Re: Session files in /tmp are zero length

I'm really coding only for register_globals ON. I only added the $_SESSION statment just to test and see if that made any difference (it didn't). I think I'm doing just what you described: $username = strtoupper($username); session_register("username"); $authlevel = $row['status']=='a'?1:2; session_register("authlevel"); I just never have anything but the zero length session (sess_...) file -- therefore the next page has nothing passed to it... Lee Kirk Johnson wrote:

It looks like the coding style is a mix of register_globals "on" and "off". Here's a summary of what it should be: If register_globals is "On" in php.ini, then do the following: - use session_register() to create your session variables; - use the global variable to access (assign, print) the variable, not the $HTTP_SESSION_VARS (or $_SESSION) array. Example: $myVar = 'test'; session_register('myVar'); $myVar = 'some new value'; print $myVar; Note: the value of $myVar is what is stored to the session at the end of the script. And, since it is stored after the script ends, its value is not available via $HTTP_SESSION_VARS[] until the next page. If register_globals is "Off" in php.ini, then do the following: - do not use session_register(), etc. - use $HTTP_SESSION_VARS (or $_SESSION) for all accesses. Example: $HTTP_SESSION_VARS['myVar'] = 'test'; $HTTP_SESSION_VARS['myVar'] = 'some new value'; print $HTTP_SESSION_VARS['myVar']; Kirk

-----Original Message----- From: Lee Stewart [mailto:lstewart@dsgroup.com] Sent: Wednesday, May 14, 2003 9:45 AM To: php-general@lists.php.net Subject: Re: [PHP] Session files in /tmp are zero length I did add the error_reporting, but still saw no errors... Here's the majority of the code: error_reporting(E_ALL); $errmsg = ''; session_start(); if( isset($username) ) {

        require_once('Connections/mySql.php');
        mysql_select_db($database_mySql, $mySql) or die(mysql_error($mySql));
        $rs = mysql_query("select * from employee where initials = '" . strtoupper($username) . "'", $mySql) or die(mysql_error($mySql));
        if( !(mysql_num_rows($rs)) ) { // not valid username
                mysql_free_result($rs);
                        $errmsg = "Invalid Userid";
                        unset($username);
        }
        else { // valid user, now validate password and status
                $row = mysql_fetch_assoc($rs);
                mysql_free_result($rs);
                if( $row['pw'] == $password ) { // if correct password
                        if( $row['status'] == 'a' || $row['status'] == 'm' ) { // if active user
                                $_SESSION["username"] = $username;
                                $username = strtoupper($username);
                                session_register("username");
                                $authlevel = $row['status']=='a'?1:2;
                                session_register("authlevel");
                                mysql_query("update employee set lastlogin = " . (time()-10800) . " where initials = '$username'", $mySql) or die(mysql_error($mySql));
                                echo "<meta http-equiv=refresh content=\"0; url=browse.php\">";
                                exit;

What follows just closes out the if's and has the html for the page to be redisplayed on an invalid userid/password. It does accept the userid/password, validates it, but when it gets to the second page (browse.php), it does not know the username or authlevel. When I take a look at /tmp (it's on Linux), I see the sess_.... file(s), but it's zero length... No variable names, no values. Like I mentioned, I'm migrating this from a PHP 4.0.3 system to 4.2.2. register_globals is ON. And /tmp is world writable.. I've even tried the "new" '$_SESSION["username"] = $username;' syntax, with the same results. (Though I have to admit that I'd hate to have to recode the entire app to change all the session_register stmts!) Thanks for any adivce... Lee Kirk Johnson wrote:

Start by setting the error reporting level to max, using: error_reporting(E_ALL); We may need to see some representative code to help. Kirk

-- PHP General Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php