql_select_db("downloaddb", $link);
$result = mysql_query("select url, filesize from downloads_downloads where lid=$lid"); 
list($url, $filesize) = mysql_fetch_row($result);
mysql_close( $link );

// Check to see if the visitor has the right ticket 

if ( $_SESSION["ticket"] == "admitone" ) { 

echo "$url";

} else {

echo "Illegally Linking";
} 

?>

douceur

I believe that if no results are returned from the query, then you can't call the mysql_fetch_row() function. Try something like:

if ($result = mysql_query("select url, filesize from downloads_downloads where lid=$lid")) {
  list($url, $filesize) = mysql_fetch_row($result);
}
mysql_close( $link );

Also make sure, though, that $lid exists.

_PQ3_RogeR

ok cool, it works..

Last thing is the session timeout.. I've been reading many pages but I can't figure out what's the easiest way to set a timelimit on a session.

matt_4013

You should be able to use the session_set_cookie_params() function. http://www.php.net/manual/en/function.session-set-cookie-params.php

_PQ3_RogeR

I'm doing that using a ini_set command and it's not working.

ini_set('session.cookie_lifetime', 4);
session_start();
$ticket = 'admitone';
session_register('ticket');

why isn't that working.

_PQ3_RogeR

any1?

douceur

Sorry, I honestly don't know about that...

Z3RatuL

It's not working cause you have session_start() at the second line. session_start MUST always be at line 1 of your script before any other code!

matt_4013

Not true Z3ratul, it can be anywhere in your script, as long as it's before any session variables, or any http output

DangerousDave86

Originally posted by Z3RatuL
It's not working cause you have session_start() at the second line. session_start MUST always be at line 1 of your script before any other code!

That is bull. Anyway use session_set_cookie_params() for the timeout of session cookies

--- Dave

Z3RatuL

ok soz my mistake forgot to mention before any http output.. :/

DangerousDave86

Originally posted by Z3RatuL
ok soz my mistake forgot to mention before any http output.. :/

For me it was the fact u wrote "MUST always be at line 1 of your script before any other code!"
but anyway.. as i said before session_set_cookie_params() sets cookie duration, path, domain and secure attributes for session cookies, thats what should be used

_PQ3_RogeR

I've been reading some posts about doing a session from inside a function and I followed what it said but it's not working:

function download($id) {

session_register('ticket');

global $ticket;
$ticket = "admitone";

if ( $_SESSION["ticket"] == "admitone" ) {

echo "it works"

} else {

echo "no work";

}
}

DangerousDave86

Originally posted by [PQ3]RogeR
I've been reading some posts about doing a session from inside a function and I followed what it said but it's not working:

function download($id) {
session_register('ticket');

global $ticket;
$ticket = "admitone";
if ( $_SESSION["ticket"] == "admitone" ) {

echo "it works"
} else {
echo "no work";

}
} [/B]

Q1) Whats the output?
Q2) Do you have register globals enabled?
Q3) Wheres your session_start()?
- Answer these and I'll be able to help you more.
But basicaly you need to use this on one page

session_start(); // Starts the session
session_set_cookie_params(60); // Sets session cookie timeout to 1 minute
$_SESSION['ticket'] = "admitone"; // sets session variable 'ticket' to 'admitone'

then this on another

session_start(); // Starts the session
if(isset($_SESSION['ticket']) AND $_SESSION['ticket'] == "admitone") {
// ^ Checks to see if session variable 'ticket' is set (stops Notice undefined var errors) and then checks if it is set to 'admitone'
  echo "It Works";
}
else {
  echo "Not Working";
}

hope this helps you out a bit more

--- Dave

_PQ3_RogeR

that code works fine on a normal page, but inside a function it doesn't work.

abnfire

try this:

session_start();
function download($id) { 

session_register('ticket'); 

global $ticket; 
$_SESSION['ticket'] = "admitone"; 

if ($_SESSION["ticket"] == "admitone" ) { 

echo "it works" 


} else { 

echo "no work"; 

} 
}