PHP - Multi Page Forms, Losing The Session Variable

Hello,   I have a secure login script that uses sessions to maintain a users logged in status. I regenerate the session ID on each page reload for added security. Sometimes, I will lose sessions, and I am hard time figuring out why. It seems to be when I have a slow internet connection. I am wondering what could be causing this?? I have a few ideas, do any of these seem plausible.   -A max execution error, returns a fatal error. -An ajax request get sent before the previous request returns, so the session ID's dont match an I am kicked out.   Any other ideas would be helpful.   Best,   James

I have four session variables, two I am valueing using $_POST elements from a previous page's form, the other two I am valueing using items retrieved from a database.  Here is the code -
----------------------------------------------------
<?php session_start();
$_SESSION['UserLastName'] = strtolower(trim($_POST['txtLastName']));
$_SESSION['BadgeID'] = trim($_POST['txtBadgeID']);

//get list for supervisor drop down
$q1 = sprintf("select * from emps where emp_last = '".$_SESSION['UserLastName']."' and emp_badge = '".$_SESSION['BadgeID']."'");

$rs_emp_info = hitMSSQL($q1,"intra_sql","employees","xxxx","xxxx",1);

$_SESSION['SSN'] = $rs_emp_info->fields("emp_ssn");
$_SESSION['CostCenter'] = $rs_emp_info->fields("emp_costcenter");

if ($_POST['rdoAction'] == 0)
 {
    header("Location: http://webapps/injury/empForm.php");
 }
?>
----------------------------

When I get to the next page, empForm.php, the Last name and badge ID session vars are populated but the SSN and Cost Center session vars are not.  I have tried several things including putting an exit(); after my header statement and first putting the database items into plain old $vars and then trying to populate the session vars with the value of the regular $vars, but nothing seems to work.  I have a session_start() at the top of all of my scripts. 

Any idea why I am losing these values? (and why this box that I am typing into on this site is bouncing around so badly that I can't see what I am typing here???)

I am not sure If I am loosing my variable or if it is just getting cancelled out by the syntax.
The error I get is this:
Query string: "SELECT * FROM timeslip WHERE 1 and Initials=" ORDER BY "Date" ASC, "Cost" ASC
Failed with error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"SELECT * FROM timeslip WHERE 1 and Initials=" ORDER BY "Date" ASC, "Cost" ASC' at line 1

Initials should have the value of GEC at this moment

Here is my code:
$qry_str="SELECT * FROM timeslip WHERE 1 ";  

if($_POST['Initials']) 
{ 
   $Initials=$_POST['Initials'];  
   $qry_str.='and Initials="'.$Initials . '"'; 
} 

if($_POST['Identifier']) 
{ 
   $Identifier=$_POST['Identifier'];  
   $qry_str.='and Identifier LIKE "%'.$Identifier . '%"'; 
} 

if($_POST['Type']) 
{ 
   $Type=$_POST['Type'];  
   $qry_str.='and Type LIKE "%'.$Type . '%"'; 
} 
if($_POST['Terms']) 
{ 
   $Terms=$_POST['Terms'];  
   $qry_str.='and Terms LIKE "%'.$Terms . '%"'; 
} 
if($_POST['Memo']) 
{ 
   $Memo=$_POST['Memo'];  
   $qry_str.='and Memo LIKE "%'.$Memo . '%"'; 
}
if($_POST['date1']) 
{  
   $date1=$_POST['date1'];
   $date2=$_POST['date2'];
   $start=date('Y-m-d', strtotime($date1));
   $end=date('Y-m-d', strtotime($date2));
   $qry_str.="and Date >= $start and Date <= $end "; 
}
if($_POST['order1'] && $_POST['order2'])
{
$order1=$_POST['order1'];
$order2=$_POST['order2'];
$qry=$_POST['qry'];
$qry_str=' "'.$qry.'" ORDER BY "'.$order1 . '" ASC, "'.$order2 . '" ASC ';
}
elseif(isset($_POST['order1'])) {
     $order1=$_POST['order1'];
$qry=$_POST['qry'];
$qry_str='$qry ORDER BY $order1 ASC';
} else {
     if(isset($_POST['order2'])) {
          $order2=$_POST['order1'];
$qry=$_POST['qry'];
$qry_str='$qry ORDER BY $order2 ASC';
     }
}

if( !$result = mysql_query($qry_str) ) {
     echo "<br>Query string: $qry_str<br>Failed with error: " . mysql_error() . '<br>';  
}

i'm creating a page counter which updates a value in a database each time the page is loaded.
I'm trying to make it so that it checks to see if a session has been set, if not, it updates the database, and then sets the session. This way it wont update every time someone refreshes the page.

$id=$_GET['id'];
if(!isset($_SESSION[$id])){
$_SESSION[$id]= $id;
$views = $row['views'] + 1;
$update_views=mysql_query("UPDATE topic SET views='".$views."' WHERE topic_id='".$id."'")

i want to set the session variable as that of the page id ($id)
The problem is that it keeps updating the database everytime the page is reloaded. I'm not sure if i'm setting the session variable correctly.
Any ideas would be great

Thanks

Hey there,

Pretty frustrated with this. It seems so simple, but I've been staring at it and toying with it for ages, so I figured I'd post here. I have a variable called "$isTaken" that seems to be losing its value in an essential step in my function. Take a look.

function subdomainTaken($inputtedSubdomain)
{
//Initialize $isTaken to 'true'
$isTaken = true;
echo "isTaken STARTS AS: <i>" . $isTaken . "</i><br />"; //FOR TESTING PURPOSES ONLY. VARIABLE HAS VALUE HERE

//Check subdomain in database
$subdomainDBQuery = mysql_query("SELECT * FROM `companies` WHERE company_subdomain = '$inputtedSubdomain'");
$foundResult = mysql_num_rows($subdomainDBQuery);

if ($foundResult > 0) {
$isTaken = true;
} else {
$isTaken = false;
}
return $isTaken;
}


By the time I get to the if statement, $isTaken has no value. I've echoed it to be sure. Any ideas?

Thanks,
Frank

I am trying to retain information from the $get variable after checking if a user, (Joomla code), is logged in but it is not working. (url: http://domain.com/script.php?file=data)

define( '_JEXEC', 1 );
define( 'DS', DIRECTORY_SEPARATOR );
define('JPATH_BASE', '/path/to/joomla/dir/');
require_once ( JPATH_BASE .DS.'includes'.DS.'defines.php' );
require_once ( JPATH_BASE .DS.'includes'.DS.'framework.php' );
$mainframe =& JFactory::getApplication('site');
$mainframe->initialise();
$session =& JFactory::getSession();
$user =& JFactory::getUser();
// get username and name of user
$username = $user->get('username');
$name = $user->get('name');
if (empty($username)) {
    die('Not logged in');
}
   $file = $_GET['file'];
   echo &file;
   exit;
Any help appreciated.

Hi everyone, as the title stated, I would like to know how I could submit a form in one page(cart) and unset a session variable on other page.   Right now my form is setting a variable within the page back to 0, however I would like the form to unset the session variable from other page as well.   The issue with my code is that every time I attempt to clear out all items, my code can empty out the cart. But whenever I close and reopen the cart, the same content will show up again. So I need to unset the session variable.   Please let me know what should I do in order to solve the problem and I greatly appreciate your help.   My code is currently looking like this: cart.php

if(!empty($_GET['aID']))
{	
$aID = $_GET['aID'];
echo $aID;
if(isset($_POST['removeAll']))
{
$aID = "0";
}
$cartSQL = "SELECT * from article where aID in ($aID)";
echo "cart sql :$cartSQL";
$cartQuery = mysqli_query($dbc, $cartSQL) or die (mysqli_error($dbc));
while($row = mysqli_fetch_array($cartQuery, MYSQLI_BOTH))
{
	$aTitle[] = $row[ 'name' ];
}
}
<form action = "" method = "POST">
<td style = "width = 200px"><input type="submit" value="Empty cart" name="removeAll"></td>
</form>

And this is the session variable from other page where I would like it to be unset upon submitting the form.

if(!empty($cartSubmit))
	$_SESSION["cartSubmit"] = $cartSubmit;
else	
	$cart = $_SESSION["cartSubmit"];

<a href="javascript:popup('cart.php?aID=<?php if(empty($cartSubmit)) echo "$cart"; else echo "$cartSubmit";?>')">Cart</a>

This is what I have


$eeee = $_POST['forum_reply'];
 $eeee = strip_tags($eeee, '<p>');
echo $eeee;

this is what prints out

Quote

Untitled document
 testinggg


this is a print_r of $_Post

Quote

Array ( [forum_reply] => testinggg
[form_reply_submit] => Reply )


Please someone tell me what in binary's name is going on!

My login script stores the user's login name as $_SESSION[ 'name'] on login. For some unapparent reason, i'm getting errors stating that $user  and $priv are  undefined variables, though I've attempted to define $user as being equal to $_SESSION['name'], using $user to look up the the user's privilege level (stored as the su column ) in the SQL table, and then where the result of the sql query is $priv which is then evaluated in an if statement. I can't seem to figure out why this might not be working.

The code I'm using:

<?php
session_start();
function verify() {
	//verify that the user is logged in via the login page. Session_start has already been called. 
	if (!isset($_SESSION['loggedin'])) {
	header('Location: /index.html'); 
	exit;
	}
	//if user is logged in, we then lookup necessary privleges. $_SESSION['name'] was written with the login name upon login. Privleges   // are written in db as a single-digit integer of of 0 for users, 1 for administrators, and 2 for special users. 
        $user === $_SESSION['name'];
    //Connect to Databse
	$link = mysqli_connect("127.0.0.1", "database user", "password", "database");
	if (!$link) {
  	  echo "Error: Unable to connect to MySQL." . PHP_EOL;
    	echo "Debugging errno: " . mysqli_connect_errno() . PHP_EOL;
    	echo "Debugging error: " . mysqli_connect_error() . PHP_EOL;
    	exit;
        }
        //SQL Statement to lookup privlege information. 
       if ($result = mysqli_query($link, "SELECT su FROM accounts WHERE username = $user", MYSQLI_STORE_RESULT)) {
         //LOOP TO CYCLE THROUGH SQL RESULTS AND STORE Privlege information as vairable $priv.
            while ($row = $result->fetch_assoc()) {
           $priv === $row["su"];
            }
        }
        // close SQL connection.
        mysqli_close($link);

 // Verify privleges and take action. Only a privlege of "1" is allowed to view this page. A privlege of "2" indicates special 
//accounts used in other scripts that have certain indermediate additional functions, but are not trusted administrators. 

        if ($priv !== 1) {
        echo $_SESSION['name'];
        echo "you have privlege level of $priv";
        echo "<br>";
        echo 'Your account does not have the privleges necessary to view this page';
        exit;
        }
        
}
verify();
?>

 

Hello everyone,

I can get Test 2 to successfully operate the if statement using a variable variable.

But when I try the same method using a session variable (Test 1) the if statement is not executed. Please could you tell me why the if statement in Test 1 is not being executed?

Code: [Select]

<?php
# TEST 1
$_SESSION[test_variable] = "abcd";
$session_variable_name = "_SESSION[test_variable]";
if ($$session_variable_name == "abcd")
{
echo "<br>line 373, abcd<br>";
}

# TEST 2
$test_variable = "efgh";
$test_variable_name = "test_variable";
if ($$test_variable_name == "efgh")
{
echo "<br>line 379, efgh<br>";
}

?>
Many thanks,

Stu

Which one is better for standards practices in PHP.

1. Using the same form for everything. (Add and edit). Meaning setting up one form to handle adding new records, as well as editing existing records. 

Or

2. Using two different forms for both actions. Use one form/area to handle Adding, and one form/area to handle editing.

Which one of these are better from a standards/practice point of a view.  Which one better fits into the MVC platform (a framework like Codeignitor, or Cake).
Should their be separate controller functions/views for add and edit or should they all be in the same controller function/form.

Thanks for the feedback.

hi all , i am working on a script which is oop driven and i m not much familiar with it, i appericiate if someone can help me to solve this problem , so basicaly current script is only setting one session variable to true if user login $_SESSION['is_successful_login']  , here is my code
<?php
include('files/db.php');
class ajaxLoginModule  {
  private $timeout         = null;
  private $target_element  = null;
  private $wait_text       = null;
  private $form_element    = null;
  private $wait_element    = null;
  private $notify_element  = null;
   
  function __construct() {
     include ('config.php'); 
 $msql  = new Db;
 $msql->connect();
 $this->is_login();
  } 
  function get_config() {
 $this->set_ajax_config();
  } 
  function set_ajax_config() {
     $this->timeout         = AJAX_TIMEOUT;
     $this->target_element  = AJAX_TARGET_ELEMENT;
     $this->wait_text       = AJAX_WAIT_TEXT;
 $this->wait_element    = AJAX_WAIT_ELEMENT;
     $this->notify_element  = AJAX_NOTIFY_ELEMENT;
     $this->form_element    = AJAX_FORM_ELEMENT;
  }
  function initLogin($arg = array()) {
 $this->get_config();
 $this->login_script();     
  }
  function initJquery() { 
 return "<script type='text/javascript' src='files/jquery-1.3.2.min.js'></script>";
  }
  function login_script() { 
 include ('files/login_script.php');
  }
  function is_login() {
      if(isset($_POST['username']))  {
     $username   = $_POST['username'];
 $password   = $_POST['password'];
 $strSQL = "SELECT * FROM ".USERS_TABLE_NAME."
    WHERE username ='$username' AND password = '$password'
   ";
        $result  = mysql_query ($strSQL); 
$row     = mysql_fetch_row($result);
   /*
//THIS IS WHAT I NEED
$_SESSION['user'] = $row['username'];
 $_SESSION['id'] = $row['id'];
*/
$exist   = count($row);
if($exist >=2) { $this->jscript_location();  } 
else { $this->notify_show();}
exit;
  }   
  }
  function notify_show() {
    echo "<script>$('.".AJAX_NOTIFY_ELEMENT."').fadeIn();</script>";
  }
  function jscript_location() {
    $this->set_session();
    echo "<script> $('#container').fadeOut();window.location.href='".SUCCESS_LOGIN_GOTO."'</script>";
  }
  function set_session() {
      session_start();
  $_SESSION['is_successful_login'] = true;

  }    
  
}  
?>  

i comment that line what i need is username and id to store in those session variables

$_SESSION['user'] = $row['username'];
 $_SESSION['id'] = $row['id']

 i tried to add code in  function set_session but did not helped, appreciate  for any help.

Thanks

Hi

I am using very simple code. Here it is

Code: [Select]
<?php
session_start();
$user = "guest";
$uid = "1";
echo $_SESSION['user']."<br />";
echo $_SESSION['uid'];
?>
it displays this error
Code: [Select]
Notice: Undefined index: user in C:\wamp\www\DealDash\index.php on line 5
Notice: Undefined index: uid in C:\wamp\www\DealDash\index.php on line 6
how can I solve this problem? Help please

I wonder whether someone can help me please.

I'm using the script below to create a page whereby users are presented with a list of image folders they have created. Clicking on any of the folders allows the user to drill down and view the individual images.

Code: [Select]
<?php session_start(); 

$_SESSION['username']=$_POST['username'];
$_SESSION['locationid']=$_POST['locationid'];
 
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<?php 
  //This variable specifies relative path to the folder, where the gallery with uploaded files is located.
  $galleryPath = 'UploadedFiles/' . $_SESSION['username'] . '/' . $_SESSION['locationid'] . '/';
  
  $absGalleryPath = realpath($galleryPath) . DIRECTORY_SEPARATOR;  
  
  $descriptions = new DOMDocument('1.0');
  $descriptions->load($absGalleryPath . 'files.xml'); 
  
  $items = array();

  for ($i = 0; $i < $descriptions->documentElement->childNodes->length; $i++) {
    $xmlFile = $descriptions->documentElement->childNodes->item($i);
    $path = $xmlFile->getAttribute('name');
    $path = explode('/', $path);
    
    $t = &$items;
    for ($j = 0; $j < count($path); $j++) {
      if (empty($t[$path[$j]])) {
        $t[$path[$j]] = array();
      }
      $t = &$t[$path[$j]];
    }
    $t['/src/'] = $xmlFile->getAttribute('source');
    $t['description'] = $xmlFile->getAttribute('description');
    $t['size'] = $xmlFile->getAttribute('size');
  }
  
  $basePath = empty($_GET['path']) ? '' : $_GET['path'];
  if ($basePath) {
    $basePath = explode('/', $basePath);
    for ($j = 0; $j < count($basePath); $j++) {
      $items = &$items[$basePath[$j]];
    }
  }
  
  $files = array();
  $dirs = array();
  
  function urlpartencode(&$item, $index) {
    $item = rawurlencode($item);
  }
  
  foreach ($items as $key => $value) {
    if (isset($value['/src/'])) {
      $value['/src/'] = explode('/', $value['/src/']);
      array_walk($value['/src/'], 'urlpartencode');
      $value['/src/'] = implode('/', $value['/src/']);
      $files[] = array(
        'name' => $key,
        'src' => $value['/src/'],
        'description' => htmlentities($value['description'], ENT_COMPAT, 'UTF-8'),
        'size' => htmlentities($value['size'], ENT_COMPAT, 'UTF-8')
      ); 
    } else {
      $dirs[] = $key;
    }
  }
  
  $basePath = empty($_GET['path']) ? '' : $_GET['path'];
  $up = dirname($basePath);
  if ($up == '.') {
    $up = '';
  }
  
  sort($files);
  sort($dirs);
?>
<head>
  <title>View Image Folders</title>
  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
  <link href="Styles/style.css" rel="stylesheet" type="text/css" />
  <script src="Libraries/jquery/jquery-1.4.3.min.js" type="text/javascript"></script>
   <style type="text/css">
<!--
.style1 {
font-size: 14px;
margin-top: 5px;
margin-right: -50px;
}

-->
  </style>
<body style="font-family: Calibri; color:  #505050; margin-right: 160px; margin-left: -180px;">
<div align="right" class="style1"> <a href = "index.php" /> Add Images <a/> &rarr; <a href = "javascript:document.imagefolders.submit()"> View All Images </a> </div>
<form id="imagefolders" name="imagefolders" class="page" action="gallery.php" method="post" enctype="application/x-www-form-urlencoded"> 
   <div id="container">
  </div>
    <div id="center">
      <div class="aB">
        <div class="aB-B">
          <?php if ('Uploaded files' != $current['title']) :?>
          <?php endif;?>
          <div class="demo">
  <input name="username" type="hidden" id="username" value="IRHM73" />
          <input name="locationid" type="hidden" id="locationid" value="1" />
            <div class="inner">
              <div class="container">
                <div class="gallery">
                  <table class="gallery-link-table" cellpadding="0" cellspacing="0">
                    <thead>
                      <tr class="head">
                        <th class="col-name">
                          Name
                        </th>
                        <th class="col-size">
                          Size
                        </th>
                        <th class="col-description">
                          Description
                        </th>
                      </tr>
                    </thead>

                    <tbody>
                      <tr class="directory odd">
                        <td class="col-name">
                          <a href="?path=<?php echo rawurlencode($up); ?>">..</a>
                        </td>
                        <td class="col-size">
                        </td>
                        <td class="col-description">
                        </td>
                      </tr>
                      <?php $i = 1; ?>
                      <?php foreach ($dirs as $dir) : ?>
                      <tr class="directory <?php $i++; echo ($i % 2 == 0 ? 'even' : 'odd'); ?>">
                        <td><a href="?path=<?php echo rawurlencode(($basePath ? $basePath . '/' : '') . $dir); ?>"><?php echo htmlentities($dir, ENT_COMPAT, 'UTF-8'); ?></a></td>
                        <td>Folder</td>
                        <td></td>
                      </tr>
                      <?php endforeach; ?>
                      <?php foreach ($files as $file) : ?>
                      <tr class="<?php $i++; echo ($i % 2 == 0 ? 'even' : 'odd'); ?>">
                        <td><a target="_blank" href="<?php echo $galleryPath . $file['src']; ?>"><?php echo htmlentities($file['name'], ENT_COMPAT, 'UTF-8'); ?></a></td>
                        <td><?php echo htmlentities($file['size'], ENT_COMPAT, 'UTF-8'); ?></td>
                        <td><?php echo htmlentities($file['description'], ENT_COMPAT, 'UTF-8'); ?></td>
                      </tr>
                      <?php endforeach; ?>
                    </tbody>
                  </table>
                </div>
              </div>
            </div>
          </div>
        </div>
      </div>
  </div>
        </div>
      </div>
    </div>
</form>
</body>
</html>
I can create the list of folders, but when I click on any of these, instead of being able to view the images, I receive the following error:
Quote

Warning: DOMDocument::load() [domdocument.load]: I/O warning : failed to load external entity "/homepages/2/d333603417/htdocs/development/UploadedFiles/files.xml" in /homepages/2/d333603417/htdocs/development/imagefolders.php on line 16

Warning: Invalid argument supplied for foreach() in /homepages/2/d333603417/htdocs/development/imagefolders.php on line 52


Line 16 is this line Code: [Select]
$descriptions->load($absGalleryPath . 'files.xml'); and line 52 is this Code: [Select]
foreach ($items as $key => $value){
However, if I change this line Code: [Select]
$galleryPath = 'UploadedFiles/' . $_SESSION['username'] . '/' . $_SESSION['locationid'] . '/'; to
Code: [Select]
$galleryPath = 'UploadedFiles/' . 'IRHM73' . '/' . '1' . '/'; i.e. replacing the 'Session Variables' with the actual values, the page works.

I've been working on this for days now, and I just can't find the solution. I just wondered whether someoen could perhaps have a look at this and let me know where I'm going wrong.

Many thanks and regards

Need help declaring some session variable guys.

I have a login form where the member enters his
1. Pilot Callsign
2. Password

I want to declare that Pilot Callsign as the session variable on authentication.

Using that Pilot Callsign session variable, I will fetch data from the database relevant to his profile.

I already have the whole login page coded along with the restricted access pages (not coded by me).

Check this out

1. Page is coded like this and working PERFECTLY
---

Code: [Select]
<?php
// *** Validate request to login to this site.
if (!isset($_SESSION)) {
  session_start();
}

$loginFormAction = $_SERVER['PHP_SELF'];
if (isset($_GET['accesscheck'])) {
  $_SESSION['PrevUrl'] = $_GET['accesscheck'];
}

if (isset($_POST['pilot_callsign'])) {
  $loginUsername=$_POST['pilot_callsign'];
  $password=$_POST['password'];
  
  mysql_select_db($database_brn_system, $brn_system);
  
  $LoginRS__query=sprintf("SELECT pilot_callsign, password, staff_level, firstname FROM pilots WHERE activated = 1 AND pilot_callsign=%s AND password=%s",
  GetSQLValueString($loginUsername, "text"), GetSQLValueString($password, "text")); 
   
  $LoginRS = mysql_query($LoginRS__query, $brn_system) or die(mysql_error());
  $loginFoundUser = mysql_num_rows($LoginRS);
  if ($loginFoundUser) {
    
    $loginStrGroup  = mysql_result($LoginRS,0,'staff_level');
    
if (PHP_VERSION >= 5.1) {session_regenerate_id(true);} else {session_regenerate_id();}
    //declare two session variables and assign them
    $_SESSION['MM_Username'] = $loginUsername;
    $_SESSION['MM_UserGroup'] = $loginStrGroup;      
?>
---

2. As you can see, there already is a session variable declared for Pilot Callsign
But on the next page "Restricted Access Page", when I try to call this same Session Variable, it doesn't work.

I tried doing this
<?php echo $_SESSION['MM_Username'] ?>

Moreover, I even tried to fetch data from the table like this -

SELECT * FROM pilots WHERE pilot_callsign=$_SESSION['MM_Username']

Doesn't work