validation user using $_SESSION in PHP

Question

I have a php page that should only be accessed by admin. I am using a php $_SESSION to validate the user. I have this code segment on top of my page which should only be accessed by the admin

if (!isset($_SESSION["uname"])) {
    header("Location:../error.html");
    exit;
}

if ($_SESSION["uname"] != "admin") {
    header("Location:../error.html");
    exit;
}

uname variable is getting pass to the page correctly, I am sure about that. But my validating process does not work as I expected. any user can access the page. Is there anything wrong I have done here.

where is the validation.. you are redirecting to same page in any case... and do you have session_start() at the top....? — Sudhir Bastakoti
– Sudhir Bastakoti, Commented Jul 8, 2014 at 3:53
With phpinfo(); you can check all variables which are set by PHP so you can check wether your variable names are right. — Sven R.
– Sven R., Commented Jul 8, 2014 at 4:04
Biggest question is are you outputting anything before calling the hearder() function, redirects wont work if you output even as little as an empty line first, I suggest adding ini_set('display_errors', 1); just above these checks. — ArtisticPhoenix
– ArtisticPhoenix, Commented Jul 8, 2014 at 4:07
Do not know how it is working now. But it is working now. I did not do any change. thank u everyone — buddhi weerasinghe
– buddhi weerasinghe, Commented Jul 8, 2014 at 6:54

ArtisticPhoenix · Accepted Answer · 2014-07-08 04:24:52Z

1

Did you output anything before doing these checks, even a single empty line is enough to prevent redirecting the page using

hearder()

As others stated I'd make sure you do

session_start();

But I have to assume you have the correct session values as you put

"uname variable is getting pass to the page correctly, I am sure about that. But my validating process does not work as I expected. any user can access the page. Is there anything wrong I have done here."

So that leads me to the header error, one way to tell is adding.

ini_set('display_errors', 1);

above your "validation checks" this should show any errors like "unable to send headers output already sent" etc.

answered Jul 8, 2014 at 4:24

ArtisticPhoenix

21.7k2 gold badges27 silver badges38 bronze badges

Sign up to request clarification or add additional context in comments.

6 Comments

buddhi weerasinghe Over a year ago

I have called session_start() and there is nothing(a new line or a space before the check). I can assure that uname variable getting passed to this page correctly. Here is my address bar in different usernames

ArtisticPhoenix Over a year ago

unwanted output can be really hard to find it can be as simple as a line return before your opening <?php tag. As I suggested turn on error reporting.

buddhi weerasinghe Over a year ago

Do not know how it is working now. But it is working now. I did not do any change. thank u everyone

ArtisticPhoenix Over a year ago

I suggest clearing your browser cookies ctrl+shift+del, and starting fresh with a new session to make sure.

buddhi weerasinghe Over a year ago

I think that was the solution

|

Padmanathan J · Accepted Answer · 2014-07-08 04:19:12Z

0

Did you call session_start() function at beginning.

It would not work unless we call session_start before using any SESSION data.

http://www.php.net/manual/en/function.session-start.php

edited Jul 8, 2014 at 4:19

Padmanathan J

4,6305 gold badges39 silver badges76 bronze badges

answered Jul 8, 2014 at 4:09

AjayR

4,1894 gold badges49 silver badges81 bronze badges

1 Comment

buddhi weerasinghe Over a year ago

Do not know how it is working now. But it is working now. I did not do any change. thank u

M N Islam Shihan · Accepted Answer · 2014-07-08 04:43:16Z

0

You probably forgot to call session_start() at the very beginning of the restricted page as well as the page where $_SESSION['uname'] is being set. Also make sure that $_SESSION['uname'] does not contains the value of 'admin' for other logged in users.

Note: You can debug values of super globals like $_SESSION using the print_r() or var_dump() functions.

edited Jul 8, 2014 at 4:43

answered Jul 8, 2014 at 4:19

M N Islam Shihan

3784 silver badges5 bronze badges

6 Comments

scrowler Over a year ago

If session_start wasn't called when creating the variable then that first if statement would catch it. It seems only logical that the variable must be set as admin so it passes through both if statements.

M N Islam Shihan Over a year ago

In that case I think answer of @artisiticphoenix is close candidate for the solution. Having something (even a new line or space) before the starting <?php tag is a common cause for not letting header function working as expected.

scrowler Over a year ago

I still disagree. The exit command would not let any user can access the page, it would probably present a white screen hopefully with some errors.

M N Islam Shihan Over a year ago

Hmm. I missed the any user can access the page part of the OP's question. In that case the only reason left open to allow anyone access page content - $_SESSION['uname'] is being set with value 'admin' no matter what is the actual user name is.

ArtisticPhoenix Over a year ago

"any user can access the page" - doesn't mean the page displays properly, we can assume that, but turning on error reporting is a good first step.

|

Saeed Afzal · Accepted Answer · 2014-07-08 05:47:51Z

0

See the example given below;

Start your session in your index or the desire page

sesstion_start();

Create this function to validate and redirect automatically

function isValidate($value, $autoRedirect = true){
 if(empty($_SESSION['uname']) || $_SESSION['uname'] != $value){
   if($autoRedirect){
     header("Location:../error.html");
     exit;
   }else {
     return false;
   }
 } 
 else {
   return true;
 }
}

Now simply call this method to validate the session by name. For example;

isValidate("admin");
isValidate("user");

answered Jul 8, 2014 at 5:47

Saeed Afzal

3681 gold badge5 silver badges18 bronze badges

2 Comments

buddhi weerasinghe Over a year ago

Do not know how it is working now. But it is working now. I did not do any change. thank u everyone

Saeed Afzal Over a year ago

No worries. You can ask more. I can explain. You are always welcome.

Collectives™ on Stack Overflow

validation user using $_SESSION in PHP

4 Answers 4

6 Comments

1 Comment

6 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

6 Comments

1 Comment

6 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related