PHP MySQL登录未保存会话数据

Question

I am using this PHP code for a login script:

<?php
if(isset($_POST["submit"]))
{
    session_start();
    //get the username, password and keyword sent from the form
    $username=$_POST['username']; 
    $password=$_POST['password'];

    //check in the database to see if the username, password and keyword match in the database
    $sql="SELECT * FROM admin WHERE username=('$username') and password=MD5('$password')";
    $rs=mysql_query($sql,$conn) or die(mysql_error());
    $result=mysql_fetch_array($rs);

    $check="SELECT * from admin where username='$username' ";
    $check2=mysql_query($check,$conn) or die(mysql_error());
    $check3=mysql_fetch_array($check2); 
    if($check3["logintries"] > '3')
    {
        echo '<p align="center"><h4>Your account has been suspended due to too many failed logins. Please contact support</h4></p>';
    }
    else
    {
        //get the number of rows that match in the database
        $count=mysql_num_rows($rs);

        //if the number of rows equals 1, then create the session variables
        if($count==1)
        {
            //$sql="INSERT into user_logins (user_seq, timestamp, ip_address, posted_username, posted_password, posted_keyword) values ('".$result["sequence"]."', '".date("Y-m-d H:i:s")."', '".$_SERVER["REMOTE_ADDR"]."', '".$username."', '".$password."', '".$keyword."') ";
            //$rs=mysql_query($sql,$conn) or die(mysql_error());

            session_start();
            $_SESSION["sequence"]=$result["sequence"];
            $_SESSION["loggedin"]='yes';
            echo $_SESSION["loggedin"];
            $_SESSION["ipaddress"]=$_SERVER["REMOTE_ADDR"];

            //then redirect to the main page
            //header("location: index.php");
            echo '<h3>Login Has Been Successful - Please wait while we redirect you...</h3>';
            //echo '<meta http-equiv="refresh" content="0;URL=index.php" />';
        }
        else 
        {
            $sql="SELECT * FROM admin WHERE username='".$_POST["username"]."' ";
            $rs=mysql_query($sql,$conn) or die(mysql_error());
            $result=mysql_fetch_array($rs);
            $logintries=$result["logintries"];
            $sql2="UPDATE admin set logintries = '".($logintries+1)."' where username = '".$result["username"]."' ";
            $rs2=mysql_query($sql2,$conn) or die(mysql_error());
            //other wise display an error message
            //echo '<p align="center"><h4>Username or Password incorrect</h4></p>';
        }
    }
}

?>

as you can se i have echoed the session variable "loggedin" and it echoes as yes on the page but when it goes to the member.php page its not keeping the variables.

On the member.php page i have included an authorisation.php which has this PHP Code:

<?php
if($_SESSION["loggedin"] != 'yes')
{
    header("Location: /admin/login.php");
}
?>

so if there is no session variable "loggedin" with a value of "yes" it will just redirect back to the login.php page.

as explained above, it is not storing the variable for some reason.

This is exactly the same code i have on another website which works fine, the only thing i have changed is the database login details.

all the columns that are being selected i have checked in the database and they are all correct columns (spelt correctly)

any ideas what it could be?

Answer 1

Use session_start(); before using any session variable, then it will display all values.

Answer 2

you must put session_start(); at the start of the file. best to put in the config file that you include in all files, so its there in all files.