Why does my session drop ?

habbardone

Hi,

My code used to work fine - but for some reason my session is not
getting passed on, and I can not see why

The site is live at expert-world.com

For testing I have echo'ed up the session variables
If you log in you see them - you can use
User ID: joh273
password : pass003

After logging in you will see:

THIS IS MEM-HEAD

auth = yes
expert = joh273
contact = John Simmons
type = E
pub = n
etc.

So the seesion is running OK here

Then hitting CONTROL PANEL:

I just get:

THIS IS MEM-CONTROL

again the session variables should be displayed
but there aren't any

You'll just see "THIS IS MEM-CONTROL"

The code for mem_control.php is:

<?php  

/*  mem_control.php 
*  

*    m - Member Control Page  

*  

*/ 
@session_start(); 

echo "<br>THIS IS MEM-CONTROL<BR>"; 
foreach($_SESSION as $key=>$value)  

{  

echo "<br>".$key." = ".$value."<br>";  

} 
exit;

So I should get the session variables.

I can NOT see why the session is getting terminated.

I am using Opera 11.00
Maybe it works in other browsers - what do you see ?

Please note that the url "internet-marketing-guru-expert-control.html"
is converted to by the .htaccess to "mem_control.php".

From .htaccess

MEMBERS MENU BAR

RewriteRule ^{internet-marketing-online-money-guru-expert.html$} mem_start1.php [NC,L]
RewriteRule ^{internet-marketing-software-tools.html$} list_tools.php [NC,L]
RewriteRule ^{internet-marketing-tutorials-tutes.html$} list_tutes.php [NC,L]
RewriteRule ^{internet-marketing-guru-expert-control.html$} mem_control.php [NC,L]

Thanks for helping.

bradgrafelman

Can you show us the code where you process the login info and create the session?

EDIT: Also, remove all '@' error suppressors from any sesesion-related code. IMHO, these error suppressors should never be used (because there's no good justification for doing so and several for why you shouldn't).

habbardone

Hi,
Thanks for your reply.

The reason for the '@' error suppressors is that I start all
my scripts with @session_start(); This is supposed to ensure that I
don't accidentally lose the session variables.

Because I start all my scripts with @session_start(); there are inevitably times when "included" scripts try to re-start a session - which would create a warning.
( I want to suppress the warning )

As far as I know php just issues the warning and ignores the unnecessary @session_start()'s . ( that is waht the warning says )

Here is my login:

if(isset($_POST['log_mn1']) && $_POST['log_mn1'] == "yes"){   

  $N_user_id	 = safe_sql($_POST['x_user_id']);
  $N_pass     = safe_sql($_POST['x_pass']);
  $sql = "SELECT * FROM clients WHERE user_id =  '$N_user_id' ";

  $result = mysql_query($sql)	or die("could not execute FIND MEMBER query");

  if(mysql_num_rows($result) == 0 ){
      $conf_msg_lwr = "The login information is not correct.";
      } // end if

  else {               //    i.e. THE CLIENT DOES EXIST
      $row = mysql_fetch_assoc($result);
      extract($row);

  $_SESSION['auth'] = "yes";
  $_SESSION['expert'] = $user_id;
  $_SESSION['contact'] = $contact;
  $_SESSION['type'] = $type;
  $_SESSION['pub'] = $pub;
  $_SESSION['talk'] = $email;
  $_SESSION['sc_name'] = $sc_name;
  } // end else

I am removing the "@" from the 3 scripts concerned, just to see what happens, I expect there will be a couple of warnings.

bradgrafelman

habbardone;10975002 wrote:
The reason for the '@' error suppressors is that I start all
my scripts with @session_start(); This is supposed to ensure that I
don't accidentally lose the session variables.

Because I start all my scripts with @session_start(); there are inevitably times when "included" scripts try to re-start a session - which would create a warning.
( I want to suppress the warning )

However, in doing so you are also suppressing any actual problems that might be occurring as well.

To accomplish what you want, I personally would instead do something like:

if(session_id() == '')
  session_start();

That way, duplicate instances of that code wouldn't cause any warnings (since the subsequent session_id() calls will return the actual SID of the already-opened session) and it won't mask any errors when attempting to start the session for the first time.

habbardone

Ok - that' a good idea 🙂

I'll give that a try and post the results.

crimsonlung

I had problems with session's being lost as well, just make sure you have session_start() on every page you want the session active. Even if you miss one it can break the session of a previous page.

bradgrafelman

crimsonlung;10975050 wrote:
Even if you miss one it can break the session of a previous page.

Not true at all - you can start a session on one page and then not use it again until several requests later. HTTP is a stateless protocol, so PHP has no way of knowing whether you start a session "on every page."

crimsonlung

bradgrafelman;10975051 wrote:
Not true at all - you can start a session on one page and then not use it again until several requests later. HTTP is a stateless protocol, so PHP has no way of knowing whether you start a session "on every page."

I said it CAN, and it has on my site. After I opened up the session on each one of my pages, it resolved my issue. So unless it was a complete coincidence.....

Plus I remember reading an article where Firefox destroys PHP sessions more frequently with a new update.