Why is 'Logged In' information showing when not logged in?

[Justin_Diamond]

Hi there,

I have a problem with my code, Information that should be hidden when not logged in is showing to all users.

This is my head code:

<?

include "options.php";

// Fixes session ID and validation problems

ini_set("arg_separator.output", "&amp;");

ini_set("url_rewriter.tags", "a=href,area=href,frame=src,input=src"); 

// End fix for session ID and validation problems

session_start();

$db=mysql_connect($db_host,$db_user,$db_pass);
mysql_select_db($db_name);

$cities = array();

$result=mysql_query("SELECT city FROM jobs;");

$j=0;
$k=0;

while ($row=mysql_fetch_array($result)) {
  $flag_city=false;
  for ($i=0;$i<sizeof($cities);$i++)
    if ($cities[$i]==$row['city'])
	  $flag_city=true;
  if (!$flag_city)
    $cities[$j++]=$row['city'];
}

if ((isset ($_POST['city']))&&($_POST['city']!="-- choose city --")) {

$categories = array();

$result = mysql_query("SELECT business_category FROM jobs WHERE city = '$_POST[city]';");

while ($row=mysql_fetch_array($result)) {
  $flag_prof=false;
  for ($i=0;$i<sizeof($categories);$i++)
    if ($categories[$i]==$row['business_category'])
	  $flag_prof=true;
  if (!$flag_prof)
    $categories[$k++]=$row['business_category'];
}

$result = mysql_query("SELECT business_sub_cat FROM jobs WHERE city = '$_POST[city]' AND business_category = '$_POST[business_category]';");

$l=0;
while ($row=mysql_fetch_array($result)) {
  $flag_proft=false;
  for ($i=0;$i<sizeof($cats);$i++)
    if ($cats[$i]==$row['business_sub_cat'])
	  $flag_proft=true;
  if (!$flag_proft)
    if ($row['business_sub_cat']!="")
      $cats[$l++]=$row['business_sub_cat'];
}
}

?>

and this is my body code with the code that should not be seen if not logged in:

<?
  if ($_SESSION['loggedIn'])
  print "<p>Welcome back $row[user]</p>";
    print "<p><a href=\"login.php?reason=logOut\">Log Out</a><br /><a href=\"add.php\">Add a new company</a></p>";
?>

Can anyone spot a glaring mistake I sure I have missed? 

Many thanks

[TheDefender]

Where in your code are you physicalls defining the logggedin session variable? I mean, you are checking to see if it is there
"if($_SESSION['loggedIn'])", but where are you setting it?

[AstroTeg]

You didn't post any code that relates to $_SESSION['loggedIn']. You'll need to investigate the value of this variable at various points in your script. You may be accidentally setting it to true somewhere where it shouldn't.

[Justin_Diamond]

Hi there and thanks for your replies.

I have a lgon.php page that has this:

<?php

include "options.php";

session_start();

if ($_POST['action']=="login") {
  if (($_POST['user']=="icko")&&($_POST['pass']=="1234")) {
    header ("Location: [url]http://[/url]$host/directory/add.php");
	$_SESSION['loggedIn']=true;
  }
}

if ($_GET['reason']=='logOut') {
  session_destroy();
  header ("Location: [url]http://[/url]$host");
}

?>

Does this make sense?

Any further help greatly appreciated.

[Justin_Diamond]

Anyone?

Many thanks