[Resolved] nightmare with php sessions

[sinbad]

Hi all,
I'm using php 4.3.3 and i'm having a noghtmare getting sessions to work.

I have a login form (username and password)
I use a Mysql table for authentication
The authentication script is:

<?php
session_start();
if ($username && $userpass)
{
$db_conn = mysql_connect("localhost", "databasename", "mypassword") ;
mysql_select_db("users", $db_conn);
$query = "SELECT mainengid, username, userpass, fname, usergroup FROM users
WHERE username = '$username' AND userpass = '$userpass'";

$result = mysql_query($query, $db_conn);
if (mysql_num_rows($result) > 0 )
{
$validuser = $username;

session_register("username", "userpass");
echo "your username is: $validuser";
}
}
else
{
echo "you are not logged on";

}
?>

[weekender]

from the php manual page on [man]session_register[/man]

If you want your script to work regardless of register_globals, you need to instead use the $SESSION array as $SESSION entries are automatically registered. If your script uses session_register(), it will not work in environments where the PHP directive register_globals is disabled.

any host worth their salt will have register_globals disabled, as it is such a security risk, so session_register will not work

instead, you need to register session vars like this

$_SESSION['username'] = $userpass;

hope that helps

adam

[sinbad]

Thanks Adam.

I keep getting this error message
"Warning: mysql_num_rows(): supplied argument is not a valid MySQL result resource in www.mywebsite/etc line 11

<?php
session_start();
if ($username && $userpass)
{
$db_conn = mysql_connect("localhost", "databasename", "password") or die ("can't connect");
mysql_select_db("users", $db_conn);
$query = "SELECT mainengid, username, userpass, fname, usergroup FROM users
WHERE username = '$username' AND userpass = '$userpass'";

$result = mysql_query($query, $db_conn);
if (mysql_num_rows($result) ==1 ) // this is line 11
{
$validuser = $username;

$_SESSION['username'] = $username;

echo "your username is: $validuser";
}
}
else
{
echo "you are not logged on";

}
?>

[weekender]

this error is normally either invalid sql syntax or no results returned - but you are checking for no results, so it is syntax.

try doing an echo $query to see what you are querying

adam

[Weedpacket]

And what do you get from [man]mysql_error[/man]?