Reputation: 171
I'm creating a website with a login and using sessions to prevent users from accessing particular pages unless they're logged in. I have a session checker (at the bottom) and it doesn't see a session so I don't think I'm registering it correctly but I've checked the web a few times and it stated that the way I'm doing it $_SESSION['myusername'] = $myusername; was the newer way but I'm thinking that's my issue. Thanks so much for taking the time to help I greatly appreciate it.
Login Script:
<table width="200" border="0" align="center" cellpadding="0" cellspacing="1">
<tr>
<form name="form1" method="post" action="checklogin.php">
<td>
<table width="100%" border="0" cellpadding="3" cellspacing="1" bgcolor="#FFFFFF">
<tr>
<td width="78">Username</td>
<td width="6">:</td>
<td width="294"><input name="myusername" type="text" id="myusername"></td>
</tr>
<tr>
<td>Password</td>
<td>:</td>
<td><input name="mypassword" input type="password" id="mypassword"></td>
</tr>
<tr>
<td> </td>
<td> </td>
<td><input type="submit" name="Submit" value="Login"></td>
</tr>
</table>
</td>
</form>
</tr>
</table>
Check for Login Procedure:
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);
$encrypted_mypassword=md5($mypassword);
$sql="SELECT * FROM users WHERE username='$myusername' and password='$encrypted_mypassword'";
$result=mysql_query($sql);
$count=mysql_num_rows($result);
if($count==1){
$_SESSION['myusername'] = $myusername;
header("location: control.php");
}
else {
header("location: failed.php");
}
?>
My sessions banner that I add to the pages I don't want to allow access to unless logged in:
<?php
session_start();
if( isset($_SESSION['myusername']) ){
header("Location: login.php");
}
?>
And lastly my logout script:
<?php
session_start();
$_SESSION = array();
session_unset();
session_destroy();
header("Location:login.php");
exit();
?>
Any help would be greatly appreciated. I apologize for so much information just wanted to make sure I had everything listed. I'm not exactly sure what I'm doing wrong. I have another script that I'm using to see if sessions are running and I don't even see a session there.
<?php
$sid = session_id();
if($sid) {
echo "Session exists!";
} else {
session_start();
}
?>
Upvotes: 1
Views: 104
Reputation: 78994
You need session_start() on every page that does anything with the session or $_SESSION vars, so add it to Check for Login Procedure.
And this:
if( isset($_SESSION['myusername']) ){
header("Location: login.php");
Should be NOT ! :
if( !isset($_SESSION['myusername']) ){
header("Location: login.php");
Upvotes: 2