Session problem

IFR

First of all i made 3 files: login.htm,redirect.php,hhqpics.php

login.htm

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<title>Login</title>
</head>
<body><br><br><br><br>
<center>
<table width="300" cellspacing="1" border="1"><form method="post" action="redirect.php">
<tr><td bgcolor="darkblue"><center><font color="white">Please use your HHQPics username to log in</font></center></td></tr>
<tr><td><center><input type="text" name="member_name"></center></td></tr>
<tr><td><center><input type="submit" value="Log in"></center></td></tr>
</form></table>
</center>
</body>
</html>

redirect.php

<?php
$db = mysql_connect('localhost','user','pass') or die ("connexion error");
mysql_select_db('databasename',$db) or die ("error connection to database");

$res = mysql_query("SELECT * FROM inv_members WHERE name='$member_name'"); 
$exist = mysql_num_rows($res); 

if(!$exist) { 
echo "<center>You must create an account at <a href=http://www.bla.com/>HHQPics</a></center>"; 
header('location: index.php');
} 
else {
//*******************************
//Username exist!
//*******************************
session_start(); 
session_register("member_name"); 
header('location: hhqpics.php');
}
mysql_close() 
?>

hhqpics.php

<?php
session_start(); 
if ( !session_is_registered("member_name") ) { 
//*********************
//not logged in
//*********************
echo "<center>You must create an account at <a href=http://www.bla.com/>HHQPics</a></center>"; 
header('location: index.php');
} 
else { 
include("list.php");
} 
?>

I assume that the mysql part is working fine because i can reach the hhqpics.php page without problems. But once im at the hhqpics.php page it returns the "not logged in" part which means that there's something wrong with the session registration

dalecosp

You might try reversing your logic in the 3rd script. However, I'm not exactly sure what's up. Try this for me??

1.php

<?php

session_start();

$_SESSION['foo']="bar";

echo "<a href=\"2.php\">click here</a>";

?>

2.php

<?php
session_start();

echo "The foovar is ".$_SESSION['foo'];

?>

Do you get "bar" echoed to the browser?

IFR

this is what i get after i clicked on "click here"


Warning: Cannot send session cache limiter - headers already sent (output started at e:\www\pass\2.php:1) in e:\www\pass\2.php on line 2
The foovar is bar

dalecosp

You most likely have introduced a hidden space or newline, perhaps by cut/pasting the code off of the forum.

It seems that sessions are working, so it might well be the logic, as I mentioned.

<html>
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
    <title>Login</title>
    </head>
    <body><br><br><br><br>
    <center>
    <table width="300" cellspacing="1" border="1"><form method="post" action="redirect.php">
    <tr><td bgcolor="darkblue"><center><font color="white">Please use your HHQPics username to log in</font></center></td></tr>
    <tr><td><center><input type="text" name="member_name"></center></td></tr>
    <tr><td><center><input type="submit" value="Log in"></center></td></tr>
    </form></table>
    </center>
    </body>
    </html>



//redirect.php

  <?php
$db = mysql_connect('localhost','user','pass') or die ("connexion error");
mysql_select_db('databasename',$db) or die ("error connection to database");

$res = mysql_query("SELECT * FROM inv_members WHERE name='$member_name'"); 
$exist = mysql_num_rows($res); 

if(!$exist) { 
echo "<center>You must create an account at <a href=http://www.bla.com/>HHQPics</a></center>"; 
header('location: index.php');
} 
else {
//*******************************
//Username exist!
//*******************************
session_start(); 
$_SESSION['member_name']=$member_name; 
header('location: hhqpics.php');
}
mysql_close() 
?>

//hhqpics.php

<?php
session_start(); 
if (!$_SESSION['member_name']) { 
//*********************
//not logged in
//*********************
   header('location: index.php');  //BTW, you can't print before a header() call....
    } 
    else { 
    include("list.php");
    } 
    ?>

Maybe that'll do?

IFR

awww it works on my home server but not on my webhost(IIS)
i still have the same problem

dalecosp

Hmm, something's not right on the web host, then.

Does it do sessions via "use_only_cookies"? Or is it set for "transparent" session support?

IFR

i dont know
how can i check that ?

LordShryku

Check phpinfo()

IFR

Session Support enabled

Registered save handlers files user

Directive / Local Value / Master Value

session.auto_start Off Off
session.bug_compat_42 On On
session.bug_compat_warn On On
session.cache_expire 180 180
session.cache_limiter nocache nocache
session.cookie_domain no value no value
session.cookie_lifetime 0 0
session.cookie_path / /
session.cookie_secure Off Off
session.entropy_file no value no value
session.entropy_length 0 0
session.gc_divisor 100 100
session.gc_maxlifetime 1440 1440
session.gc_probability 1 1
session.name PHPSESSID PHPSESSID
session.referer_check no value no value
session.save_handler files files
session.save_path C:\PHP\sessiondata C:\PHP\sessiondata
session.serialize_handler php php
session.use_cookies On On
session.use_only_cookies Off Off
session.use_trans_sid Off Off

dalecosp

Are you blocking cookies in your browser?

If transparent support is "off", and you're blocking cookies, you'd have to write SESSID handling routines into every script.....

IFR

hmm.. how and where do you put that ?😕

dalecosp

You really don't want to.

I'd either accept a cookie from that domain, or get the server to add transparent support.

Otherwise, it's a major PITA....

Any link to any page on which you intent to call session_start() would have to be altered to append the session id to the query string for that URI. IOW ....

//logincheck.php --- the login handler page:

<?php

if ($user=="bob" && $pw=="bob's pw") {
   session_start();
   $_SESSION['auth_user']="bob";
   $sessid=session_id();
   header("Location: members.php?sid=$sessid");
}
?>

//and then, on members.php

<?php
$sid=striptags($_GET['sid']); // striptags for security
            //possible you'd want other stuff as well...
session_name($sid);
session_start();
echo "Welcome to our site, ".$_SESSION['auth_user'];
?>

... or something like that....

I don't think you wanna do that on every page unless you just have to....

IFR

hmmm so i have to turn session.use_trans_sid to on right ?

dalecosp

Worth a shot.

You never answered the "blocking cookies?" question...

nagasea

I have this kind of problem too last time.
you can fixed it by put the

session_start();

right after starting the php

<?php
session_start();

IFR

where can i find if im blockiong cookies or not ?

also i have invision board running fine on the server and i know it uses sessions