PHP - Crisis? When Using Cookies Or Not Using Logout.php

Hi, im new here 

Need some help.

I have a database which contains users, and for every user i have logged_in value which is 1 if user is logged in and 0 if not. I use this so that user can be logged in only once.
When user clicks on logout link i set logged_in on 0.
My problem is when browser closes logged_in for current user is not set to 0, and after that user can't login because my site thinks he is already logged in.

is there some way I can call some function when browser exits or any other solution?

please help

When writing a logout script in PHP what steps should i take? Should i:

1.) unset all session vars like:  

 unset($_SESSION["var1"]);
 unset($_SESSION["var2"]);

or calls   

session_unset();

2.) destroy session cookie like:

setcookie(session_name(), "NULL", time()-60, $params['path'], $params['domain'], $params['secure'], isset($params['httponly']));

3.) finally destroy the session data by calling

session_destroy();

or maybe just only unset the session vars - that is making only the first step?

I'm asking because I've seen many logout scripts that doesn't involve these 3 steps (i most cases doing only the first one as i stated)

Thx. for help.

Hey guys, me again. A few of you were helping me with my login script, which I did finally get working. I am having one small problem though. Upon clicking the logout link, it does not re-direct back to the login page, it just stays blank. I have pasted my code from my logout.php file for reference. Thanks in advance for your help!

Logout.php code

<?php
session_start();
session_destroy(); {
header("location: login.php");
}
exit();
?>

Hi there I have this problem with a button that should destroy sessions and then redirects to login page when clicked, pointing to this method:

Code: [Select]
public function logout(){
$this->logged_in = false;
session_start();
session_unset();
session_destroy();
redirect_to("login.php");
    }
the function is called as bellow:
Code: [Select]
             <form>
    <input id="logout" name="logout" type="submit" value="logout" onClick="<?php $session->logout(); 
    ?> " />
</form>

which is available on a page called index.php, which is the default page where you'll be directed to when logged in or just registered. unfortunately when I'm supposed to be to this page and before even clicking on the button, the function just does the work and redirects to the login page!!!.....any help please







[/color][/size]

I based this off some other pages read, and think I'm doing this wrong or it's just not connecting. 

Code: [Select]
Here's the database table:
CREATE TABLE users (
    id INT NOT NULL AUTO_INCREMENT,
    username VARCHAR(30) NOT NULL UNIQUE,
    password VARCHAR(64) NOT NULL,
    salt VARCHAR(3) NOT NULL,
    PRIMARY KEY(id)
);


Ando far I have index.php with my login form <form name="login" action="login.php" method="post">
    Username: <input type="text" name="username" />
    Password: <input type="password" name="password" />
    <input type="submit" value="Login" />
</form><br />Would you like to <a href="register.php">register?</a></center>

Then I have my actual login on login.php (header.php includes website's main image as well as session_start():
<?php

include('header.php');

$username = $_POST['username'];
$password = $_POST['password'];
//connect to the database here
$username = mysql_real_escape_string($username);
$query = "SELECT password, salt
        FROM users
        WHERE username = '$username';";
$result = mysql_query($query);
if(mysql_num_rows($result) < 1) //no such user exists
{
    header('Location: login.php');
    die();
}
$userData = mysql_fetch_array($result, MYSQL_ASSOC);
$hash = hash('sha256', $userData['salt'] . hash('sha256', $password) );
if($hash != $userData['password']) //incorrect password
{
    header('Location: login_form.php');
    die();
}
else
{
    validateUser(); //sets the session data for this user
}
//redirect to another page or display "login success" message
?>

then I have my register php on register.php:
<?php

include('header.php');

//retrieve our data from POST
$username = $_POST['username'];
$pass1 = $_POST['pass1'];
$pass2 = $_POST['pass2'];
if($pass1 != $pass2)
    header('Location: register_form.php');
if(strlen($username) > 30)
    header('Location: register_form.php');
    
    $hash = hash('sha256', $pass1);
    function createSalt()
{
    $string = md5(uniqid(rand(), true));
    return substr($string, 0, 3);
}
$salt = createSalt();
$hash = hash('sha256', $salt . $hash);

$dbhost = 'localhost';
$dbname = 'mygame';
$dbuser = 'root';
$dbpass = '';
$conn = mysql_connect($dbhost, $dbuser, $dbpass);
mysql_select_db($dbname, $conn);
//sanitize username
$username = mysql_real_escape_string($username);
$query = "INSERT INTO users ( username, password, salt )
        VALUES ( '$username' , '$hash' , '$salt' );";
mysql_query($query);
mysql_close();
header('Location: login.php');

?>
and lastly the register form:
   
    <center><form name="register" action="register.php" method="post">
    Username: <input type="text" name="username" maxlength="30" />
    Password: <input type="password" name="pass1" />
    Password Again: <input type="password" name="pass2" />
    <input type="submit" value="Register" />
</form></center>
I am getting the errors:
Warning: mysql_num_rows() expects parameter 1 to be resource, boolean given in /Applications/XAMPP/xamppfiles/htdocs/testing/login.php on line 13

Warning: Cannot modify header information - headers already sent by (output started at /Applications/XAMPP/xamppfiles/htdocs/testing/config.php:1) in /Applications/XAMPP/xamppfiles/htdocs/testing/login.php on line 15

Could someone explain why this is happening?

Hi,

I am having a bit of problem with my login/logout script. When user is logged in I want the script to show logout and if they are not login I want the script to show login. The problem is even when the user is logged in it says "you must be logged in Click here to login " here is the script Please help

Code: [Select]


<?php
session_start();
$_SESSION['username'] = $_POST['username'];
if ($_SESSION['username'])
echo "Welcome, ".$_SESSION['username']."!<br><a href='logout.php'>Logout</a>" ;
else
 die("you must be logged in <a href='Login.php'>Click here to login</a>");
?>


what did I do wrong in this script ?
Thanks

Hello, I'm currently storing a timestamp of the users last activity in my database in which if that hasn't been updated for 15 minutes (for testing doing 2 minutes) I want it to log the user out.

I have been trying different things but they all seem to log me out even though they shouldn't be. 

Example of something I've tried

	$Online = time() - 120;
	if ($CheckOnline['lastaction'] < $Online){
    header("Location: Logout.php");
    session_destroy();
}
	

Am I going at this the wrong way.? If I do $Online < $CheckOnline['lastaction'] it keeps me logged in but never logs me out.

 

Any help would be brillaint.

 

Thank you!

is it possible to update data in mysql when a user clicks logout?

I had set this value into the super global $_SESSION in the first file, file_1.php:

<?php

//there is some code here

$_SESSION['salesorder'] = 'are---io';

//remaining code, includes a form.

?>

When the submit button is clicked, the form is submitted to file_2.php 

<?php
//some code over here
if (isset($_POST['sales']) && $_POST['sales'] != ""){
    $sales = sanitize_input(trim($_POST['sales']));	
    $_SESSION['salesorder'] = $sales;
	$host  = $_SERVER['HTTP_HOST'];
	$uri   = rtrim(dirname($_SERVER['PHP_SELF']), '/\\');
	$extra = 'processSO_helper_sd.php';
	header("Location: http://$host$uri/$extra?so=".$sales);
	exit();
 }
//Begin display
 include 'inc_fn_header_and_menu.php';
//some code over here
?>

which will redirect to processSO_helper_sd.php

<?php

// Initialize session
session_start();

    $SD_ID = $_SESSION['salesorder'];
    $result = $db->query($sql);
	$row = $result->fetch_assoc();
	$rowcount =$row['row_count'];*/
	//print_r($_SESSION);//*
	$result = $tmonedb->query("SELECT COUNT(*) FROM document WHERE SD_ID = $SD_ID")->fetch_array();
	$rowcount = $result[0];
//remaining code

?>

My problem is that I cannot access the 

$_SESSION['salesorder'] in the last file processSO_helper_sd.php although I have set it twice previously. 

I could not add session_start(); in the file_2.php  because that was already added in  'inc_fn_header_and_menu.php'; 

Can someone help me with this? Thank you. Please tell me if you need any additional information.

I was wondering if there is away to set a logout message when you are using sessions

this is my code

<?php
     session_start();
      if($_SESSION[auth] = "yes") {
      session_unset(); 
      session_destroy();
       header( "Location: index.php" );
      exit();
     } else { 
       if ($_SESSION[auth] != "yes") {
       header( "Location: index.php" );

   $_SESSION['error'] = "please login!";
      exit();
    }
  }
?>

Hi,

Just wondered if anyone could help 

Ive been following this tutorial: http://net.tutsplus.com/tutorials/php/user-membership-with-php/

Ive got a simple membership system working now, but just wondering about the login / login links that i currently have. The login link is currently hard coded like so:

Code: [Select]
<ul id="menu">
<li id="active"><a href="index.html">Home</a></li>
<li><a href="About.html">About</a></li>
<li><a href="Contact.php">Contact</a></li>
<li class="end"><a href="login.php">Login</a></li>
</ul>

and same for the logout:
Code: [Select]
<ul id="menu">
<li id="active"><a href="index.html">Home</a></li>
<li><a href="About.html">About</a></li>
<li><a href="Contact.php">Contact</a></li>
<li class="end"><a href="logout.php">Logout</a></li>
</ul>
But the problem is, when i go to the about us page for example it will still display the login which really it should have logout.

Could anyone offer some assistance please

For some reason my logout is not working properly.  I searched other forum posts and read some tutorials but I still have an issue.

Do this to create session:
Code: [Select]
$_SESSION['username'] = $row['username'];
setcookie('username', $row['username'], time() + (60 * 60 * 24 * 5));

Do this to log out the user
Code: [Select]
session_start();
session_unset();
$_SESSION = array();
setcookie(session_name(), '', time() - 3600);
session_destroy();
setcookie('username', '', time() - 3600);

Above all else I am trying to end the $_SESSION['username']

Thank you all

Hey there guys, small problem here that I can't seem to figure out. I am in the process of programming a database with user-access control.  I have the log-in system working great, but the logout link, which is located next to the logged-in username seems to not be echoing correctly. It is loading the 'Logout' text in text-form only, not link-form....

Any ideas on what may be causing this small glitch?? Thanks!!   

I have attached relevant code for said part for reference.


<img src="images/username.png" height="20" width="20">&nbsp;<b>Welcome</b> <?php echo ("<font color=#9e0219>$username</font>");?>, <?php echo '<a href="logout.php">Logout</a>';?>

This topic has been moved to Application Design.

http://www.phpfreaks.com/forums/index.php?topic=313919.0

I'm trying to use this php to clear out the session variables and return to the index page.  However it's not clearing them out. Any ideas?

logout.php
Code: [Select]
<?php 
session_start();
        unset($_SESSION['user_id']);
        unset($_SESSION['username']);
session_destroy();
header("Location: http://aaronhaas.com/pitchshark6/index.php?vid_id=1"); 
?>

then in my navigation I'm using this code to either display their username and a logout link to logout.php or if they are not logged in display a sign in link.

Code: [Select]
<?php
         // if logged in
if (isset($_SESSION['user_id'])) 
{
// display 
echo "<a href='#'>".$_SESSION['username']."</a>&nbsp; &nbsp;";
echo "<a href='scripts/logout.php'>Log Out</a>&nbsp; &nbsp;";
}
        // if not logged in
else
{      // display login link
echo "<a href='login.php'>Sign In</a>";
}
?>


here is my super simple login script
Code: [Select]
$username = $_POST['username'];
$password = $_POST['password'];

//Check if the username or password boxes were not filled in
if(!$username || !$password){
//if not display an error message
echo "<center>You need to fill in a <b>Username</b> and a <b>Password</b>!</center>";
}else{
// find user by username and password - working
$userQuery = 'SELECT * FROM users WHERE user_name ='.'"'. $username.'" AND password='.'"'. $password.'"' ;
$users = mysql_query($userQuery);

$user = mysql_fetch_array($users);
$_SESSION['user_id'] = $user['user_id'];
$_SESSION['username'] = $user['username'];
header("Location: http://aaronhaas.com/pitchshark6/index.php?vid_id=1");

}