need help with sessions
| From: | Anders Thoresson | Date: | Mon, 16 Dec 2002 20:34:31 +0000 |
| Subject: | need help with sessions | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-128474@lists.php.net to get a copy of this message | ||
Hi again,
I'm still trying to understand sessions, and have made some progress during the afternoon, thanks to Ernest E. Vogelsinger. I'm at the moment trying to get a login-script up and running, but without 100 percent success.
The script is split up in two major parts: bilder.php, which is the main script, and accesscontrol.php, which should check wether a valid username and password are entered or is already entered.
The first time bilder.php is run, everything works fine. accesscontrol.php gets called, and since I've not logged in, a log in-form is displayed. I enter a valid username and password, which is checked in a MySQL-table and get the green light.
But then the scripts forget that I've already logged in, and presents the log in-form over and over again.
Since I'm new to this list, I'm not sure how big source code snippets that are needed and allowed to post. This time I make a rather long posting. If not ok, please let me know.
bilder.php:
<?php
# bilder.php
include ("db_functions.php");
include ("html_functions.php");
include ("accesscontrol.php");
include ("bilder_functions.php");
session_start();
define ("INITIAL_PAGE", 0);
define ("LOGOUT", 1);
# start
$title = "bilder";
$header = " ";
html_begin ($title, $header);
# if $action is empty, show the start page
if (empty($action))
$action = INITIAL_PAGE;
if(isset($_REQUEST["action"])) {
$action = $_REQUEST["action"];
}
# examine $action
switch ($action)
{
case INITIAL_PAGE:
accesscontrol();
menu();
break;
case LOGOUT:
accesscontrol();
logout();
break;
default:
die("Unknown action: $action");
}
html_end();
?>
<*** bilder.php ends here ***>
accesscontrol.php
<?php
function accesscontrol() {
# accesscontrol.php - include-file to control that user is logged in
session_start();
# check if either $_POST['uid'] or $_SESSION['uid'] is set
if(!isset($_POST['uid']) OR !isset($_SESSION['uid'])) {
$title = "log in";
$header = " ";
html_begin ($title, $header);
?>
<H2>You are not logged in.</H2>
<p> To see the pictures you need a username and a password. If you don't have these, send a <A HREF="mailto:listor@thoresson.net">mail</A>. </p>
<p> <FORM METHOD="POST" ACTION="<?=$_SERVER['PHP_SELF']?>">
<TABLE>
<TR>
<TD>Name:</TD>
<TD><input name=uid type=text maxlength=20 size=15></TD>
</TR>
<TR>
<TD>Password: </TD>
<TD><input name=pwd type=password maxlength=10 size=15></TD>
</TR>
<TR>
<TD></TD>
<TD><input type=submit name=skicka value=" OK "> <input type=reset value="Clear"></TD>
</TR>
</TABLE>
</FORM>
</p>
<?php
html_end();
exit;
}
# if either $_POST['uid'] or $_SESSION['uid'] is set, here is where one end up
$_SESSION['uid'] = $_POST['uid'];
$_SESSION['pwd'] = $_POST['pwd'];
$uid = $_SESSION['uid'];
$pwd = $_SESSION['pwd'];
# db_connect is my own function to connect to my database
db_connect ("XXX", "YYY", "ZZZ");
$sql = "SELECT * FROM users WHERE userid = '$uid' AND password = PASSWORD('$pwd')";
$result = mysql_query($sql);
if(!$result) {
error("An error occured while your username and password were processed.\\n");
}
if(mysql_num_rows($result) == 0) {
unset($_SESSION['uid']);
unset($_SESSION['pwd']);
$title = "log in - error";
$header = " ";
html_begin ($title, $header);
?>
<H2> Log in failure! </H2>
<p> Your username or password was wrong. <A HREF="<?=$_SERVER['PHP_SELF']?>">Try again</A>.
<?php
html_end();
exit;
}
$_SESSION['username'] = mysql_result($result,0,"fullname");
}
?>
<*** accesscontrol.php ends here ***>
My non-educated guess is that there is something wrong with the line if(!isset($_POST['uid']) OR !isset($_SESSION['uid'])). Also, at the moment I have a session_start(); in both files. Right or wrong?
Best regards,
Anders