sessions and protecting page

pang

i'm trying to protect a web page: Member_page.php whith a login and a password using sessions, but if we just log off and press the precedent buttom i can have access to Member_page.php, so it's just like i'm having no protection, here are my files:

index1.htm:

<form action="verif.php" method="post">
Votre login : <input type="text" name="login">
<br />
Votre mot de passé : <input type="text" name="pwd"><br />
<input type="submit" value="Connexion">
</form>

verif.php

$login_sql ="toto"; 
$password_sql ="toto"; 

if (($_POST['login']=="toto") && ($_POST['pwd']=="toto")){
session_start();
session_register("login");
session_register("pwd");




header('location:Member_page.php'); }
else { echo "Erreur d'identification, veuillez entrez un login et un mot de passe valide !"; // Sinon l'identification n'est pas réussite
       include("index1.htm");
	   }
?>

Member_page.php

session_start(); 

if ((isset($_SESSION["login"])) && (isset($_SESSION["pwd"]))) {

echo "Bienvenue sur l'espace membre !";
header('location: main_menu.html'); 
echo "<a href=logout.php> Vous déconnectez ?!</a><br>"; }
else{
echo "Erreur : vous devez vous identifiez pour avoir accès à cette espace !"; 
include("index1.htm");

}

So how can i deal with this, thanks in advance

Kudose

Originally posted by pang
but if we just log off and press the precedent buttom i can have access to Member_page.php

You need to stop caching and set the page to expire the moment it loads.

Do this using the [man]header[/man] function. There are examples on how to do this on the function's page.

Drakla

when you log off are you also using session_destroy? It will actually delete the session file on the disk.

session_register has also been deprecated, just set values with $_SESSION['somevalue'] = 'foo';

And in your member page you're echoing, then doing a header location - which is wrong, as all headers have to be sent before any output, only if you're output buffering should you do this. Plus always put an exit after header locations, or use like

die( header('location: somewhere.php') );

To stop the code continuing execution.

phpprogrammer

Dear friend,

memberpage.php

<?php

session_start();

if (!isset($SESSION["login"])||!isset($SESSION["pwd"]))
{

header("Location: login.php");

}
else
{

echo "Bienvenue sur l'espace membre !";
header('location: main_menu.html');

echo "<a href=logout.php> Vous déconnectez ?!</a><br>"; }
else{
echo "Erreur : vous devez vous identifiez pour avoir accès à cette espace !";

include("index1.htm");

}

regards,
bvsureshbabu