RE: [PHP] Session files in /tmp are zero length

It looks like the coding style is a mix of register_globals "on" and "off". Here's a summary of what it should be: If register_globals is "On" in php.ini, then do the following: - use session_register() to create your session variables; - use the global variable to access (assign, print) the variable, not the $HTTP_SESSION_VARS (or $_SESSION) array. Example: $myVar = 'test'; session_register('myVar'); $myVar = 'some new value'; print $myVar; Note: the value of $myVar is what is stored to the session at the end of the script. And, since it is stored after the script ends, its value is not available via $HTTP_SESSION_VARS[] until the next page. If register_globals is "Off" in php.ini, then do the following: - do not use session_register(), etc. - use $HTTP_SESSION_VARS (or $_SESSION) for all accesses. Example: $HTTP_SESSION_VARS['myVar'] = 'test'; $HTTP_SESSION_VARS['myVar'] = 'some new value'; print $HTTP_SESSION_VARS['myVar']; Kirk > -----Original Message----- > From: Lee Stewart [mailto:lstewart@dsgroup.com] > Sent: Wednesday, May 14, 2003 9:45 AM > To: php-general@lists.php.net > Subject: Re: [PHP] Session files in /tmp are zero length > > > I did add the error_reporting, but still saw no errors... > > Here's the majority of the code: > error_reporting(E_ALL); > $errmsg = ''; > session_start(); > if( isset($username) ) { > require_once('Connections/mySql.php'); > mysql_select_db($database_mySql, $mySql) or > die(mysql_error($mySql)); > $rs = mysql_query("select * from employee where > initials = '" . > strtoupper($username) . "'", $mySql) or die(mysql_error($mySql)); > if( !(mysql_num_rows($rs)) ) { // not valid username > mysql_free_result($rs); > $errmsg = "Invalid Userid"; > unset($username); > } > else { // valid user, now validate password and status > $row = mysql_fetch_assoc($rs); > mysql_free_result($rs); > if( $row['pw'] == $password ) { // if > correct password > if( $row['status'] == 'a' || > $row['status'] == > 'm' ) { // if active user > $_SESSION["username"] = $username; > $username = strtoupper($username); > session_register("username"); > $authlevel = $row['status']=='a'?1:2; > session_register("authlevel"); > mysql_query("update employee set > lastlogin = " . (time()-10800) . " where initials = '$username'", > $mySql) or die(mysql_error($mySql)); > echo "<meta http-equiv=refresh > content=\"0; url=browse.php\">"; > exit; > > What follows just closes out the if's and has the html for > the page to > be redisplayed on an invalid userid/password. > > It does accept the userid/password, validates it, but when it gets to > the second page (browse.php), it does not know the username > or authlevel. > > When I take a look at /tmp (it's on Linux), I see the > sess_.... file(s), > but it's zero length... No variable names, no values. > > Like I mentioned, I'm migrating this from a PHP 4.0.3 system > to 4.2.2. > register_globals is ON. And /tmp is world writable.. > > I've even tried the "new" '$_SESSION["username"] = > $username;' syntax, > with the same results. (Though I have to admit that I'd hate > to have to > recode the entire app to change all the session_register stmts!) > > Thanks for any adivce... > Lee > > > > Kirk Johnson wrote: > > > > Start by setting the error reporting level to max, using: > > > > error_reporting(E_ALL); > > > > We may need to see some representative code to help. > > > > Kirk > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, visit: http://www.php.net/unsub.php >