Sessions and Globals Set to ON

Rulkster

Hi.

I have been coding in php for a few years now but always on a server where the Global Variables has been set to ON. I am now working on a server with the globals set to OFF and having trouble with some of my login scripts.

My initial script works just fine and lets the user login, at this point I set the session variable:

session_register("foo") or die("session started") ;

Now on all my scripts that check for that session, they do not work. I have this:

session_start(); 

if (!$foo) {
echo "
<html>
<head>
<HEAD>
<META HTTP-EQUIV=REFRESH CONTENT=\"0;URL=login.php\">
</HEAD>
";
exit;
} else {
CONTINUE TO DISPLAY PAGE
}

Like I said, with globals set to ON there are no problems with above code, but with them set to OFF, it does not work.

Thanks for any help.

bradgrafelman

You're going to have to update your scripts, because both session_register() and the register_globals directive have long since been deprecated (for very good reasons).

Instead of using $foo, you need to use $POST['foo'] or $GET['foo'] or $_COOKIE['foo'] or ... etc. These new "superglobal arrays" will contain the appropriate data, rather than a new variable being created with the same name. More information about these superglobals can be found here: [man]variables.superglobals[/man].

Also note that using if(!$POST['foo']) when $POST['foo'] doesn't exist causes a warning. You should instead use [man]isset/man or [man]empty/man to check if the variable exists or not.

As for sessions, you should use the new $_SESSION superglobal. It's as easy as creating a new index in this array:

session_start();

// Store data in session:
$_SESSION['name'] = 'Foo Bar';

Rulkster

Thanks for the help, but it is not working.

Lets call my first page login.php (where I am setting the session) and the second page (with the below code) iamloggedin.php

I changed it to this:

iamloggedin.php:

if(!$_POST['foo']) {
echo "
<html>
<head>
<HEAD>
<META HTTP-EQUIV=REFRESH CONTENT=\"0;URL=login.php\">
</HEAD>
";
exit;
}

And now all it does is go back to the login.php page, and then on login.php the session is set so it sends it back to the iamloggedin.php. iamloggedin.php then sends it back to login again ... So it is an infinite loop back and forth between the 2 pages.

bradgrafelman

Show us the complete code in both scripts.

Rulkster

Here is the part the checks to see if username and password are correct and registers the session variable.

if ($userid && $password) {
 	$query = "select * from TABLENAME where email_address='$userid' and password='$password'";
 	$result = mysql_query($query, $db);

	if (mysql_num_rows($result) >0 )  {
		// if they are in the database register the user id
	$FOO = $userid;
		$msglog = "Welcome $FOO<br>";
	session_register("FOO") or die("session started") ;
	} else {
	$msglog = "<font color=red>Username or Password not valid!</font>";
	}

} 

// THEN LOWER IN THE SAME SCRIPT THIS:

if (session_is_registered("FOO"))
  {
echo "
<html>
<head>
<HEAD>
<META HTTP-EQUIV=REFRESH CONTENT=\"0;URL=iamloggedin.php\">
</HEAD>
";
}

iamloggedin.php (change it to make it simple)

session_start(); 

if(!$_POST['FOO']) {
echo "
NOT LOGGED IN
";
} else {
echo "
LOGGED IN
";
}

leatherback

Of course, when you go to the iamloggedin.php page, you have not POST-ed any information (That is reserverd mainly for forms and some other situations, I will not bother you with). You do not want to:

if(!$_POST['FOO']) {

But:

if(!$_SESSION['FOO']) {

If you pass variables through an url you are looking at:

if(!$_GET['FOO']) {

Rulkster

Change it to:

session_start();

if(!$_SESSION['FOO']) {
echo "
NOT LOGGED IN
";
} else {
echo "
LOGGED IN
";
}

And still does not work.

bradgrafelman

Where is $userid and $password ever defined in your script?

Also, you shouldn't be using [man]session_register/man but rather the $_SESSION array as I described above.

Rulkster

$userid and $password are defined in the login.php script. They are coming from a login form and I am posting them properly. The problem is not with these 2 variables as I can run the login.php script just fine and even print the $foo session variable after someone fills out the form.

The problem is when it goes to the second script: iamloggedin.php , the session variable is empty. It existed on login.php and got set because I can echo it to the screen.

Thanks for all your help so far.

Do you think there may be a change I need to make in my php.ini file?

bradgrafelman

Echo out [man]session_id/man on both pages; does it change?

Weedpacket

Rulkster wrote:
$userid and $password are defined in the login.php script. They are coming from a login form and I am posting them properly.

As already pointed out, though, you should update this.

Also, have you fixed

        $FOO = $userid;
            $msglog = "Welcome $FOO<br>";
        session_register("FOO") or die("session started") ;

to use $_SESSION['FOO']? If you still have a mix of old-fashioned and contemporary session handling, you will have trouble.