PHP - Php Session And Login Trouble

in my login script i have the following which searches for the username they inputted and then adds their user id to the table sessions in the database.

$result = mysql_query("SELECT * FROM ".DB_PREFIX."members WHERE user_username = '$username' AND user_password = '$password'");
        
            if(mysql_num_rows($result) != 1)
            {
                $val_error = 'Username and Password incorrect.';
            }
                else
                {
                 $row = mysql_fetch_array($result);
                    $browser = $_SERVER['HTTP_USER_AGENT'];
                    $_SESSION['user_id'] = $row['user_id'];
                    $_SESSION['session'] = session_id();
                    mysql_query("INSERT INTO ".DB_PREFIX."sessions 
                    VALUES(NULL, '".$_SESSION['user_id']."', '".$_SESSION['session']."', '".$_SERVER['REMOTE_ADDR']."', '".$_SERVER['HTTP_USER_AGENT']."', '".date('Y-m-d')."')");
                    
                    if ($_SESSION['backpage']) 
                    {
                    header('Location: '.$_SESSION['backpage']);
                    } else {
                    
                    header('Location: index.php');
                    }
                }

 then on pages which i want only logged in members to access i have the following:

if ($_SESSION['user_id'] == '') {
header ('Location: '.SITE_ROOT.'/login.php');
} else { REST OF CODE }

but when i login and try to access a page which requires you to be logged in i am directed back to index.php. I have nothing which does that. if you are not logged in you are redirected to login.php but it doesnt seem to work.
Any ideas?

Hello,
I have the following code. I am trying to have it same the searches save for 30 days. I can't tell exactly how long this works for because it does work for a while but when I open the browser the following day, the information is lost. The server time is accurate. Does anyone have any clue to why this might not work?
session_set_cookie_params(2592000);   session_name('test_mysearches');  session_start();  $rqstsignature = md5($_SERVER['REQUEST_URI'].$_SERVER['QUERY_STRING'].print_r($_POST, true));if(!isset($_SESSION['mysearches'])) {    $_SESSION['mysearches'] = array($_GET['s']);} else { if ($_GET['s'] != '') { $_SESSION['mysearches'] = array_filter($_SESSION['mysearches'], 'strlen'); if ($_SESSION['LastRequest'] != $rqstsignature) { // not a refresh array_unshift($_SESSION['mysearches'], $_GET['s']); $_SESSION['LastRequest'] = $rqstsignature; while(count($_SESSION['mysearches']) > 5) { array_pop($_SESSION['mysearches']); } } } } ()

thanks in advance.

errors:

Deprecated: Function session_register() is deprecated in /Applications/XAMPP/xamppfiles/htdocs/login.php on line 18

Warning: session_register() [function.session-register]: Cannot send session cookie - headers already sent by (output started at /Applications/XAMPP/xamppfiles/htdocs/login.php:18) in /Applications/XAMPP/xamppfiles/htdocs/login.php on line 18

Warning: session_register() [function.session-register]: Cannot send session cache limiter - headers already sent (output started at /Applications/XAMPP/xamppfiles/htdocs/login.php:18) in /Applications/XAMPP/xamppfiles/htdocs/login.php on line 18

Deprecated: Function session_register() is deprecated in /Applications/XAMPP/xamppfiles/htdocs/login.php on line 22

Code:
Code: [Select]
<?php

if ($_POST['email']) {

include_once "connect_to_mysql.php";
$email = stripslashes($_POST['email']);
$email = strip_tags($email);
$email = mysql_real_escape_string($email);
$password = preg_replace("[^A-Za-z0-9]", "", $_POST['password']); 
$password = md5($password);

$sql = mysql_query("SELECT * FROM members WHERE email='$email' AND password='$password' AND emailactivated='1'"); 
$login_check = mysql_num_rows($sql);
if($login_check > 0){ 
    while($row = mysql_fetch_array($sql)){ 
        
        $id = $row["id"];   
        session_register('id'); 
        $_SESSION['id'] = $id;
  
    $username = $row["username"];   
        session_register('username'); 
        $_SESSION['username'] = $username;

        mysql_query("UPDATE members SET lastlogin=now() WHERE id='$id'"); 
        
header("location: member_profile.php?id=$id"); 
exit();
    } 
} else {

  print '<br /><br /><font color="#FF0000">No match in our records, try again </font><br />
<br /><a href="login.php">Click here</a> to go back to the login page.';
  exit();
}
}
?>

any help really appreciated...thanks!!

Can someone please explain to me why I cant seem to get my mysql update line to work.  I have been trying for a while an still nothing.  I am new in php and need some help getting this to work.  Please be gentle.  a good explaination in newbie talk would be appreciated.

The session variable I echoed out does work so I know I am reading the variable in from the other page.

thanks

<?php
session_start();

/*   
   Server side scripting with php
   CISS 225
   Lab # Final Project
*/
//This section will create variables collected from information sent
//by the post method on the createUserProcess.
   
/*      $_SESSION['city'] = $_POST['city'];
   $_SESSION['state'] = $_POST['state'];
   $_SESSION['zipCode'] = $_POST['zipCode'];
   $_SESSION['profession'] = $_POST['profession'];
   $_SESSION['activities'] = $_POST['activities'];
   $_SESSION['hobbies'] = $_POST['hobbies'];
*/   
   $city = $_POST['city'];
   $state = $_POST['state'];
   $zipCode = $_POST['zipCode'];
   $profession = $_POST['profession'];
   $activities = $_POST['activities'];
   $hobbies = $_POST['hobbies'];

   $db = mysql_connect("localhost", "root", "");      
   mysql_select_db("accountprofile",$db);
   
   echo $_SESSION['Email'];
   //$query = "UPDATE accountprofile SET city = '$city', state = '$state', zipcode = '$zipCode', profession = '$profession', " . "
   //activities = '$activities', hobbies = '$hobbies' WHERE lastName = 'Hildebrand'";
   $query = "UPDATE accountprofile SET city = '$city', state = '$state', zipcode = '$zipCode', profession = '$profession',
   activities = '$activities', hobbies = '$hobbies' WHERE userName = " .$_SESSION['Email']."";                   mysql_query($query,$db);
   if (mysql_error())
    {
       echo "$query<br />";
       echo mysql_error();
    }
   
   echo "THANK YOU!<br />";
   echo "Your profile has been completed!<br />";
?>

I'm not sure where the issue really lies after the form submits it DOES perform the error messages if there is one, however if the username and password are atleast filled in and the user clicks Log In it doesn't do anything after that.   

login.php

<?php

/**
 * @author Jeff Davidson
 * @copyright 2010
 */

if (isset($_POST['submitted'])) {
    
    require_once ('inc/login_functions.php');
    require_once ('inc/dbconfig.php');
    list ($check, $data) = check_login($dbc, $_POST['username'], $_POST['password']);
    
    if ($check) { // OK!
    
    // Set the session data:.
    session_start();
    $_SESSION['id'] = $data['id'];
    $_SESSION['firstname'] = $data['firstname'];
    
    // Redirect:
    $url = absolute_url ('loggedin.php');
    header("Location: $url");
    exit();
    
    }else {
    // Unsuccessful!
    $errors = $data;
    }
    
    mysqli_close($dbc);
    
} // End of the main submit conditional.

include ('inc/login_page.php')

?>


login_functions.php

<?php

/**
 * @author Jeff Davidson
 * @copyright 2010
 */

// This page defines two functions used by the login/logout process.

/* This function determines and returns an absolute URL.
 * It takes one argument: the page that concludes the URL.
 * The argument defaults to index.php.

*/

function absolute_url($page = 'index.php') {
    // Start defining the URL...
    // URL is http://plus the host name plus the current directory:
    $url = 'http://' . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']);
    
    // Remove any trailing slashing:
    $url = rtrim($url, '/\\');
    
    // Add the page
    $url .= '/' . $page;
    
    // Return the URL:
    return $url;
    
} // End of absolute_url() function.


/* This function validates the form data (the username and password).
 * If both are present, teh database is queried.
 * The function requires a database connection.
 * The function returns an array of information, including:
 * - a TRUE/FALSE variable indicating success
 * - an array of either errors or the database result
 */
 
function check_login($dbc, $username = '', $password = '') {
    $errors = array(); // Initialize error array.
    
    // Validate the username
    if (empty($username)) {
        $errors[] = 'You forgot to enter your username.';
    } else {
        $u = mysqli_real_escape_string($dbc, trim($username));
    }
    
    // Validate the password:
    if (empty($password)) {
        $errors[] = 'You forgot to enter your password.';
    } else {
        $p = mysqli_real_escape_string($dbc, trim($password));
    }
    
    if (empty($errors)) { // If everythings OK.
        
        // Retrieve the firstname and lastname for the username/password combination:
        $q = "SELECT id, firstname FROM users WHERE username='$u' AND password=SHA('$p')";
        $r = @mysqli_query($dbc, $q); // Run teh query.
        
        // Check the result:
        if (mysqli_num_rows($r) == 1) {
            
            // Fetch the record:
            $row = mysqli_fetch_array($r, MYSQLI_ASSOC);
            
            // Return true and the record:
            return array(true, $row);
            
        }else { // Not a match!
        $errrors[] = 'The username and password entered do not match those on file.';
        }
    } // End of empty ($errrors) IF.
    
    // Return false and the errors:
    return array(false, $errors);
    
} //End of check_login() function.

?>


login_page.php

<?php

/**
 * @author Jeff Davidson
 * @copyright 2010
 */

// This page prints any errors associated with logging in and creates the login, including the form.

// Prints any error messages, if they exists:
if (!empty($errors)) {
    echo '<h1>Error!</h1>
    <p class="error">The following error(s) occured:<br />';
    foreach ($errors as $msg) {
        echo " - $msg<br />\n";
    }
    echo '</p><p>Please try again.</p>';
}

// Display the form:
?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="description" content="Caracole" />
<title>Titanium</title>
<link HREF="favicon.ico" type="image/x-icon" rel="icon" />
<link HREF="favicon.ico" type="image/x-icon" rel="shortcut icon" />
<link rel="stylesheet" type="text/css" href="css/tripoli.simple.css" media="screen, projection, print" />
<link rel="stylesheet" type="text/css" href="css/base.css" media="screen, projection, print" />
<link rel="stylesheet" type="text/css" href="css/layout.css" media="screen, projection, print" />
<link rel="stylesheet" type="text/css" href="css/style.css" media="screen, projection, print" />
<link rel="stylesheet" type="text/css" href="css/theme.css" media="screen, projection, print" />
<link rel="stylesheet" type="text/css" href="css/icons.css" media="screen, projection, print" />
<script type="text/javascript" SRC="http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>
<script type="text/javascript">
//<![CDATA[
document.write('<link rel="stylesheet" type="text/css" href="css/js/js.css" media="screen, projection, print" />');
//]]>

$(document).ready(function(){

$(".close").click(function(){
$(this).parents(".message").hide("puff");
});

});


</script>
<!--[if IE]>
<link rel="stylesheet" type="text/css" href="css/ie/ie.css" media="screen, projection, print" />
<![endif]-->
 <!--[if lt IE 7]>
<script src="js/DD_belatedPNG_0.0.7a-min.js" type="text/javascript"></script>
<script>

DD_belatedPNG.fix(' #header, h1, h1 a, .close, .field,.paginate .current, .icon, .required-icon');

</script>
  <link rel="stylesheet" href="css/ie/ie6.css" type="text/css" media="screen, projection"/>
<![endif]-->
</head>
<body>
<!-- Content -->
<div id="login" class="content">
<div class="roundedBorders login-box">
<!-- Title -->
<div id="title" class="b2">
<h2>Log In</h2>
<!-- TitleActions -->
<div id="titleActions">
<div class="actionBlock">
<a href="#">Forgot your password ?</a>
</div>
</div>
<!-- /TitleActions -->
</div>
<!-- Title -->

<!-- Inner Content -->
<div id="innerContent">
<form action="login.php" method="post">
<div class="field">
<label for="username">Username</label>
<input type="text" class="text" id="username" name="username" />
</div>
<div class="field">
<label for="password">Password</label>
<input type="password" class="text" id="password" name="password"/>
</div>
<div class="clearfix login-submit">
<span class="fleft">
<input type="checkbox" name="remember-me" id="remember-me" />
<label for="remember-me">Remember me</label>
</span>
<span class="fright">
<button class="button" type="submit" name="submit"><strong>Log In</strong></button>
</span>
</div>
                    <input type="hidden" value="TRUE" name="submitted" />
</form>
</div>
<!-- /Inner Content -->
<div class="bBottom"><div></div></div>
</div>
</div>

</body>
</html>


loggedin.php

<?php

/**
 * @author Jeff Davidson
 * @copyright 2010
 */

// The user is redirected here from login.php.

session_start(); // Star the session.

// If no session value is present, redirect the user:
if (!isset($_SESSION['id'])) {
    require_once('inc/login_functions.php');
    $url = absolute_url();
    header("Location: $url");
    exit();
}

$page_title = 'Logged In!';

// Print a customized message:
echo "<h1>Logged In!</h1>
<p>You are now logged in, {$_SESSION['firstname']}!</p>
<p><a href=\"logout.php\">Logout</a></p>";


?>


I thought I'd come back in and insert the file manager I have setup here.

root/loggedin.php
root/login.php

root/inc/login_page.php
root/inc/login_functions.php