Session Problem!!

obrienkev

Hi all,

I have logged in on one page but when I continue onto the next page it says I am not logged in. Why is this?

I put the session code(below) just after the DOCTYPE.

<?php
session_start(); 
?>

Here is my checking code:

// check session variable
  if (isset($HTTP_SESSION_VARS['valid_user']))
  {
   echo '<h1>Logged in</h1><br />';
  }
  else
  { 
   echo '<h1>You are not logged in!</h1>';
   exit;
  }

for some reason the session is not registered when I go to the next page. Why is this?

thanks.

Kevin.

devinemke

Originally posted by obrienkev
I put the session code(below) just after the DOCTYPE.

that may be your problem. [man]session_start[/man] needs to be called before any output is sent to the browser and needs to be called at the top of every page that uses the session vars.

obrienkev

Nope. Didnt make any difference. Any other ideas??

devinemke

Originally posted by obrienkev
Any other ideas??

yes. do a simple test. create 2 blank text files called page1.php and page2.php. on page1.php do this:

<?php
session_start();
$_SESSION['name'] = 'obrienkev';
echo '<a href="page2.php">page2</a>';
?>

then a page2.php:

<?php
session_start();
print_r($_SESSION);
?>

what do you see?

obrienkev

Page 2 comes up: Array ()

devinemke

are sessions enabled in you php.ini?

mrhappiness

on both pages do

echo session_id();

is the id the same on both pages?

does your borswer accept cookies from the very domain you use for testing?
is php allowed to transfer the session-id via cookie?
is php allowed to transfer the session-id by url?

phpinfo();

gives answers to the last two questions, simply post the "session" block

obrienkev

it says:

session support: enabled

Anything else I should look out for?

Session.save_path is set to: C:\WINDOWS\Temp

Is that ok?

mrhappiness

Originally posted by obrienkev
Anything else I should look out for?

the rest of this block 🙂

obrienkev

Any help welcome guys. Still not working for me. Anything to do with where the session variable is stored??

Kevin.

pang

hi
i have the same problem , sessions seem not work , i'm using php4.3.10 under iis on XP pro my settings in phpinfo are:

session.auto_start Off Off
session.bug_compat_42 Off Off
session.bug_compat_warn On On
session.cache_expire 180 180
session.cache_limiter nocache nocache
session.cookie_domain no value no value
session.cookie_lifetime 0 0
session.cookie_path E:/couki E:/couki
session.cookie_secure Off Off
session.entropy_file no value no value
session.entropy_length 0 0
session.gc_divisor 1000 1000
session.gc_maxlifetime 1440 1440
session.gc_probability 1 1
session.name PHPSESSID PHPSESSID
session.referer_check no value no value
session.save_handler files files
session.save_path E:/session E:/session
session.serialize_handler php php
session.use_cookies On On
session.use_only_cookies Off Off
session.use_trans_sid Off Off

when i execute the two page:
page1:

 session_start(); 
$_SESSION['name'] = 'obrienkev'; 

echo session_id();
echo '<a href="page2.php">page2</a>';

page2:

session_start();  

echo session_id();
print_r($_SESSION);

the session_id is different and i get array() from print_r($_SESSION);

so could anyone have any idea, i'm lost!!!

Weedpacket

session.use_cookies On On
session.use_only_cookies Off Off
session.use_trans_sid Off Off

Is your browser accepting cookies? If it isn't, you'll have to either put the session ID into the URL, or turn use_trans_sid on.

obrienkev

Cheers weedpacket.

How do I put the session id into the url??

Would turning on session.use_trans_sid have any major effect on server regards security??

Thanks.

Kevin.

Weedpacket

Originally posted by obrienkev
How do I put the session id into the url??

[man]Session[/man]
Predefined Constants
SID (string)
Constant containing either the session name and session ID in the form of "name=ID" or empty string if session ID was set in an appropriate session cookie.

Printing the SID, like shown above [Example 5], is not necessary if use_trans_sid is enabled.

Would turning on session.use_trans_sid have any major effect on server regards security??

[man]session[/man]
session.use_trans_sid boolean
URL based session management has additional security risks compared to cookie based session management. Users may send a URL that contains an active session ID to their friends by email or users may save a URL that contains a session ID to their bookmarks and access your site with the same session ID always, for example.

obrienkev

I don't understand that. Any simple code that would allow me to do what I need?

Thanks.

Weedpacket

Originally posted by obrienkev
I don't understand that. Any simple code that would allow me to do what I need?

[man]session[/man]
Example 5
<p>
To continue, <a href="nextpage.php?<?php echo strip_tags(SID); ?>">click
here</a>.
</p>
The strip_tags() is used when printing the SID in order to prevent XSS related attacks.