Sessions Not Working (Not staying logged in)

Radon3k

I'm having a problem with my sessions. If I switch to another page, I'm logged out. I don't understand why either. It could have something to do with the fact that All the pages are requring another page for the menu (so that way if I have to update something on the menu, I don't have to update every page, just one). Here is the code for the menu page which also contains the login code as well as the session information. The other pages just have session_start(); as the first line on every page.

<?php
session_start();
require_once("db.php");
if(!isset($_POST['uname']) AND !isset($_POST['passwd']))
{
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>The Film Reel</title>
<link rel="stylesheet" href="style.css" type="text/css" />
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
</head>
<body bgcolor="#F3F3F3">

<div class="banner">
<img src="/images/filmreellogo.gif" />
</div>
<br />
<div class="left">
<div class="menuheader">Navigation</div>
<div class="lefttext">
<a href="index.php">Home</a><br />
<a href="reviews.php">Reviews</a><br />
<a href="register.php">Register</a><br />
<a href="search.php">Search</a><br />
<a href="#">Forums</a><br />
<a href="#">FAQ</a><br />
<a href="contact.php">Contact</a><br /><br />
</div>

<div class="menuheader">Links</div>
<div class="lefttext">
<a href="http://www.imdb.com" target="_blank">Internet Movie Database</a><br /><br />
<a href="http://impawards.com" target="_blank">Internet Movie Poster Awards</a><br /><br />
</div>


<div class="menuheader">Statistics</div>
<div class="lefttext">
<?php
require("stats.php");
?>
<b>Reviews listed:</b> <br />
<?php
echo($row['total']);
?>
<br /><br />
<b>Newest Reviews:</b> <br />
<?php
newestReview();
?>
<br /><br />
<form name="loginform" method="post" action="<?$PHP_SELF?>">
<?php
    echo("You are not logged in!<br /><br />");
    echo("Username:<br />");
    echo("<input type='text' name='uname'><br />");
    echo("Password:<br />");
    echo("<input type='password' name='passwd'><br />");
    echo("<input type='submit' name='submit' value='Login'><br /><br />");
    echo("Click <a href='register.php'><u>here</u></a> to register!<br /><br />");
} else {
    ?>
<div class="banner">
<img src="/images/filmreellogo.gif" />
</div>
<br />
<div class="left">
<div class="menuheader">Navigation</div>
<div class="lefttext">
<a href="index.php">Home</a><br />
<a href="reviews.php">Reviews</a><br />
<a href="register.php">Register</a><br />
<a href="search.php">Search</a><br />
<a href="#">Forums</a><br />
<a href="#">FAQ</a><br />
<a href="contact.php">Contact</a><br /><br />
</div>

<div class="menuheader">Links</div>
<div class="lefttext">
<a href="http://www.imdb.com" target="_blank">Internet Movie Database</a><br /><br />
<a href="http://impawards.com" target="_blank">Internet Movie Poster Awards</a><br /><br />
</div>


<div class="menuheader">Statistics</div>
<div class="lefttext">
<?php
require("stats.php");
?>
<b>Reviews listed:</b> <br />
<?php
echo($row['total']);
?>
<br /><br />
<b>Newest Reviews:</b> <br />
<?php
newestReview();
?>
<br /><br />
<?php
if($_POST['submit'] == "Login")
{
    $login = mysql_query("SELECT * FROM users WHERE `username` = '{$_POST['uname']}' AND `password` = '".md5($_POST['passwd'])."'") or     die(mysql_error());
    $num = mysql_num_rows($login);
    if(empty($num))
    {
        ?>
    <font color="#FF0000">Login failed!</font>
    <?php
    } else {
        $uname = $_POST['uname'];
        $passwd = $_POST['passwd'];
        $_SESSION['uname'] == $uname;
        $_SESSION['passwd'] = $passwd;
        $row = mysql_fetch_array($login) or die(mysql_error());
        $id = $row['id'];
        $_SESSION['id'] == $id;
    }
}

?>
</div>

<div class="menuheader">My Controls</div>
<div class="lefttext">
<a href="#">My Profile</a><br />
<a href="logout.php?action=logout">Logout</a><br />
<?php
}
?>
</div>
</div>
</div>

Any help? Thanks! 🙂

poisa

Have you tried something EXTREMELY simple, like 2 pages that use sessions with no other code or HTML?
If this works maybe there is some other problem you are overlooking. I'm thinking something very simple along these lines:

<?
// First page
session_start();
$_SESSION['test'] = 'hello world';
?>
<a href="second_page.php">Second Page</a>

<?
// Second Page
session_start();
echo $_SESSION['test'];
?>

I'm actually working on a project that uses sessions and loads the menu from another PHP file so I'm pretty sure that that is not the issue.

Radon3k

Yes, I have this running on another site (though the other site does not have a page loading a menu that is another page). This is the page I'm talking about. If you login using "test" (without quotes) as both username and password it will log you in but if you click on another page (such as "Contact") it doesn't keep you logged in.

poisa

Could you post contact.php so we can have a look at it?

Radon3k

Sure, here you go:

<?php
session_start();
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>The Film Reel</title>
<link rel="stylesheet" href="style.css" type="text/css" />
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
</head>
<body bgcolor="#F3F3F3">

<?php
require("leftnav.php");
?>

<div class="contact">
<form method="post" action="<?$PHP_SELF?>" name="contact">
<br />
&nbsp;&nbsp;Name: <br />
&nbsp;&nbsp;<input type="text" name="name" size="30" class="addreviewinputs" /><br />
&nbsp;&nbsp;Email: <br />
&nbsp;&nbsp;<input type="text" name="email" size="30" class="addreviewinputs" /><br /><br />
&nbsp;&nbsp;Subject:<br /> 
&nbsp;&nbsp;<select name="subject" class="addreviewinputs">
			<option>General Comment/Complaint</option>
			<option>Feature Request</option>
			<option>Bug Report</option>
			<option>Question</option>
			<option>Other</option>
			</select><br /><br /><br />
&nbsp;&nbsp;Message: <br />
&nbsp;&nbsp;<textarea name="message" rows="10" cols="45" class="addreviewinputs"></textarea> <br /><br />
&nbsp;&nbsp;<input type="submit" name="submit" value="Send" />
</form><br /><br />
<?php

$to = "email@emailaddy.com";
$from = "From: $name <$email>";
$email = $_POST['email'];
$name = $_POST['name'];
$subject = $_POST['subject'];
$message = $_POST['message'];

if($_POST['submit'] == "Send")
{
	if(empty($name) OR empty($email) OR empty($message))
	{
		echo("&nbsp;&nbsp;<font color='#FF0000'>All fields are required. Please go back and fill them in.</font>");
	} else {
		if(mail($to, $subject, $message, $from))
		{
			echo("&nbsp;&nbsp;<font color='#EA8328'><b>Mail has been sent. Thank you!</b></font>");
		} else {
			echo("&nbsp;&nbsp;There was a problem while trying to send your mail. Please try again later.");
		}
	}
}

?>
</div>

<?php
include("footer.inc");
?>
</body>
</html>

I didn't include anything about being logged in because that is taken care of in the nav menu file. Thanks! 🙂

poisa

Well, just one more request: :queasy: Can you post leftnav.php?

poisa

Wait a sec... I just found this inside your code:

$_SESSION['uname'] == $uname; 
$_SESSION['passwd'] = $passwd; 
$row = mysql_fetch_array($login) or die(mysql_error()); 
$id = $row['id']; 
$_SESSION['id'] == $id;

You have == where you should have =

Radon3k

Oops, that's just a careless error on my part! Thanks! However, after updating that bit it still isn't keeping me logged in. I should have specified earlier, but the code in my first post is leftnav.php. What else could I be doing wrong? Thanks. 🙂

poisa

The problem is that you are setting the $_SESSION variables but you are never actually checking if they are set...

You only check for a login if the user pressed a submit button.

You wil need something like:

if (isset($_SESSION['uname'])) {
    // The user is logged in otherwise this SESSION var wouldn't exist
}

See?

Radon3k

I didn't put that because what do I do if it's not set? I specifically didn't put that in there because it should be checking it in leftnav.php itself though I do see your point of checking it on those pages as well.

Also, one of the other problems I'm having is that if you hit the login button, regardless of what you enter, it shows the new links and it should only show that if it's correct. Any ideas on that? Thanks for your help! 🙂

poisa

I think you need to tighten up the logic on your code...

For example, one block of code should deal with the form submission:

if user submitted the form {
    // Deal with input and set for example $_SESSION['validUser']
}

The previous block only deals with validating a user and NOTHING else.

On another part of your code you can have:

if (isset($_SESSION['validUser'])) {
   // Show premium content or whatever you want registered users to be able to see
}

This is much simpler and saves the brain damage for the tough parts.

Radon3k

Thanks, I managed to tighten up the code a bit more and now it looks a lot better and is a lot easier to read. However I'm still having issues with not being logged in on other pages. I don't understand why it's not working. It shouldn't matter whether or not the session variables are passed onto the main page or not because they are already stored in a session variable on the leftnav.php page. I think I'm not understanding something here. 😕

poisa

The thing is that technically you are using sessions, but practically you are not.

Show me the part of the code that you are using to check if a user is logged in using $_SESSION vars.

This will definitely make things clearer, you'll see.

Radon3k

Well, the code is this:

if(!isset($_POST['uname']) AND !isset($_POST['passwd']))
{
       // The login form goes here
} else {
      // The logged in information goes here
}

poisa

There, you see? You are checking for variables that come via $POST which are completely different than $SESSION variables.

$SESSION variables are not "submitted" on every page. They are available as long as you start a session in every page.
$POST vars (and $_GET vars too) are submitted to a page via headers and the URL, respectively.

So when you do:

if(!isset($_POST['uname']) AND !isset($_POST['passwd']))

you are simply checking to see if the user submitted something via $POST. This has absolutely nothing to do with $SESSION variables at all.

You need to read more on SESSION vars and it will all become clearer. Re read also my previous post on the logic you need to follow. I pretty much gave you the code (or pseudo-code) you will end up using if you want to make this work.

chyan

or.. maybe you should check your PHP.INI in 'session save path'
where are you save the session data , maybe your session data is lost because you haven't set the location to save the session

Radon3k

Ah, I can't believe I missed that mistake the entire time. I kept using $POST instead of $SESSION. That's keeping me logged in, for the most part anyway. I can go to other pages and I'm still logged in but it's not remembering the username that I put into the $_SESSION variable. I figured that (as I said before) all I would need is session_start() at the top of each page and that would be good enough because it's leftnav.php that's keeping track of the variables. Also, if I type the username and password and hit login, it doesn't work. If I do it a second time, it works then. Is there some sort of a default timeout with session variables? Thank you for your help in this, these are stupid mistakes that I should have picked up on myself! 🙂

Edit: @, I'm on a shared server, can I still check this somehow? Or would it be in phpinfo()? Thanks. 🙂

poisa

chyan, even thou what you pointed out could be the problem, I doubt it. The odds of a server admin screwing that setting up (which is ok by default) are pretty slim.

Radon3k, I'm going to insist that the logic in your code is wrong. I'm attaching an example I just created (and tested) from scratch.

It works around 3 pages.
1) Main menu page that handles login/logout and links to another page
2) Dummy page that does nothing but start a session and require() another file
3) Included file that dumps the contents of the session vars

It's a little bit messy because I did it in a few minutes, but you will get the hang of it.

Radon3k

Thanks poisa! I believe I figured out what I was doing wrong. It seems to be working now with the exception that I still have to login twice in order to actually log in. 😕

Thanks for taking the time to help me out with this, it's greatly appreciated! 🙂

poisa

No problem... feel free to post the new code so we can get it straight.

If you have to login twice then the problem is most likely that you are checking to see if the user is logged in after checking to see if you need to display the "premium content".

Reverse thos chunks of code and it should work.