help with login script - sessions

[adammc]

Hi folks,

I am having trouble with my login script 🙁
I am trying to get the script to extract the state for each member as they login and store it in the session with the username.

I have tried echoing the state variable and the session variable (state) with no result.

$conn = @mysql_connect("localhost","user","pass") or die("Err:Conn");
$rs = @mysql_select_db("database",$conn) or die("Err:Db");

  $sql = "select * from members where username='" . mysql_real_escape_string($username) . "' and password = '" . mysql_real_escape_string($password) . "'"; 
  $sql_result = mysql_query($sql, $conn) or die(mysql_error()); 
  if (mysql_num_rows($sql_result) > 0) { 

 $state = $row["state"];


$_SESSION['loggedIn'] = 1; 
$_SESSION['username'] = $_POST['username']; 
$_SESSION['state'] = $row["state"]; 

mysql_close($conn); 
header("Location: our-products.php?state=$state");
exit(); 

  } else { 

header("Location: login.html"); 
exit();  
  } 
} 

Any help would be GREATLY appreciated 🙂

[Rodney_H_]

This may be obvious, but are you are being sure to start the session prior to any other ouput on the page with the session_start() function?

<?php
// start session
session_start();

$conn = @mysql_connect("localhost","user","pass") or die("Err: Conn");

$rs = @mysql_select_db("database",$conn) or die("Err: Db");

$sql = "SELECT `state`
		FROM `members` 
		WHERE `username` ='" . mysql_real_escape_string($username) . "' 
		AND `password` = '" . mysql_real_escape_string($password) . "'
		LIMIT 1";

$sql_result = mysql_query($sql, $conn) or die(mysql_error());

// valid login
if(mysql_num_rows($sql_result) == 1) 
{
	$_SESSION['loggedIn'] = 1;
    $_SESSION['username'] = $username;
    $_SESSION['state'] = $row["state"];

header("Location: http://domain.com/our-products.php?state=" . $row["state"]);
exit();
} 

// invalid
else {
    header("Location: http://domain.com/login.html");
    exit();
}

mysql_close($conn);
?>

/ off topic: Be sure to use absolute address/path for the header - Location function call /