PHP Session won't work

Question

Ok I am trying to create a simple login here but my login code as well as the intropage wont work properly. Tried to tweak the code for SESSION but find no luck.

Here's the code for my login.php:

<?php require_once("includes/connection.php"); ?>
<?php include("includes/header.php"); ?>


<?php

if(isset($_POST["login"])){

if(!empty($_POST['username']) && !empty($_POST['password'])) {
    $username=$_POST['username'];
    $password=$_POST['password'];


    $query=mysql_query("SELECT * FROM usertbl WHERE username='".$username."' AND password='".$password."'");


    $numrows=mysql_num_rows($query);
    if($numrows!=0)
    {
    while($row=mysql_fetch_assoc($query))
    {
    $dbusername=$row['username'];
    $dbpassword=$row['password'];
    }

    if($username == $dbusername && $password == $dbpassword)
    {
    session_start();
    $_SESSION['session_username']=$username;

    /* Redirect browser */
    header("Location: intropage.php");
    }
    } else {
    $message = "Invalid username or password!";
    }

} else {
    $message = "All fields are required!";
}
}
?>




    <div class="container mlogin">
            <div id="login">
    <h1>LOGIN</h1>
<form name="loginform" id="loginform" action="" method="POST">
    <p>
        <label for="user_login">Username<br />
        <input type="text" name="username" id="username" class="input" value="" size="20" /></label>
    </p>
    <p>
        <label for="user_pass">Password<br />
        <input type="password" name="password" id="password" class="input" value="" size="20" /></label>
    </p>
        <p class="submit">
        <input type="submit" name="login" class="button" value="Log In" />
    </p>
        <p class="regtext">No account yet? <a href="register.php" >Register Here</a>!</p>
</form>

    </div>

    </div>


    <?php include("includes/footer.php"); ?>
    <?php if (!empty($message)) {echo "<p class=\"error\">" . "MESSAGE: ". $message . "</p>";} ?>

Then for here's the code for my intropage.php where in I redirect the page.

<?php 
session_start();
if(!isset($_SESSION["session_username"])){
    header("location:login.php");
} else {
?>


<?php include("includes/header.php"); ?>

    <h2>Welcome, <?php echo $_SESSION['session_username'];?>! </h2>
    <p><a href="logout.php">Logout</a> Here!</p>




<?php
}
?>

Any help please? Just wanna make this work or if anything you can tweak so that I can find where I made a mistake. A big thanks!

Answer 1

You need to check if the session name is set inside all pages using if(isset($_SESSION["session_username"]))

login.php

<?php

error_reporting(E_ALL); ini_set('display_errors', 1);
session_start();

?>

<?php require_once("includes/connection.php"); ?>
<?php include("includes/header.php"); ?>

<?php

if(isset($_SESSION["session_username"])){
// echo "Session is set"; // for testing purposes
header("Location: intropage.php");
}

else{
echo "You are not logged in.";
}

if(isset($_POST["login"])){

if(!empty($_POST['username']) && !empty($_POST['password'])) {
    $username=$_POST['username'];
    $password=$_POST['password'];

    $query =mysql_query("SELECT * FROM usertbl WHERE username='".$username."' AND password='".$password."'");

    $numrows=mysql_num_rows($query);
    if($numrows!=0)

    {
    while($row=mysql_fetch_assoc($query))
    {
    $dbusername=$row['username'];
    $dbpassword=$row['password'];
    }

    if($username == $dbusername && $password == $dbpassword)

    {

// old placement
//    session_start();
    $_SESSION['session_username']=$username;

    /* Redirect browser */
    header("Location: intropage.php");
    }
    } else {
//    $message = "Invalid username or password!";

echo  "Invalid username or password!";
    }

} else {
    $message = "All fields are required!";
}
}
?>




    <div class="container mlogin">
            <div id="login">
    <h1>LOGIN</h1>
<form name="loginform" id="loginform" action="" method="POST">
    <p>
        <label for="user_login">Username<br />
        <input type="text" name="username" id="username" class="input" value="" size="20" /></label>
    </p>
    <p>
        <label for="user_pass">Password<br />
        <input type="password" name="password" id="password" class="input" value="" size="20" /></label>
    </p>
        <p class="submit">
        <input type="submit" name="login" class="button" value="Log In" />
    </p>
        <p class="regtext">No account yet? <a href="register.php" >Register Here</a>!</p>
</form>

    </div>

    </div>

---

Footnotes:

Your present code is open to SQL injection . Use prepared statements , or PDO .

mysql_* functions deprecation notice:

http://www.php.net/manual/en/intro.mysql.php

This extension is deprecated as of PHP 5.5.0, and is not recommended for writing new code as it will be removed in the future. Instead, either the mysqli or PDO_MySQL extension should be used. See also the MySQL API Overview for further help while choosing a MySQL API.

These functions allow you to access MySQL database servers. More information about MySQL can be found at » http://www.mysql.com/ .

Documentation for MySQL can be found at » http://dev.mysql.com/doc/ .

---

Passwords

I noticed that you may be storing passwords in plain text. This is not recommended.

Use one of the following:

• CRYPT_BLOWFISH
• crypt()
• bcrypt()
• scrypt()
• On OPENWALL
• PBKDF2
• PBKDF2 on PHP.net
• PHP 5.5's password_hash() function.
• Compatibility pack (if PHP < 5.5) https://github.com/ircmaxell/password_compat/

Other links:

• PBKDF2 For PHP

Answer 2

<?php
session_start();

require_once("includes/connection.php");
include("includes/header.php");
$message = '';

if(isset($_REQUEST["login"])) {
    if((isset($_POST['username']) && strlen(trim($_POST['username'])) > 0) && (isset($_POST['password']) && strlen(trim($_POST['password'])) > 0)) {
        $username = filter_var($_POST['username'],FILTER_SANITIZE_STRING);
        $password = filter_var($_POST['password'],FILTER_SANITIZE_STRING);

        $query = mysql_query("SELECT * FROM usertbl WHERE username='".$username."' AND password='".$password."' LIMIT 1");

        if(mysql_num_rows($query) == 1) {
            $row = mysql_fetch_assoc($query));

            $_SESSION['session_username'] = $row['username'];

            /* Redirect browser */
            header("Location: intropage.php");
        } else {
            $message = "Invalid username or password!";
        }
    } else {
        $message = "All fields are required!";
    }
}
?>
<div class="container mlogin">
    <div id="login">
        <h1>LOGIN</h1>
        <form name="loginform" id="loginform" action="" method="POST">
        <p>
            <label for="user_login">Username<br />
                <input type="text" name="username" id="username" class="input" value="" size="20" />
            </label>
        </p>
        <p>
            <label for="user_pass">Password<br />
                <input type="password" name="password" id="password" class="input" value="" size="20" />
            </label>
        </p>
        <p class="submit">
            <input type="submit" name="login" class="button" value="Log In" />
        </p>
        <p class="regtext">No account yet? <a href="register.php" >Register Here</a>!</p>
        </form>
    </div>
</div>
<?php
include("includes/footer.php");
if (!empty($message)) {
echo "<p class=\"error\">" . "MESSAGE: ". $message . "</p>";
}
?>

That won't do it, session_start needs to be at the top of the file to work properly. So either include it at the beginning of the file "includes/header.php" (which you are including in your login page) or in some other include file which you will be using in all of your pages.

Answer 3

Put your session_start() into your top of the page.

i have just commented your code. and its worked for me. Just copy and run this code directly.

<?php session_start();
//require_once("includes/connection.php"); ?>
<?php //include("includes/header.php"); ?>


<?php

if(isset($_POST["login"])){

if(!empty($_POST['username']) && !empty($_POST['password'])) {
    $username=$_POST['username'];
    $password=$_POST['password'];


   /* $query=mysql_query("SELECT * FROM usertbl WHERE username='".$username."' AND password='".$password."'");


    $numrows=mysql_num_rows($query);
    if($numrows!=0)
    {
    while($row=mysql_fetch_assoc($query))
    {
    $dbusername=$row['username'];
    $dbpassword=$row['password'];
    }

    if($username == $dbusername && $password == $dbpassword)
    {*/

    $_SESSION['session_username']=$username;
    print_r($_SESSION);

    /* Redirect browser */
   /* header("Location: intropage.php");
    }
    } else {
    $message = "Invalid username or password!";
    }
*/
} else {
    $message = "All fields are required!";
}
}
?>




    <div class="container mlogin">
            <div id="login">
    <h1>LOGIN</h1>
<form name="loginform" id="loginform" action="" method="POST">
    <p>
        <label for="user_login">Username<br />
        <input type="text" name="username" id="username" class="input" value="" size="20" /></label>
    </p>
    <p>
        <label for="user_pass">Password<br />
        <input type="password" name="password" id="password" class="input" value="" size="20" /></label>
    </p>
        <p class="submit">
        <input type="submit" name="login" class="button" value="Log In" />
    </p>
        <p class="regtext">No account yet? <a href="register.php" >Register Here</a>!</p>
</form>

    </div>

    </div>


    <?php include("includes/footer.php"); ?>
    <?php if (!empty($message)) {echo "<p class=\"error\">" . "MESSAGE: ". $message . "</p>";} ?>

Answer 4

You are unnecessarily checking session username in intropage.php
you should remove the code

 if(!isset($_SESSION["session_username"])){
header("location:login.php");

From intro file and start session only once and it should be in header file's first line.