Sessions Problem

cmccomas

Hey,

I have a script that was written to login to a secure area, but I cannot get the script right that goes at the top of each page that checks to see if a session is valid before loading the page.

This is what someone else recommended, but it doesn't seem to be working and instead of a message from the PHP, I'd just like it to allow the page to be loaded. If a session is not valid, I'd like for it to have a message and show the login page.

<?
session_start();
if ( empty( $first_name ) ) {
?> 
This page requires you to login before it can be viewed. Login  <a href="index.htm">Here</a>.<?
} else {
echo "the pages content when logged in";
} 
?>

I don't want it to show "the page content when logged in", just want the page to be visible.

Anywhere on the page, I should be able to include this to show the person's name, right?

<?
} else { include 'db.php'; echo "Welcome, 
". $_SESSION['first_name'] .""; 
?>

Finally, when the individual add's a news story, I'd like for his name to be inserted into the news database using his name in the session.

So, I assume this would work:

 $result = mysql_query("INSERT INTO newss SET news_date = '$date', news_story = '$city', news_author = '. $_SESSION['first_name'] .'");

Is that right, or am I wrong?

rachel2004

Originally posted by cmccomas ...and instead of a message from the PHP, I'd just like it to allow the page to be loaded. If a session is not valid, I'd like for it to have a message and show the login page.

Then try this:

<?php
session_start();
if (!isset($_SESSION['first_name'])) {
    echo "This page requires you to login before it can be viewed. 
          Login  <a href=\"index.htm\">Here</a>.";
} else {
    $path_to_login = "http://www.mydomain.com/login.php";
    header("Location: ".$path_to_login);
}

Anywhere on the page, I should be able to include this to show the person's name, right?
<?
} else { include 'db.php'; echo "Welcome, 
". $_SESSION['first_name'] .""; 
?>

You have a set of double quotes at the end of your echo statement and I'm not sure what you intended to do there, so try this instead:

<?php
} else { include 'db.php'; 
    echo "Welcome, ". $_SESSION['first_name']; 
?>

So, I assume this would work:

 $result = mysql_query("INSERT INTO newss SET news_date = '$date', news_story = '$city', news_author = '. $_SESSION['first_name'] .'");

Try this instead (it just looks cleaner IMHO):

<?php
$fn = $_SESSION['first_name'];
$result = mysql_query("INSERT INTO newss 
                       SET news_date = '$date', 
                       news_story = '$city', 
                       news_author = '$fn'");
?>

HTH.

cmccomas

thanks rachel. one clarification question:

<?php 
session_start(); 
if (!isset($_SESSION['first_name'])) { 
    echo "This page requires you to login before it can be viewed. 
          Login  <a href=\"index.htm\">Here</a>."; 
} else { 
    $path_to_login = "http://www.mydomain.com/login.php"; 
    header("Location: ".$path_to_login); 
}

Should be:

<?php 
session_start(); 
if (!isset($_SESSION['first_name'])) { 
    echo "This page requires you to login before it can be viewed. 
          Login  <a href=\"index.htm\">Here</a>."; 
} else { 
    $path_to_login = "http://www.mydomain.com/login.php"; 
    header("Location: ".$path_to_login); 
} 
?>
<html>

Right?

rachel2004

I looked at your code too quickly the first time. Thanks for catching my error. This should be closer to what you want:

<?php 
session_start(); 
if (!isset($_SESSION['first_name'])) {    

$path_to_login = "http://www.mydomain.com/login.php"; 
    header("Location: ".$path_to_login); 
}
?>
<html>

I removed the "else" clause because, of course, if the "if" check is false, we're going to continue to the HTML of the page, but if "true" (meaning 'first_name' is a session variable), we'll never see the HTML of the page since we'll have been redirected to the login page. Since we're using the header function, I had to remove the echo message that had originally been in your "if" conditional.