CODEWITHSUNDEEP
phpmysql
Zazu
Zazu

Reputation: 25

Logout script is not working

Please help with my logout script. I am sorry for dumb mistakes I am very new to php. Please provide me with details and examples of how to fix this. Thank you so much.

Login Page: There are 4 types of users. Each user will get a separate home page.

<?php
session_start();

require_once('common/config.php');


if(isset($_POST['username']))
{
    $username = $_POST['username'];
    $password = $_POST['password'];

    $sql = "SELECT * FROM `users` WHERE username='".$username."' and password='".$password."'";

    $result = mysql_query($sql) or die(mysql_error());
    $fetched = mysql_fetch_array($result);

        if ($fetched['user_type'] == "admin")
        {
           header('location: adminhomepage.php');
        }
        else if ($fetched['user_type'] == "po")
        {
           header('location: pohomepage.php');
        }
        else if ($fetched['user_type'] == "pw")
        {
           header('location: pwhomepage.php');
        }
        else if ($fetched['user_type'] == "ps")
        {
           header('location: pshomepage.php');
        }
        else
        {
           header('location: invalid.php');
           exit();
        }
}
?>

Home Page: For instance this is the admin home page.

<?php

session_start();

if (isset($_SESSION['username']) && ($_SESSION['username'] !== 1))
{
    header('Location: login.php');
}

?>

Logout Page

<?php

session_start();
$_SESSION['username'] =0;

?>

Logout Button

<form action = "logout.php">
     <input id="logoutbutton" type="submit" value="Logout">
</form>

Upvotes: 0

Views: 97

Answers (5)

OIS
OIS

Reputation: 10033

Edit:

With your new information, it's clear you never actually set the $_SESSION['username'] value. 

if ($fetched['user_type'] == "admin")
{
    $_SESSION['username'] = $username;
    header('location: adminhomepage.php');
}
else if ($fetched['user_type'] == "po")
{
    $_SESSION['username'] = $username;
    header('location: pohomepage.php');
}
else if ($fetched['user_type'] == "pw")
{
    $_SESSION['username'] = $username;
    header('location: pwhomepage.php');
}
else if ($fetched['user_type'] == "ps")
{
    $_SESSION['username'] = $username;
    header('location: pshomepage.php');
}
else 
{
    header('location: invalid.php');
}
exit();

Your problem is your comparison. 

if ($_SESSION['username'] != 1)

This is true if $_SESSION['username'] is not set, null, a string, false, etc...

This might be more what you are looking for. 

if (isset($_SESSION['username']) && is_string($_SESSION['username']) && strlen($_SESSION['username']))

And you need to fix your SQL injection problem here 

$sql = "SELECT * FROM `users` WHERE username='".$username."' and password='".$password."'";

Escape variables with mysql_real_escape_string or use PDO with proper prepared statements.

You should also store passwords as hashes with password_hash(). Fetch the user, compare stored hash to password with password_verify. 

if (!password_verify($password, $fetched["password"])) {/* wrong password, show error or something */}

Upvotes: 0

Saan
Saan

Reputation: 178

logout page

<?php 
    session_start();
    unset($_SESSION['susername']);
    $_SESSION['susername'] = "";
    session_destroy();

    header("location:index.php");
?>

login.php

session_start();

    if (isset($_SESSION['uname']) == "")
    {               
        require_once('index.php');
    }

    $user_name = $_POST['user_name'];
    $user_pass = $_POST['user_pass'];
    $_SESSION['susername'] = $user_name; // or other value

Upvotes: 1

Kumar Sambhav Pandey
Kumar Sambhav Pandey

Reputation: 1743

use unset($_SESSION['susername']) or session_destroy

Upvotes: 0

Prashant Vardhan Singh
Prashant Vardhan Singh

Reputation: 380

In your logout.php please update this code...

    <?php
        session_start();
        if(isset($_SESSION['username']))
        {
           unset($_SESSION['username']);
           header('Location: login.php');
        }
    ?>

Upvotes: 0

Sougata Bose
Sougata Bose

Reputation: 31749

logout page - 

<?php
    session_start();
    $_SESSION['username'] =0;

?>

you have to start the session first before accessing it.

Upvotes: 0

Related Questions