How to make a secure session with php and mysql?

Question

I have tried a session.php script which runs at the head of each page in my website to verify that the user has logged in before they can browse the site. However, now the process_login script won't load the secure landing page and it just reloads to the login page. I believe that my secure session is not being set correctly. Can someone further explain how this works to me?

This is the script, process_login, which executed when a user clicks login:

<?php

// Initialize session
session_start();

// Require database connection settings
require('config.inc');

// Retrieve email and password from database
$email = mysql_real_escape_string($_POST['email']);
$password = mysql_real_escape_string(md5($_POST['password']));
$query = "SELECT * FROM $table WHERE email='$email' AND password='$password' LIMIT 1";
$result = mysql_query($query);

// Check email and password match
if(mysql_num_rows($result)) {
        // Set email session variable
        $_SESSION['email'] = $_POST['email'];
        // Jump to secured page
        header('Location: home.php');
}
else {
            // Jump to login page
            header('Location: index.php');
}

?>

and this is the session.php script which is in the head of each page that requires a user to be logged in:

<?php

if (isset($_SESSION['email']) == 0) {
    // Redirect to login page
    header('Location: index.php');
}

?>

When the process_login script is called, the user is by definition not yet logged in. So you should not run the verify/redirect code during process_login. — Jon
– Jon, Commented Jan 11, 2012 at 2:36
hey guys - i asked this guy to post his question on SO, but he's never used it before. i'm just vouching that he's a real person with a real problem and not some fly-by-night :) — Jason
– Jason, Commented Jan 11, 2012 at 2:37

Dipu Raj · Accepted Answer · 2012-01-11 03:04:02Z

2

You need to include the code

session_start();

in the your file session.php to access your session variables

Or you should make sure that session auto start is enabled on your php configuration.

answered Jan 11, 2012 at 3:04

Dipu Raj

1,8944 gold badges33 silver badges39 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

user1142202 Over a year ago

but if i have it start a session on each new page will that mess something up?

Dipu Raj Over a year ago

No. It should be do that way php.net/manual/en/function.session-start.php

Daisetsu Over a year ago

Dipu raj is correct. Remember, PHP is stateless which is why you need sessions in the first place. You MUST call session_start() on every page load before you access/ser ANY session variables.

Collectives™ on Stack Overflow

How to make a secure session with php and mysql?

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related