PHP - Sessions Across Domains

Hello   I'm new in PHP but I need a help If it possible.   I want to Know which domain used my php script .   For example when some one run installer or run index.php an email send to me that contain the domain name.   Or some thing like this that I used for any php code.   so thanks

I recently installed a SSL certificate for one of my domains, on a hosting account that includes several other domains.  To redirect visitors to the SSL version of the website (because the SSL certificate only works for the www. version of the site) I use the following code in my .htaccess file:   #First rewrite any request to the wrong domain to use the correct one (here www.)

First of all, does anyone know of some good documentation to better understand cookies?  I've gone through the PHP manual, and can find how to use PHP to work with cookies, but not how cookies really work.   In particular, it is my understanding that if the domain is .mydomain.com, then mydomain.com, www.mydomain.com, or whatEver.mydomain.com, cookies could be set for each, and available for each, right?   If path was /, cookies will be sent for mydomain.com, mydomain.com/bla, and mydomain.com/bla/bla. If path was /bla, cookies will be not be sent for mydomain.com, but will be sent for mydomain.com and mydomain.com/bla/bla.   Also, what would be the impact if Apache rewrote bla.mydomain.com to mydomain.com/bla?   Please feel free to provide any other insight on this topic.   Thank you

hey all,
i've got no experience with php or apache coding but would really appreciate some help.

basically, all i want to do is add a parked domain so that website2.com redirects to website1.com

when i try to do this with cPanel i get the following message

(Apache detected an error in the Rewrite config.

Syntax error on line 5 of /public_html/.htaccess.Ei15veHhUrcxOtEJvtu0jaH_2_TPSZ8u:
RewriteRule: bad flag delimiters

Please try again.)

i opened .htaccess but have no idea what to change in it to fix this issue

all that is .htaccess contain is the following

RewriteEngine on
RewriteCond %{REQUEST_FILENAME} -f [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^(.+) - [PT,L]
RewriteRule ^(.+) index.php


any help would be really appreciated.
thanks.

I have recently changed server and setting things up are a right pain, after 2 days im need of some help.

I have my site split into sub domains so lets say;

www.domain.com
one.domain.com
two.domain.com
three.domain.com

They are to separate parts of my site which used to make it easier the manage each part, so one sub domain handles accounts and logins etc.. whilst another handles products and so on. the problem im having is all my login scripts and are on say 'one.domain.com', i can log in fine but when i visit any other domain im logged out, i can't seem to sort it out.

i have tried setting my session cookie path and session cookie domain by painstakingly adding
Code: [Select]
ini_set('session.save_path', '/var/www/vhosts/website.co.uk/httpdocs/tmp');
ini_set('session.cookie_domain', '.website.co.uk');
to every page, but it makes no difference, im also getting the occasional error
Code: [Select]
Warning: session_start() [function.session-start]: open(/tmp/sess_d387ha6eqvj53f135q0fh4d733, O_RDWR) failed: Permission denied

I have contacted my server provider by after endless messages they are no longer helping but rather keep saying 'leave it with us' then 'we fixed it' although they didnt. It doesn't help im so limited in what i have access to, i cant access the php.ini so everything has to be done via php

So i would really appreciate any help getting this session problem sorted out.

Thank you.

Suppose I have two versions of the same website; one American and one Canadian.  This site has members with profiles etc.  The way my site is written, I think that if someone were to login to their account on, say, the American site, then a session variable would indicate that a user is logged in on the client machine.  Now if they visit the "profile" page, for example, or some other members-only page ON THE CANADIAN SITE, and start manipulating data etc., then this would affect the databases for the Canadian site, and everything would get screwed up (actually, I think mysql would just start spitting out errors, but that's not good either).

Does anyone have some simple way to deal this this kind of thing?  I don't really know exactly how session variables work.   Say I have two domains, somepage.com and somepage.ca on the same server/DNS.  If a page on somepage.com sets a session variable called $_SESSION['somevar'], and a page on somepage.ca also sets a variable called $_SESSION['somevar'], are the two variables somehow distinct because they are on different domains?  Like, if somepage.com sets the variable, then somepage.ca check if the variable is set, what will happen?  What if I wanted to set up the two pages in subfolders, like somepage.com/us and somepage.com/ca, how would I deal with distinguish session variables for the two sites?  Is one approach (i.e. distinct domains vs subfolders) better than the other?

Thanks,

I'm looking for a secure way to share session data across two different domains (not subdomains) on the same server.

I've looked at passing the session id through a GET var to the other domain. It works but it looks to open the possibility of session hijacking and I don't really like having the session id in the URL string. Any way to make this secure?

The other option I'm looking at is using cURL to load a script on the other domain that sets a cookie with the session id. When the person loads the other domain, check for the cookie, get the session id, connect to session then delete the cookie. Can anyone see anything wrong with this?


Thanks.

Good Day,

I'm using the following example script from http://php.net/manual/en/function.session-set-save-handler.php which I have placed in session-handler.php and is included at the top of my index.php file. I have multiple domain names for the same website, so naturally when a person logs into the site, I would like the session to be active across all the domains instead of them having to login again if say they go from mysite.com to mysite2.com.

session-handler.php
<?php

function open($save_path, $session_name)
{
  global $sess_save_path;

  $sess_save_path = $save_path;
  return(true);
}

function close()
{
  return(true);
}

function read($id)
{
  global $sess_save_path;

  $sess_file = "$sess_save_path/sess_$id";
  return (string) @file_get_contents($sess_file);
}

function write($id, $sess_data)
{
  global $sess_save_path;

  $sess_file = "$sess_save_path/sess_$id";
  if ($fp = @fopen($sess_file, "w")) {
    $return = fwrite($fp, $sess_data);
    fclose($fp);
    return $return;
  } else {
    return(false);
  }

}

function destroy($id)
{
  global $sess_save_path;

  $sess_file = "$sess_save_path/sess_$id";
  return(@unlink($sess_file));
}

function gc($maxlifetime)
{
  global $sess_save_path;

  foreach (glob("$sess_save_path/sess_*") as $filename) {
    if (filemtime($filename) + $maxlifetime < time()) {
      @unlink($filename);
    }
  }
  return true;
}

session_set_save_handler("open", "close", "read", "write", "destroy", "gc");

session_start();

?>

The script above doesn't appear to be throwing any errors, and I can login like normal but it doesn't seem to be saving the sessions at all. So I still have to login to each separate domain.

Any ideas?

Thanks,
Ace

Hi all,

What is the best practice when using Sessions for guest users?

Basically I am trying to make a login with sessions but its just not working. Can someone look and see for any errors in what I wrote or snippet suggestions?
<?php
    //Start session
    session_start();
    
    //Include database connection details
    require_once('config.php');
    
    //Array to store validation errors
    $errmsg_arr = array();
    
    //Validation error flag
    $errflag = false;
    
    //Connect to mysql server
    $link = mysql_connect(DB_HOST, DB_USER, DB_PASSWORD);
    if(!$link) {
        die('Failed to connect to server: ' . mysql_error());
    }
    
    //Select database
    $db = mysql_select_db(DB_DATABASE);
    if(!$db) {
        die("Unable to select database");
    }
    
    //Function to sanitize values received from the form. Prevents SQL injection
    function clean($str) {
        $str = @trim($str);
        if(get_magic_quotes_gpc()) {
            $str = stripslashes($str);
        }
        return mysql_real_escape_string($str);
    }
    
    //Sanitize the POST values
    $username = clean($_POST['username']);
    $password = clean($_POST['password']);
    
    //Input Validations
    if($username == '') {
        $errmsg_arr[] = 'Username missing';
        $errflag = true;
    }
    if($password == '') {
        $errmsg_arr[] = 'Password missing';
        $errflag = true;
    }
    
    //If there are input validations, redirect back to the login form
    if($errflag) {
        $_SESSION['ERRMSG_ARR'] = $errmsg_arr;
        session_write_close();
        header("location: login.php");
        exit();
    }
    
    //Create query
    $qry="SELECT * FROM users WHERE AND username='$username' AND password='$password'";
    $result=mysql_query($qry);
    
    //Check whether the query was successful or not
    if($result) {
        if(mysql_num_rows($result) == 1) {
            //Login Successful
            session_regenerate_id();
            $member = mysql_fetch_assoc($result);
            $_SESSION['SESS_MEMBER_ID'] = $member['member_id'];
            $_SESSION['SESS_USERNAME'] = $member['username'];
            $_SESSION['SESS_EMAIL'] = $member['email'];
            $_SESSION['SESS_BETAKEY'] = $member['betakey'];
            $_SESSION['SESS_PIN'] = $member['pin'];
            session_write_close();
            header("location: member-index.php");
            exit();
        }else {
            //Login failed
            $errmsg_arr[] = 'Username/Password Invalid';
            $_SESSION['ERRMSG_ARR'] = $errmsg_arr;
            session_write_close();
            header("location: login.php");
            exit();
    }
    }else {
        die("Query failed");
    }
?>

I got a log-in form with database, it only logs if such username and password exists. I was told that if i wanna make a log-out button once logged-in, i need to add sessions to my code and idk how..

this is my code that checks if username/password exists, and if so it lets u log in, if not it displays a msg:

if(isset($_POST['loginsubmit'])){
if($username !="" && $password !="") {


///////////////////////////////Check for username/pass in database////////////////////////////
$nameexists = false;
$passexists = false;
$result = pg_query("SELECT name FROM duom WHERE name='".$username."'");
while ($row = pg_fetch_array($result)) {
if($row['name'] != ""){
$nameexists = true;
}
} if($nameexists) {
$result = pg_query("SELECT pass FROM duom WHERE name='".$username."'");
while ($row = pg_fetch_array($result)) {
if($row['pass'] == $password){
$passexists = true;
echo "Prisijungimas pavyko, jusu vartotojo vardas - ".$username."";
include"loggedinform.php";
} else {
echo "Slaptazodis netinka!";
}
/////////////////Starts session if password is correct////////////////////////////////////////////
if ($passexists){
//Here i want it to start the session if password is correct
}
//////////////////////////////////////////////////////////////////////////////////////////////////////////
} 
} else {
echo "Tokio vartotojo nera!";
}
//////////////////////////////////////////////////////////////////////////////////////////////////////////


} else {
echo "Uzpildykite visus duomenys!";
}
}


Cant i just make smth like this?

if ($passexists){
session_start();
}

Im makigna simple login system for a sight but i only want them to have to login if they want to go to the shopping cart i have t implement a session_start() on every page before the cart page so the home page products page etc etc and then on the cart page ive a simple function that checks if their logged in if not then it will direct them to the login page if they are they should just continue is this the correct way to do it ?

thanx

I am trying to create a blog and visitor log, where I should be able to log in as admin and add the item and see the visitor log.
I want a password protected administration section and I want to use sessions on the administration section.

When I for example click on add post, I want it to log in and go to page addpost.php where I can enter my text.

This is what I've done so far. I would like to know what I have done wrong and how I should do to accomplish what I have mentioned above.




<?php
session_start(); 
if(isset($_POST['btnLogin']) || isset($_POST['addpost'])){
$txtUserId = $_REQUEST['txtUserId'];

$txtPassword = $_REQUEST['txtPassword'];

if (isset($_POST['txtUserId']) && isset($_POST['txtPassword'])) {

if ($_POST['txtUserId'] === 'admin' && $_POST['txtPassword'] === 'abc123') {

//$_SESSION['basic_is_logged_in'] = true;

echo "you are logged in";

}

elseif (empty($txtUserId) || empty($txtPassword))

{
echo "fill in username and password";
}  
elseif ($_POST['txtUserId'] != 'admin'){

echo "wrong username";

}

elseif ($_POST['txtPassword'] != 'abc123'){
echo "wrong password";

}
}
}
?>
<?php
//if (!isset($_SESSION['basic_is_logged_in']) 
//   || $_SESSION['basic_is_logged_in'] !== true) 
  
?>


<html>
<head>
<title>Main User Page</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

<body>

<form method="post" name="frmLogin" id="frmLogin" action="main.php">
<table width="400" border="1" align="center" cellpadding="2" cellspacing="2">
<tr>
<td width="150">User Id</td>
<td><input name="txtUserId" type="text" id="txtUserId"></td>
</tr>
<tr>
<td width="150">Password</td>
<td><input name="txtPassword" type="password" id="txtPassword"></td>
</tr>
<tr>
<td><input type="submit" name="btnLogin" value="Login"></td>
</tr>
<tr>
<td><input type="submit" name="addpost" value="add post" /></td>
</tr>
<tr>
<td><input type="submit" name="showstat" value="Show visitors log" /></td>
</tr>
<tr>
<td><input type="submit" name="blogg" value="To blog (logout)" /></td>
</tr>

</table>
</form>


</body>
</html>

Hello,
Is there a problem in destroying a session and then starting it in the same file, for example:


session_name();
session_start();

session_destroy();



And lastly, if I create a variable $_SESSION['user'] under a session called 'one' i.e. session_name("one") and then create another variable $_SESSION['user'] under a session called 'two' i.e. session_name("two").
Are these two variables the same?

Hi, I have been looking at this code for hours and I can't figure out why the product name and quantity aren't transferring from treats.php to checkOut.php.  I realize checkOut.php is extremely long but if I could get some help I would really appreciate it. 


In case you would want the link, it 's http://auntievics.com/treats.php