PHP Unable to set a session variable

Question

From a login page I am capturing the user and password values:

<?php
session_start();
$error=''; 
$rows = 0;
if (isset($_POST['submit'])) {
    $username=$_POST['username'];
    $password=$_POST['password'];
    $mysqli = new mysqli("localhost","xxxxx","xxxxx","xxxxxxx");
    if (mysqli_connect_errno()) {
        printf("Connect failed: %s\n", mysqli_connect_error());
        exit();
    }
    $username = stripslashes($username);
    $password = stripslashes($password);
    $username = $mysqli->real_escape_string($username);
    $password = $mysqli->real_escape_string($password);
    $query = "select count(*) from login where password='$password' AND username='$username'";
   if ($stmt = $mysqli->prepare($query)) {
        $stmt->execute();
        $stmt->store_result();
        $rows = $stmt->num_rows;
        $stmt->close();
   }
}
$mysqli->close();
if ($rows == 1) {
    $_SESSION['login_user']=$username; 
    header("location: profile.php"); 
} else {
    header("location: login.php"); 
    $error = "Username or Password is invalid";
} 
?>

My profile.php script is something like below:

<?php
include('session.php');
?>
<!DOCTYPE html>
<html>
<head>
<title>Your Home Page</title>
<link href="style.css" rel="stylesheet" type="text/css">
</head>
<body>
   <div id="profile">
     <b id="welcome">Welcome : <i><?php echo $login_session; ?></i></b>
     <b id="logout"><a href="logout.php">Log Out</a></b>
   </div>
</body>
</html>

And session.php

<?php
if(!isset($_SESSION['login_user'])){
    header('Location: login.php');
}
?>

My code flow is like when the login form is submitted the validate_login.php source code will verify the details from the user. In case the details are correct a profile.php page would be displayed or back again to login page.

I am having 3 difficulties;

How to debug PHP scripts?
Why my code is going back to login page again - I have tested by hard coding wrong undefined variable (forcing a dump) - I found that the row is found as it enters in if condition which defines the session variable [if ($rows == 1)]
Is there any other way we can verify a session - basically only a logged in user should see the further pages?

Thanks that solves my main issue .. but please let me know how do I debug a PHP script and is there other better method to validate a logged in user — Programmer
– Programmer, Commented Dec 18, 2014 at 9:57
"How to debug PHP" is far too vague of a question and is only something you can learn to do by gaining knowledge of the language or reading, there is no 'correct' answer for that. Install programs like Xdebug and use a proper IDE. — ɴᴀᴛᴇ ᴅᴇᴠ
– ɴᴀᴛᴇ ᴅᴇᴠ, Commented Dec 18, 2014 at 10:01
Prepared statements only give you the security benefits if you're actually binding parameters. If you're inputting values straight into the query string you might as well just use mysqli->query — ReallyMadeMeThink
– ReallyMadeMeThink, Commented Dec 18, 2014 at 10:02

AddcitedToLearn · Accepted Answer · 2014-12-18 10:11:39Z

1

you have no session right now in youre session.php

<?php
if(!isset($_SESSION['login_user'])){
header('Location: login.php');
}
?>

You need to add session_start();

So u will get

<?php
session_start();
if(!isset($_SESSION['login_user'])){
header('Location: login.php');
}
?>

For security its better to use prepared prepared statements. For error handelings, try to make something is there really a session ?.

if(session_id() == '' || !isset($_SESSION)) {
    // session isn't started
    echo "No session";
}

edited Dec 18, 2014 at 10:11

answered Dec 18, 2014 at 10:06

AddcitedToLearn

3982 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

score 1 · Accepted Answer · 2017-12-12 02:42:34Z

Your session.php should be

empty() is essentially the concise equivalent to !isset($var) || $var == false.

<?php
session_start();
if(empty($_SESSION['login_user'])){
header('Location: login.php');
}
?>

include session.php to your script and any other page that is for registered users

<?php
include_once('session.php');
$error=''; 
$rows = 0;
if (isset($_POST['submit'])) {
$username=$_POST['username'];
$password=$_POST['password'];
$mysqli = new mysqli("localhost","xxxxx","xxxxx","xxxxxxx");
if (mysqli_connect_errno()) {
    printf("Connect failed: %s\n", mysqli_connect_error());
    exit();
}
$username = stripslashes($username);
$password = stripslashes($password);
$username = $mysqli->real_escape_string($username);
$password = $mysqli->real_escape_string($password);
$query = "select count(*) from login where password='$password' AND username='$username'";
if ($stmt = $mysqli->prepare($query)) {
$stmt->execute();
$stmt->store_result();
$rows = $stmt->num_rows;
$stmt->close();
}
}
$mysqli->close();
if ($rows == 1) {
$_SESSION['login_user']=$username; 
header("location: profile.php"); 
} else {
header("location: login.php"); 
$error = "Username or Password is invalid";
} 
?>

vineet · Accepted Answer · 2014-12-24 09:48:01Z

0

Call session_start() function, before use any session variable.

If you get warning such as : Warning: Cannot modify header information - headers already sent (output started at script:line), then use @ suppression operator

@session_start() //@ for error suppression

edited Dec 24, 2014 at 9:48

answered Dec 18, 2014 at 10:21

vineet

14.3k11 gold badges61 silver badges76 bronze badges

1 Comment

ɴᴀᴛᴇ ᴅᴇᴠ Over a year ago

How exactly is adding @ (error suppression) good practise? This is awful practise.

Collectives™ on Stack Overflow

PHP Unable to set a session variable

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related