PHP - Setting Session Variables
I have created a test account in my database with a user level of -1 and i think my code might be wrong but i am hoping someone can spot where i have gone wrong as i cannot, also a similar problem with another session variable loggedIn this is what i get when i login this is on the index page.
Notice: Undefined index: loggedIn in C:\xampp\htdocs\Login\index.php on line 11 Notice: Undefined index: loggedIn in C:\xampp\htdocs\Login\index.php on line 17 You must be logged in to view this page!Index page source code: <?php session_start(); error_reporting(E_ALL | E_NOTICE); ini_set('display_errors', '1'); require 'connect.php'; if($_SESSION['loggedIn'] == 1) { //Do Nothing exit(); } else if($_SESSION['loggedIn'] != 1) { echo "You must be logged in to view this page!"; exit(); } if($_SESSION['user_level'] == -1) { header("Location: banned.php"); } if(isset($_SESSION['username'])) { echo "<div id='welcome'> Welcome, ". $_SESSION['username'] ." <br> </div> "; } ?>Also if you need my login source code: <?php error_reporting(E_ALL | E_NOTICE); require 'connect.php'; session_start(); if (isset($_POST['submit'])) { $username = trim($_POST['username']); $password = trim($_POST['password']); if (empty($username)) { echo "You did not enter a username, Redirecting..."; echo "<meta http-equiv='refresh' content='2' URL='login.php'>"; exit(); } if (empty($password)) { echo "You did not enter a password, Redirecting..."; echo "<meta http-equiv='refresh' content='2' URL='login.php'>"; exit(); } //Prevent hackers from using SQL Injection to hack into Database $username = mysqli_real_escape_string($con, $_POST['username']); $password = mysqli_real_escape_string($con, $_POST['password']); $result = $con->query("SELECT * FROM $tbl_name WHERE username='$username' AND password='$password'"); $row = $result->fetch_array(); $user_level = $row['user_level']; // check to make sure query did execute. If it did not then trigger error use mysqli::error to see why it failed if($result->num_rows > 0) { //Set default user $_SESSION['loggedIn'] == 1; $_SESSION['user_level'] == 1; $_SESSION['username'] == trim($_POST['username']); header("Location: index.php"); exit(); } else if($row['user_level'] == 1) { $_SESSION['user_level'] == 1; //Location admin header("Location: admin.php"); exit(); } else if($row['user_level'] == -1) { $_SESSION['user_level'] == -1; $_SESSION['username'] == trim($_POST['username']); //Location banned header("Location: banned.php"); exit(); } else if($_SESSION['loggedIn'] == true) { //Location default user home page header("index.php"); } else { echo "Invalid Username/Password"; } //Kill unwanted session } if(isset($_POST['killsession'])) { session_destroy(); echo "<br> <br> The Session Destroyed. (Basically means you have been logged out)"; exit(); } ?>I appreciate all help Similar TutorialsI have a form where users enter name, username, password etc. The values are posted to a MySQL table where I also have a field called 'ID' that auto increments. I want to store that ID in a SESSION variable that I can carry over to other pages. Need help in doing this please. Hi guys,
I would like to have a security measure in place to prevent unauthorized access to my site without a valid log on.
At the moment, it would let anyone in without destroying the session and redirecting to index page.
What would i "use" that's created in the session? what's the "best" practice
My understanding is that the session variable is stored in the browser, after a successful log in, that session variable is like baton or a key that's "passed" onto the next page.
- if someone tried to bypass the log on with the session then access is denied or redirected away.
So on my index page to start i have:
<?php session_start(); /* clear all session variable */ $_SESSION = array(); /* set a session variable for later use */ $_SESSION['what_page'] = "admin00"; ?>What do i need to have to use the session against unauthorized access? my guess is: if(!isset($_SESSION['what_page']) || $_SESSION['what_page'] != "index.php") { $_SESSION = array(); session_destroy(); header("Location: index.php"); exit(); }So to me that means; - if 'what_page' is not set from the index page, don't go any further, re-direct (back to index) If i remove this and use a known username and password, i am able to log into the correct page, but this session validation is the bit that's not working please could you help? Record set has 2 text fields in the form which is set in a full repeat recordset browse. So, we get a long list of every record in the database. However, I want to be able to click on a single record and make another page appear. I can do this if the display is set as a table without using a text field form -- just the record variable and using a hyperlink. But, I want to use the text field. Wrapping the form only gets me the value of the last record displayed. Help would be appreciated. Hi all, Yesterday I moved a web application from a normal cookie session to a use_trans_sid session because some users' browser didn't accept cookies. This works great, but the session used to last for 45 minutes (set with session.gc_maxlifetime), but after the change the session times out faster. (How) can I set the session length if I use use_trans_sid? Thanks, Base PS: PHP version 5.2.13-1 Hey guys, Currently Im using: $row = mysql_fetch_array($result) or die(mysql_error()); echo $row['user_family']. " - ". $row['user_registered']; $row['user_family'] = $fam; $_SESSION['family'] = $fam; to take data from a mysql table & set it as SESSION family. However, I cant seem to get this to set. The information IS being taken from mysql because its being echo'd earlier up in the code, but its just not passing to the session. Any ideas? i'm creating a page counter which updates a value in a database each time the page is loaded. I'm trying to make it so that it checks to see if a session has been set, if not, it updates the database, and then sets the session. This way it wont update every time someone refreshes the page. $id=$_GET['id']; if(!isset($_SESSION[$id])){ $_SESSION[$id]= $id; $views = $row['views'] + 1; $update_views=mysql_query("UPDATE topic SET views='".$views."' WHERE topic_id='".$id."'") i want to set the session variable as that of the page id ($id) The problem is that it keeps updating the database everytime the page is reloaded. I'm not sure if i'm setting the session variable correctly. Any ideas would be great Thanks Hi girls and boys I am trying to set a variable if a session OR a cookie has been set, but am unsure on how to write the statement... if (isset($_SESSION['name'])||isset($_COOKIE['name'])) {$variable = $_SESSION['name']||$_COOKIE['name'];} Obviously not working there, but just need a pointer here. any help is appreciated... Two part question: 1) I have a MySql table called "lang_key", which will store all of the common text for a site, which will allow easy site modifications from the "non tech" admin. Now, I am creating a recordest that will pull the information from the table, and create a basic list of variables in php. For example: I connect to the database, and do a wildcard select. I can figure out how to set a basic php variable like the example below: Code: [Select] $query1 = "SELECT * FROM lang_key"; $result = mysql_query($query1); while($row = mysql_fetch_array($result)) { $template = $row['common_text']; } There are three fields in my lang_key table (unique_id, string_id, and common_text') What I want to do is take it a step further from the example and I want $template to be the value of "common_text" Where string_id = "curr_template" I hope this makes sense? I really just want to create my recordset and then populate the website with the recordset info. Part II Do you recommend that I use a lang_key database, or would it be simpler and more efficient to just create a lang page with static variables, and use the php file write option to update the page? Thanks!!! Hi all.
i am trying to use php to include a javascript onto different pages, and then "sort of " pass it a var.
The bulk of the code will be in an included footer php file.
The var will be set in the main page.
i have it working as follows: by just using echo 3 times.. the 1st with the first part of the script, the 2nd is the variable, and the 3rd is the rest of the script.
The same endcode.php file needs to also be used for pages that wont have a var set, and wont be using the script - hense the isset.
<!-- mainPage.php --> <?php $sion_gallery_id = '450'; ?> <?php include(endcode.php); ?> <!-- endcode.php --> <?php if (isset($sion_gallery_id)) {echo "start of javascript.......album/"; echo $sion_gallery_id; echo"/end of script"; } else { echo "var not on set";} ?> Say I have a dropdown menu consisting of user specific options. I need to be able to set a session variable depending on the option chosen & then re-access it on the following page. Can someone give me a crash course on how to utilize session variables? Hi Can some steer me in the right direction. I am having issues subtotaling 2 session variables: <td>'.$_SESSION['itemqty'][$key].'*'.$_SESSION['itemprice'][$key].'</td> Can you advise if I am doing this right? Cheers Hi. I'm brand new to this forum, so sorry if I do something wrong... I'm someone who has thought myself to code in php to add dynamic objects to my basic static websites. I have had no formal education. This is not my first project however. I'm having problems with session variables working fine up to a point when I call a new file and then all my session variables are lost. I have tried everything, but cannot keep them alive when I get into this or any other new file. I display a form, get user data submitted, then display a next form and after the user submits this next form all the session variables are lost. Anyone have any idea what is killing my session variables? Thanks in advance. they recently reset my website so my php.ini file has been adjusted. One of my sites is no longer passing a session variable to the next page. I am sure its one of the settings being reset. here is the data from my phpinfo file. Anything that looks off to anyone? session Session Support enabled Registered save handlers files user sqlite Registered serializer handlers php php_binary wddx Directive Local Value Master Value session.auto_start Off Off session.bug_compat_42 On On session.bug_compat_warn On On session.cache_expire 180 180 session.cache_limiter nocache nocache session.cookie_domain no value no value session.cookie_httponly Off Off session.cookie_lifetime 0 0 session.cookie_path / / session.cookie_secure Off Off session.entropy_file no value no value session.entropy_length 0 0 session.gc_divisor 100 100 session.gc_maxlifetime 1440 1440 session.gc_probability 1 1 session.hash_bits_per_character 4 4 session.hash_function 0 0 session.name PHPSESSID PHPSESSID session.referer_check no value no value session.save_handler files files session.save_path /home/users/web/b535/ipw.plevtech/public_html/cgi-bin/tmp /home/users/web/b535/ipw.plevtech/public_html/cgi-bin/tmp session.serialize_handler php php session.use_cookies On On session.use_only_cookies Off Off session.use_trans_sid 0 0 ...anyone know anything about Internet Explorer not printing values from session variables. It works on Firefox but not on Internet Explorer. The session variable value works find on the web page but click on Print preview and it dissapears and will not print. Hi, I'm having a wierd problem related to session variables. It looks like variables would get duplicated inside same session, which of course should not be possible. Background: This problem exists on one page script which creating a quote request system where users can select different products and get quote for those. Quote system creates quote ID per customer and all products selected in one session should go under the same quote ID. Problem is that sometimes when user selects products second quote ID is created and after that products are randomly added into both of quotes. While trying to solve this problem I added simple logs to see what's going on, those are added below. Problem seems to be caused by duplicated session variables. At somepoint it looks like session variables are not defined any more and new quote ID is created. After that the old and new session variables seems to be used randomly. To demonstrate the problem I added session variable called 'counter' which is defined if it does not exist and incremented always when page is reloaded by submitting the form. As you can see from below logs the 'counter' variable seems to have duplicate values, see the quote value to separate two different session variable "sets". <?php session_start(); echo "\n Current session id: ".session_id(); echo "\n _SESSION['quote']: ".$_SESSION['quote']; $_SESSION['counter'] = isset($_SESSION['counter'])? $_SESSION['counter'] +1 : 0; echo "\n _SESSION['counter']: ".$_SESSION['counter']; Output when page is reloaded(form submitted): Current session id: r5i15u4s9e20ud4j6jke8ln376 $_SESSION['quote']: $_SESSION['counter']: 0 set _SESSION['quote']: 984 Current session id: r5i15u4s9e20ud4j6jke8ln376 $_SESSION['quote']: $_SESSION['counter']: 0 set _SESSION['quote']: 985 Current session id: r5i15u4s9e20ud4j6jke8ln376 $_SESSION['quote']: 985 $_SESSION['counter']: 1 Current session id: r5i15u4s9e20ud4j6jke8ln376 $_SESSION['quote']: 985 $_SESSION['counter']: 2 Current session id: r5i15u4s9e20ud4j6jke8ln376 $_SESSION['quote']: 984 $_SESSION['counter']: 1 Current session id: r5i15u4s9e20ud4j6jke8ln376 $_SESSION['quote']: 985 $_SESSION['counter']: 3 Current session id: r5i15u4s9e20ud4j6jke8ln376 $_SESSION['quote']: 984 $_SESSION['counter']: 2 Could anyone explain how the 'counter' can behave such way inside same session (based on session ID)? This is far beyond my knowledge and I would highly appreciate any advice or tip how to solve this porblem. Thanks. BestRegards, Laowai Hi All! I've written up a script for my website. It\ is basically a virtual job quest. My queries are all correct it just isn't registering the variable for the session. It is $-SESSION[theid']. I want to be bale to use it in my table but I get an error. How do I write this in my SQL query for it to work. The page (when no errors), doesn't show my data. Here is my ocde: Code: [Select] <?php session_start(); include("config536.php"); ?> <html> <head> <link rel="stylesheet" type="text/css" href="style.css" /> </head> <?php if(!isset($_SESSION['username'])) { echo "<ubar><a href=login.php>Login</a> or <a href=register.php>Register</a></ubar><content><center><font size=6>Error!</font><br><br>You are not Logged In! Please <a href=login.php>Login</a> or <a href=register.php>Register</a> to Continue!</center></content><content><center><font size=6>Messages</font><br><br></center></content>"; } if(isset($_SESSION['username'])) { echo "<nav>$shownavbar</nav><ubar><img src=/images/layout/player.gif><a href=status.php>$showusername</a>.......................<img src=/images/layout/coin.gif> $scredits</ubar><content><center><font size=6>Basic Quests</font><br><br>"; $startjob = $_POST['submit']; $jobq = "SELECT * FROM jobs WHERE username='$showusername'"; $job = mysql_query($jobq); $jobnr = mysql_num_rows($job); if($jobnr == "0") { ?> <form action="<?php echo "$PHP_SELF"; ?>" method="POST"> <input type="submit" name="submit" value="Start Job"></form> <?php } if(isset($startjob)) { $initemidq = "SELECT * FROM items ORDER BY RAND() LIMIT 1"; $initemid = mysql_query($initemidq); while($ir = mysql_fetch_array($initemid)) { $ids = $ir['itemid']; } mysql_query("INSERT INTO jobs (username, item, time, completed) VALUES ('$showusername', '$ids', 'None', 'No')"); $wegq = "SELECT * FROM items WHERE itemid='$ids'"; $weg = mysql_query($wegq); while($wg = mysql_fetch_array($weg)) { $im = $wg['image']; $nm = $wg['name']; $id = $wg['itemid']; } $_SESSION['theid'] = $id; echo "<font color=green>Success! You have started this Job!</font><br><br>Please bring me this item: <b>$nm</b><br><br><img src=/images/items/$im><br><br><br>"; echo $_SESSION['theid']; } if($jobnr == "1") { $finish = $_POST['finish']; $okgq = "SELECT * FROM items WHERE itemid='$yes'"; $ok = mysql_query($okgq); while($ya = mysql_fetch_array($ok)) { $okname = $ya['name']; $okid = $ya['itemid']; $okimage = $ya['image']; } echo "Where is my <b>$okname</b>?<br><br><img src=/images/items/$okimage><br><br><br>"; echo $_SESSION['theid']; ?> <form action="<?php echo "$PHP_SELF"; ?>" method="POST"> <input type="submit" name="finish" value="I have the Item"></form> <?php } } if(isset($finish)) { $cinq = "SELECT * FROM uitems WHERE theitemid='$_SESSION[theid]'"; $cin = mysql_query($cinq); $connr = mysql_num_rows($cin); if($connr != "0") { echo "<font color=green>Success! You have the item.</font>"; } else { echo "<font color=red>Error! You do not have my item!</font>"; } } ?> . I basically just want to know how I can set this session as a variable. Also..I have a user login on every page and I want to be able to destroy JUST THE "theid" session and NOT the username session. How would I do that too? thanks for the help in advance! About to pull my hair out. Looks simple, I think it's simple, but something is not behaving. I have a simple login page (loginpage.php) which checks a database for the FamilyID and Password, if it is a match, then it redirects them to userspage.php. I eventually want to use the FamilyID as a filter for my database so I only show the stuff relative to that FamilyID. Using CS5 and the built in functions, and it looks to me that the session variable 'MM_Username' should contain the FamilyID which is "adminid" in my database. It appears to work since it sends me to my userspage.php when I enter a valid FamilyID and Password, but it will not show me my session variable on the that page!!! PLEASE PLEASE HELP...Slap me in the face if it's a stupid question, but I have spent WAY too much time trying to figure what is wrong. I have included my code: CODE FOR LOGINPAGE.PHP <?php require_once('Connections/MyTest.php'); ?> <?php if (!function_exists("GetSQLValueString")) { function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "") { if (PHP_VERSION < 6) { $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue; } $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue); switch ($theType) { case "text": $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL"; break; case "long": case "int": $theValue = ($theValue != "") ? intval($theValue) : "NULL"; break; case "double": $theValue = ($theValue != "") ? doubleval($theValue) : "NULL"; break; case "date": $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL"; break; case "defined": $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue; break; } return $theValue; } } ?> <?php // *** Validate request to login to this site. if (!isset($_SESSION)) { session_start(); } $loginFormAction = $_SERVER['PHP_SELF']; if (isset($_GET['accesscheck'])) { $_SESSION['PrevUrl'] = $_GET['accesscheck']; } if (isset($_POST['familyid'])) { $loginUsername=$_POST['familyid']; $password=$_POST['password']; $MM_fldUserAuthorization = ""; $MM_redirectLoginSuccess = "userspage.php"; $MM_redirectLoginFailed = "loginpage.php"; $MM_redirecttoReferrer = false; mysql_select_db($database_MyTest, $MyTest); $LoginRS__query=sprintf("SELECT adminid, password FROM `admin` WHERE adminid=%s AND password=%s", GetSQLValueString($loginUsername, "int"), GetSQLValueString($password, "text")); $LoginRS = mysql_query($LoginRS__query, $MyTest) or die(mysql_error()); $loginFoundUser = mysql_num_rows($LoginRS); if ($loginFoundUser) { $loginStrGroup = ""; if (PHP_VERSION >= 5.1) {session_regenerate_id(true);} else {session_regenerate_id();} //declare two session variables and assign them $_SESSION['MM_Username'] = $loginUsername; $_SESSION['MM_UserGroup'] = $loginStrGroup; if (isset($_SESSION['PrevUrl']) && false) { $MM_redirectLoginSuccess = $_SESSION['PrevUrl']; } header("Location: " . $MM_redirectLoginSuccess ); } else { header("Location: ". $MM_redirectLoginFailed ); } } ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Untitled Document</title> </head> <body> <form id="form1" name="form1" method="POST" action="<?php echo $loginFormAction; ?>"> <p> <label for="familyid">FamilyID:</label> <input type="text" name="familyid" id="familyid" /> </p> <p> <label for="password">Password:</label> <input type="text" name="password" id="password" /> </p> <p> <input type="submit" name="Submit" id="Submit" value="Submit" /> </p> </form> </body> </html> CODE FOR USERSPAGE.PHP <?php if (!isset($_SESSION)) { session_start(); } ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <title>Untitled Document</title> </head> <body> <strong>YOU MADE IT! </strong> <?php echo $_SESSION['MM_Username']; ?> </body> </html> THANKS IN ADVANCED!!! Hello all, I just wrote a php website to communicate with a database and it has a login based on the users email and password, they login on the first page and then the php checks for every page they visit if they indeed logged in before and not just found out what php file to open to get where they want to be. For this I used session variables to store both e-mail and password. The login info gets posted from the 1st(login) site to the 2nd site where it is checked for the first time, after that the login info isn't posted to the next page anymore, but just checked, this works for the 3rd page but when the user hits for the 4th page the variables are lost(I can't echo them either). However if I'd go from the 2nd page directly to the 4th page the page will load, however the 5th will then get my security-msg. So offcourse, I am wondering how this might have happened and how to fix this problem, here's some of the code I wrote: This is the check for the logininfo: <?php include('SessionStart.php'); include('logindata.php'); $db = mysql_connect($host, $user, $pw); if (!$db) { echo "<br />Helaas, u heeft geen verbinding met de database."; exit(); } else { mysql_select_db("teammanagementtool", $db); $sql24 = "SELECT * FROM leidinggevenden"; $allesarray = mysql_query($sql24); $i = 0; while ($mails = mysql_fetch_array($allesarray)) { $mailtjes[$i] = $mails['lg_mailadres']; $i = $i+1; } echo "...".$_SESSION['sessie']['email']."...".$_SESSION['sessie']['password']."...".$session_name."..."; if (in_array($_SESSION['sessie']['email'],$mailtjes)) { $sql25 = "SELECT lg_wachtwoord FROM leidinggevenden WHERE lg_mailadres = '".$_SESSION['sessie']['email']."'"; $pass = mysql_query($sql25); $pasje = mysql_fetch_array($pass); if ($_SESSION['sessie']['password'] != $pasje['lg_wachtwoord']) { echo "<script>alert('U bent hier op incorrecte manier terecht gekomen!');</script>"; echo "<meta http-equiv='refresh' content='0;URL=index.php' />"; exit(); } else if ($_SESSION['sessie']['password'] = "" || $_SESSION['sessie']['email'] = ""){ echo "<script>alert('U bent hier op incorrecte manier terecht gekomen!');</script>"; echo "<meta http-equiv='refresh' content='0;URL=index.php' />"; exit(); } else { } } else { echo "<script>alert('U bent hier op incorrecte manier terechtgekomen!');</script>"; echo "<meta http-equiv='refresh' content='0;URL=index.php' />"; exit(); } ?> And this is the code in my SessionStart.php: <?php $session_name = 'sessie'; $session_exp_time = 10000 ; $previous_name = session_name($session_name); ini_set('session.gc_maxlifetime', $session_exp_time); ini_set('session.gc_probability', '1'); ini_set('session.gc_divisor', '1000'); ini_set('session.name', $session_name); ini_set('session.cookie_domain', ''); ini_set('session.cookie_lifetime', 0 ); session_set_cookie_params($session_exp_time, '/', ''); session_start(); if (isset($_COOKIE[$session_name])) setcookie($session_name, $_COOKIE[$session_name], 2147483647 , ''); ?> the includes are at the start of all of my pages, I only do a session_unset() at my index.php(the login page). and my 2nd page gets: $_SESSION['sessie']['email'] = $_POST['email']; $_SESSION['sessie']['password'] = $_POST['password']; from the login. I could really use some help here, thanks in advance. I am finally making the upgrade from PHP 5.3 to PHP 7.3. When converting over the code I noticed that session some sessions are not being processed. My test code for this is below:
session_start(); include ("../includes/connect.inc"); echo "hiiiiiiii: ".$currentDate; echo "He ".$_SESSION['user']; if (isset($_SESSION['user'])) { $user = $_SESSION['user']; $currentDate = date("Y/m/d"); } else { echo "Session not started: "; }
My include is listed below: $link = mysqli_connect('localhost', 'root', ''); if (!$link) { die('Could not connect: ' . mysql_error("Connection error message")); } mysqli_select_db($link, 'dbname') or die (mysqli_error($link)); date_default_timezone_set('America/Chicago'); define ("TZ_CORRECTION", 43200); $bkcolor = "#FFFFFF"; $currentDate = (Date("Y-m-d")); I am not getting the message "Session not started or the current date from the include". If it matters I am using WAMP as my testing server Any help is greatly appreciated. Hi, I am facing problems in destroying the session variables in my logout file .I have used session_id() in my php files for ex $sid = session_id().Now when I click on logout I naviagte to my index file but the session variable $sid still remain.I have chkd it.I have kept session_start() function in a file and I am including that file in every php by require_once function.The file is palced in Includes folder..is it causing the problem?? please help me out Also can I use session_start() more than once in a single php file? My logout file is : <?php session_start(); session_destroy(); header("location:index.php"); exit(); ?> |