Let me ask for your pardons for the length of this post and give my appreciations to those that actually read it ...
I am trying to implement session management and the problem I'm running into at the moment goes follows:
I have 4 files:
- login.php
- the page with the login form
- proc_login.php
- a php file for starting a session
- mystart.php
- a secured area page that can only be viewed with an active session
- header.inc
- a file that contains a function to redirect the user back to the login.php page if they do not have a specific session variable
How I attempt to handle the validation of a session:
The [login.php] page submits it's data to [proc_login.php]. [proc_login.php] simply starts a session and then sets and registers a variable called $uid that stores the user's login id. I've removed all the id validation stuff, so all it does is start the session and then redirects the user to the [mystart.php] page.
There is a validateSession() function I've defined in [header.inc]. This function will be called from every page that is a members-area/secure page. In this example, [mystart.php] is the members page. I check for the existence of a session variable $uid in validateSession(). If it is not defined I redirect the request to the [login.php] with an error message saying they need to login to get to that page.
It's not working the way I'm thinking it should.
The basic question is:
What do I need to do in each of the four files to make the scenario work as I expect it to? If I can I understand it in this trivial example, then I'm guessing/hoping that I will be able to implement full secure session managment.
So here's the situation:
If I open my Internet Explorer 5 and try to go directly to the [mystart.php], I get sent back (as I expect to) to the login page. But from there on out, I can never login. And now, after putting together this explanation, I cannot log in at all? I'm not sure what I changed along the way.
Basically I get strange/unexpected/inconsistent results - inconsistent from what I'm expecting based on the online stuff I've read. I would appreciate it if someone could take a look at my demo example and tell me where my logic is skewed. I'm relatively new to PHP, and I've been scrounging around for a detailed explanation of session management (in the sense of login/secure stuff), but the best I could do was pick up bits and peices from different sources. Can anyone recommend a good all around reference book and/or site for PHP education - especially something with all the code (the complete listing) to implement a demo dynamic, database back end, session management website(s).
Below is the source code of each file. I created demo_* files that do not have any of the database or extra stuff. All it is doing is going from the login page into the process_login page that will start a session, and then have that process page redirect the user to a members page. The intention is that if the user attempts to first access the members page, they get a login message. However, it's not working out that way.
demo_login.php
<BODY>
<? if (isset($err_msg)) { echo "<FONT COLOR=red>$err_msg</FONT></P>"; } ?>
<FORM METHOD="GET" ACTION="demo_proc_login.php">
<TABLE>
<TR>
<TD>user id:</TD>
<TD><INPUT TYPE="text" SIZE="15" NAME="login_uid"></TD>
</TR>
<TR>
<TD>password:</TD>
<TD><INPUT TYPE="password" SIZE="15" NAME="pwd"></TD>
</TR>
</TABLE>
<INPUT TYPE=submit VALUE=login></FORM></BODY>
demo_proc_login.php
<?php
session_start();
$uid = $login_uid;
session_register("uid");
Header ("Location: demo_mystart.php");
exit;
?>
demo_header.inc
<?php
function validateSession ()
{
global $uid;
if (!isset($uid))
{
session_destroy();
$err_msg=urlencode("This is a restricted area. You must login to access it.");
//$err_msg=urlencode("The current value of \$uid is '$uid'");
Header ("Location: demo_login.php?err_msg=$err_msg");
exit;
}
}
?>
demo_mystart.php
<?php
session_start();
include_once("demo_header.inc");
validateSession();
?>
<BODY><H1>Welcome To My Start <? echo $uid ?></H1></BODY>
