Re: need help with sessions

You don't need to call session_start twice. And you are right, the problem is in that line: you want to show your login screen if both $_POST['uid'] and $_SESSION['uid'] are not set, therefor instead of OR use AND. Anders Thoresson wrote:

Hi again, I'm still trying to understand sessions, and have made some progress during the afternoon, thanks to Ernest E. Vogelsinger. I'm at the moment trying to get a login-script up and running, but without 100 percent success. The script is split up in two major parts: bilder.php, which is the main script, and accesscontrol.php, which should check wether a valid username and password are entered or is already entered. The first time bilder.php is run, everything works fine. accesscontrol.php gets called, and since I've not logged in, a log in-form is displayed. I enter a valid username and password, which is checked in a MySQL-table and get the green light. But then the scripts forget that I've already logged in, and presents the log in-form over and over again. Since I'm new to this list, I'm not sure how big source code snippets that are needed and allowed to post. This time I make a rather long posting. If not ok, please let me know. bilder.php: <?php # bilder.php include ("db_functions.php"); include ("html_functions.php"); include ("accesscontrol.php"); include ("bilder_functions.php"); session_start(); define ("INITIAL_PAGE", 0); define ("LOGOUT", 1); # start $title = "bilder"; $header = " "; html_begin ($title, $header); # if $action is empty, show the start page if (empty($action))

    $action = INITIAL_PAGE;

if(isset($_REQUEST["action"])) {

    $action = $_REQUEST["action"];

} # examine $action switch ($action)

    {
    case INITIAL_PAGE:
        accesscontrol();
        menu();
        break;

    case LOGOUT:
        accesscontrol();
        logout();
        break;
        default:
        die("Unknown action: $action");

} html_end(); ?> <*** bilder.php ends here ***> accesscontrol.php <?php function accesscontrol() {

# accesscontrol.php - include-file to control that user is logged in session_start(); # check if either $_POST['uid'] or $_SESSION['uid'] is set if(!isset($_POST['uid']) OR !isset($_SESSION['uid'])) { $title = "log in"; $header = " "; html_begin ($title, $header); ?> <H2>You are not logged in.</H2> <p> To see the pictures you need a username and a password. If you don't have these, send a <A HREF="mailto:listor@thoresson.net">mail</A>. </p> <p> <FORM METHOD="POST" ACTION="<?=$_SERVER['PHP_SELF']?>"> <TABLE>

        <TR>
            <TD>Name:</TD>
            <TD><input name=uid type=text maxlength=20 size=15></TD>
        </TR>
        <TR>
            <TD>Password: </TD>
            <TD><input name=pwd type=password maxlength=10 size=15></TD>
        </TR>
        <TR>
            <TD></TD>
            <TD><input type=submit name=skicka value=" OK "> <input type=reset value="Clear"></TD>
        </TR>

</TABLE> </FORM> </p> <?php

    html_end();
    exit;

} # if either $_POST['uid'] or $_SESSION['uid'] is set, here is where one end up $_SESSION['uid'] = $_POST['uid']; $_SESSION['pwd'] = $_POST['pwd']; $uid = $_SESSION['uid']; $pwd = $_SESSION['pwd']; # db_connect is my own function to connect to my database db_connect ("XXX", "YYY", "ZZZ"); $sql = "SELECT * FROM users WHERE userid = '$uid' AND password = PASSWORD('$pwd')"; $result = mysql_query($sql); if(!$result) {

    error("An error occured while your username and password were processed.\\n");

} if(mysql_num_rows($result) == 0) {

    unset($_SESSION['uid']);
    unset($_SESSION['pwd']);

$title = "log in - error"; $header = " "; html_begin ($title, $header); ?> <H2> Log in failure! </H2> <p> Your username or password was wrong. <A HREF="<?=$_SERVER['PHP_SELF']?>">Try again</A>. <?php html_end(); exit; } $_SESSION['username'] = mysql_result($result,0,"fullname"); } ?> <*** accesscontrol.php ends here ***> My non-educated guess is that there is something wrong with the line if(!isset($_POST['uid']) OR !isset($_SESSION['uid'])). Also, at the moment I have a session_start(); in both files. Right or wrong? Best regards, Anders