[RESOLVED] Session problems

djwinder

Hi all,

I am trying to use sessions to authenticate users for my site. I have bits of code below these are the functions for logging in. The login completes successfully and if i echo the $session variables straight after logging in they are set. I am having a problem however as when trying to confirm if someone is logged in on another page constantly see that they are not. when i try and echo the $session variables on this page i get an Undefined index error for each of them. Can anyone understand why this might be happening?

function member_login($username, $password)
{
     // Try and get the salt from the database using the username
     $query = "SELECT salt FROM members WHERE username='$username' limit 1";   //changed user to member removed limit 1    

     $result = mysql_query($query);
     $member = mysql_fetch_array($result);  //changed user to member

 // Using the salt, encrypt the given password to see if it 
 // matches the one in the database
 $encrypted_pass = md5(md5($password).$member['salt']);

 // Try and get the user using the username & encrypted pass
 $query = "select memid, username from members where username='$username' and pass='$encrypted_pass'";
 $result = mysql_query($query);
 $member = mysql_fetch_array($result);
 $numrows = mysql_num_rows($result);

 // Now encrypt the data to be stored in the session
 $encrypted_id = md5($member['memid']);
 $encrypted_name = md5($member['username']);

 // Store the data in the session
 $_SESSION['userid'] = $member['memid'];             
 $_SESSION['username'] = $username;
 $_SESSION['encrypted_id'] = $encrypted_id;
 $_SESSION['encrypted_name'] = $encrypted_name;


if ($numrows == 1)
{
    return 'Correct';
}
else
{
    return false;
}
}


function is_authed()
{
     // Check if the encrypted username is the same
     // as the unencrypted one, if it is, it hasn't been changed
     if (isset($_SESSION['username']) && (md5($_SESSION['username']) == $_SESSION['encrypted_name']))
     {
          return true;
     }
     else
     {
          return false;
     }
}

dagon

you need session_start() at the start of any page you want to check user is authenticated

djwinder

Thanks for the reply. I have used session_start() at the begining of the pages already, the error messages given is not that the $session is unknown but the the variable that i created in session i.e $_session['userid'] so the error is unidentified index userid. does this shed any light on it?

dagon

print_r($_SESSION); -note its upercase SESSION

Weedpacket

Just a question:

     // Check if the encrypted username is the same
     // as the unencrypted one, if it is, it hasn't been changed
     if (isset($_SESSION['username']) && (md5($_SESSION['username']) == $_SESSION['encrypted_name']))

How could the username change without the encrypted_name changing as well? Is there somewhere else where you're setting $_SESSION['username'], without setting $_SESSION['encrypted_name'] to match?

djwinder

the print_r($SESSION);

when i execute this on the login page i get :Array ( [userid] => 1 [username] => testuser [encrypted_id] => c4ca4238a0b923820dcc509a6f75849b [encrypted_name] => 5d9c68c6c50ed3d02a2fcf54f63993b6 )

this shows that variables are being set into the session.

however when i try it on a second page which does have session_start(); at the top its outputs array()

so for some reason the session is empty when i navigate to a second page.

djwinder

Hi all, after a lot of research on other sites i resolved the issue using by adding session_write_close(); to the functions where the session was set. this prevents the values written to the session being lost when moving from page to page. Hopefully this will be of help to people in a similar situation.