[Resolved] it looks like my session variables are not passing

jasonmills58

So you log in on one page, and it takes you to the viewClients page. The login works, and takes you to viewClients, but viewClients is not recognizing my login. What have I missed?

session_start();
$secret_word = "spinach";
if ( validate ( $_REQUEST['username'], $_REQUEST['password'] ) ) {
	$_SESSION['login'] = $_REQUEST['username'].','.md5( $_REQUEST['username'].$secret_word );
	header( "Location: viewClients.php" );
} else {
	print "Get lost...";
}

viewClients.php:

unset ( $username );
if ( $_SESSION['login'] ) {
	list ( $c_username, $cookie_hash ) = explode( ',', $_SESSION['login'] );
	if ( md5( $c_username.$secret_word ) == $cookie_hash ) {
		$username = $c_username;
		print $username;
	} else {
		header ( "Location: index.php" );
	}
} else {
	header ( "Location: index.php" );
}

thanks!

jasonmills58

ok, i did a little testing, and I know $_SESSION['login'] is showing up to viewClients.php with no pants, er, value. Its turning up empty... but why?

weevil

Do you have a session_start on viewClients.php?

jasonmills58

No. Does that have to be on every page that should be login protected?

leatherback

It should be on every page in hte whole project, if you use sessions..
Once there is a page without session_start() the session is lost, and so are all the var's in it.

Shawazi

why yes it does :-D im assuming all your login pages have the same layout? an easy way to save time typing it out repeatedly is to use include and have the include file have the line session_start();

#indexbegin.php
<?
session_start();
?>
<html>
<body>
<table>
<tr>
<td>

#indexend.php
</td>
</tr>
</table>
</body>
</html>

#index.php

<? include("indexbegin.php"); ?>
The Text
<? include("indexend.php"); ?>

Doing this from the start lets you change something on all the pages at once - most importantly when you wanna add a link to one page or a session thing or whatever

jasonmills58

thank you.

i added session_start(), [edit] and the "if ( md5(" line is coming up bad. i ran a test and its returning that "else".

viewClients.php

session_start();
unset ( $username );
if ( $_SESSION['login'] ) {
	list ( $c_username, $cookie_hash ) = explode( ',', $_SESSION['login'] );
	if ( md5( $c_username.$secret_word ) == $cookie_hash ) {
		$username = $c_username;
		print $username;
	} else {
		header ( "Location: index.php" );
	}
} else {
	header ( "Location: index.php" );
}

Shawazi

What is that part trying to do? I never use hashes 0.o

jasonmills58

just checking for a valid session. have i gone about this in the wrong way? I have a habit of making things more complicated than they need to be...:rolleyes:

Shawazi

All I do for sessions is session_start() and then
session_register('variable')
register only needs to be on one page. i dont do any checks for the session. do you wanna make sure the user is logged in? i do something simple. i make a variable no one can guess equal to yes.

$atxp9 = yes

then on all pages where i want to i have session_start() and then

if ($atxp9 != "yes")
{
  // do whatever header or message saying you cant go on
  exit();
}

jasonmills58

now i can't stop the variable from being set. even if you come to it from another site or restart the browser...

session_start();
unset ( $username );
if ( isset ( $_SESSION['login'] ) ) {
	//list ( $c_username, $cookie_hash ) = explode( ',', $_SESSION['login'] );
	//if ( md5( $c_username.$secret_word ) == $cookie_hash ) {
		//$username = $c_username;
		print $username;
	//} else {
		//header ( "Location: index.php" );
	//}
} else {
	header ( "Location: index.php" );
}

whats happening?

jasonmills58

ok, sorry, looks like it just won't reset until ALL browser windows are closed. is there a way to get it to kill the session when the user navigates away and/or just closes that browser window?

[edit] I have discovered session_register and session_unregister. yay me. [/edit]