PHP Session - Cookie help pls - PHPBuilder Forums

PHP Session - Cookie help pls

vaibhav

Hi,

I have the following code in my index.php

Main purpose: I have a logout routine which works fine, but I wish to kill the session when any user closes the browser window without logging-out.

I believe this can be achieved using cookies in conjunction with sessions.

I wish to incorporate cookies into this page so that the session is killed as soon as the user closes the browser window.

Requesting forum members to help help me with the code.
I tried some combinations but failed!

<?
$db_name = "mydb";
$db_user = "mydbuser";
$db_pass = "mydbuserpass";


session_start();

if($_POST['submit'] == 'Submit') 
{
	$db=mysql_connect ("localhost", $db_user, $db_pass) or die ('Cannot connect to MySQL: ' . mysql_error());
	mysql_select_db ($db_name) or die ("Sorry, database Problems.Please try again.");
	$username = $_POST['username'];
	$query = "select client_name, client_email from login where username = '".$username."' and password= '".$_POST['password']."'";
	$result = mysql_query($query);
	$value = mysql_fetch_array($result);
	$num_rows = mysql_num_rows($result);
	if($num_rows > 0) {
		$_SESSION["client_name"] = $value['client_name'];
		$_SESSION["client_email"] = $value['client_email'];
		header("location:list.php");
	} 
	else 
	{
		echo "<div align='center'><font color='#FF0000' face='Verdana' size='1'>Invalid Username or Password!!</font></div>";
	}
}
?>
<html>
<head>
<title>Login </title>
</head>

<body onLoad="document.forms[0].elements[0].focus()">
<div align="center">
<center>
<br>
<b><font face="Verdana" color="#FF0000" size="4">Login:</font></b>
<form name="login" action="<?php $_SERVER["PHP_SELF"] ?>"  method="post">
  <table border="1" cellpadding="4" cellspacing="4" style="border-collapse: collapse" bordercolor="#F0F0F0" width="293">
    <tr>
      <td width="290" colspan="2" bgcolor="#F0F0F0"><b>
      <font size="2" face="Verdana">Login</font></b></td>
    </tr>
    <tr>
      <td width="88"><b><font size="2" face="Verdana">Username</font></b></td>
      <td width="202"><font face="Verdana">
      <input type="text" name="username" size="20"></font></td>
    </tr>
    <tr>
      <td width="88"><b><font size="2" face="Verdana">Password</font></b></td>
      <td width="202"><font face="Verdana">
      <input type="password" name="password" size="20"></font></td>
    </tr>
    <tr>
      <td width="293" colspan="2" align="center"><input type="submit" value="Submit" name="submit">&nbsp;
      <input type="reset" value="Reset" name="B2"></td>
    </tr>
  </table>
</center>
</div>
</form>
</body>
</html>

devinemke

since there is no reliable way to know when the client has closed their browser i suggest you run a cron every 5 minutes or so to flush out idle sessions

vaibhav

Won't cookies help ??
I believe cookies will help decide if the browser is closed or not.

NogDog

Either server-wide in your php.ini file or locally via .htaccess, set session.use_only_cookies to "1" and session.cookie_lifetime to "0" ("0" means on browser closed). You could also do it per script via calls to ini_set(), but then you need to do it in every applicable script before the call to session_start().

vaibhav

I modified php.ini.

session.use_only_cookies = 1
session.cookie_lifetime = 0
session.auto_start = 0
session.use_cookies = 1

restarted httpd, but still no good.

Any other suggestions pls....

Thx
Vai

scrupul0us

--disregard.... read wrong--

NogDog

When you say "still no good", what is happening that should not happen (or vice versa)?

vaibhav

The problem persists as follows:

I login successfully via index.php (as coded above).
I close the borwser window fully.
I open a new browser and go to list.php
List.php has the following at the top
<?
session_start();
if($_SESSION["client_name"] == ''){
header("location:index.php");
}

I am logged in without asking for username/password.
The session opened by index.php did not die after I closed the browser.
I need the session to be killed when the browser window is closed.
I believe this can happen via cookies (sessions alone cannot do this becuase session is server based).
But I do not know how to implement this.

Any help is deeply appreciated.

Thx
Vai

NogDog

Maybe you need to clear your browser's cookies/cache?

Anyway, I tried a simple test as a sanity check:

.htaccess:

php_flag session.use_only_cookies 1
php_value session.cookie_lifetime 0

test.php

<?php
session_start();
if(empty($_SESSION['logged']))
{
   echo "<p>You were not yet logged in when you accessed this page.</p>";
}
else
{
   echo "<p>You are already logged in.</p>";
}
$_SESSION['logged'] = 1;

This worked fine for me, going back to the first echo message whenever I closed the browser then opened it and reaccessed the test script.