Solved

php Session issues

Posted on 2011-09-07
7
267 Views
Last Modified: 2012-08-13
I am trying to control access to some web site "back end" pages via session & session variables.

I am using a technique I have used on other sites & it has always worked perfectly, until now.

Maybe there is a change in php 5?

See attached php files.

The chk_login.php is used to check the validity of the login & go to the admin menu. The admin_menu.php is self-explanatory.

But they don't work. After the timeout, the admin_menu page is just a blank page with the <!DocTYPE and <html tags at the top, rest of page completely blank.

What's wrong?

Thanks
admin-menu.php
chk-login.php
0
Comment
Question by:Richard Korts
7 Comments
 
LVL 108

Expert Comment

by:Ray Paseur
ID: 36497775
The correct design pattern for PHP client authentication is available in this article.
http://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/A_2391-PHP-login-logout-and-easy-access-control.html

Please read it over and have a look at the code samples.  It is intentionally simplistic, but it is the foundation of "how it's done."
0
 
LVL 27

Expert Comment

by:yodercm
ID: 36497810
Make sure the webpages are all under the same domain level directory.  Session variables do not persist across domains.
0
 
LVL 13

Accepted Solution

by:
haloexpertsexchange earned 500 total points
ID: 36497837
potential problems for the admin-menu.php page
you cannot have any type of output to the browser before you do the session_start(), try moving that to before the doctype declaration. It is the same with any header information from php.
Check your ini file to see if you have short tags enabled otherwise you have to start php scripting with <?php not just <?
0
Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

 
LVL 108

Expert Comment

by:Ray Paseur
ID: 36497842
Here is the chk-login.php script annotated with some comments.  Error checking is important when you are running queries.  MySQL is not a black box -- it can and will fail for reasons that are outside of your control.  You would want to trap these failures and take appropriate action.
<? // THIS USES THE SHORT-OPEN TAG.  SUGGEST YOU CONVERT TO THE FULL TAG LIKE <?php

// THIS NEEDS TO BE THE FIRST LINE OF EVERY SCRIPT
error_reporting(E_ALL);

// set up database
$Host = "db380492857.db.1and1.com";
$User = "dbo380492857";
$Password = "abcxyz";
$DBName = "db380492857";

// THE FOLLOWING INSTRUCTION CAN FAIL, AND MUST BE TESTED FOR SUCCESS
$Link = mysql_connect ($Host, $User, $Password);

// THE FIELDS HERE NEED TO BE ESCAPED
$qry = "SELECT * from admin where code = '" . $_POST['uc'] . "' and password = '" . $_POST['pwd'] . "'";

// THIS FUNCTION IS DEPRECATED - CHANGE IT. http://php.net/manual/en/function.mysql-db-query.php
$res = mysql_db_query ($DBName, $qry, $Link);

// HOW DO YOU KNOW WHAT VALUE IN IN $res?  YOU HAVE TO TEST IT BEFORE YOU TRUST IT IN ANOTHER FUNCTION
$n = mysql_num_rows($res);

// WHAT WOULD YOU DO IF $n == 3?  MAYBE YOU NEED A LIMIT IN THE QUERY
if ($n == 0) {
	header("Location: login.php?bad=1");
	exit;
}

// THE SESSION IS NOT STARTED UNLESS THE LOGIN IS SUCCESSFUL?  THAT IS A RECIPE FOR CONFUSION
session_start();
$_SESSION['vavusr'] = $_POST['pwd'];
$_SESSION['user'] = $_POST['uc'];
$_SESSION['alast_used'] = time();	
header("Location: admin_menu.php");
exit;

// THE ZEND CODING STANDARD RECOMMENDS ELIMINATING THE CLOSING PHP TAG. OMIT IT.
?>

Open in new window

0
 
LVL 108

Expert Comment

by:Ray Paseur
ID: 36497867
Regarding this, Session variables do not persist across domains.

I think the issue might be across sub-domains?  That may or may not be true.  If you need session variables to persist across sub-domains, it is easy enough to make it happen.  You just have to set the session cookie yourself.  If you do not set the session cookie yourself, the PHP session handler will set a cookie that does not persist across sub-domains.  No cookie persists across domains - cookies are domain-specific.
0
 
LVL 108

Expert Comment

by:Ray Paseur
ID: 36497924
Same general comments apply to admin-menu.php -- you need to use error_reporting(E_ALL) to see what might be going on.  You need to replace the deprecated code, etc.  You might want to ask yourself why you are testing $tdiff and mucking up the client session.  PHP has its own session timeout mechanism.  I think I would use that instead or trying to write my own.
0
 

Author Comment

by:Richard Korts
ID: 36503554
To Ray_Paseur:

Thank you for all your comments & your impressive tutorial on this general subject.

However, I have been successfully using the technique I described on other sites.

As it turns out, the comment by haloexpertsexchange:solved the problem, moving the session_start to the beginning resolved the issue.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will explain how to display the first page of your Microsoft Word documents (e.g. .doc, .docx, etc...) as images in a web page programatically. I have scoured the web on a way to do this unsuccessfully. The goal is to produce something …
Generating table dynamically is the most common issue faced by php developers.... So it seems there is a need of an article that explains the basic concept of generating tables dynamically. It just requires a basic knowledge of html and little maths…
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…
The viewer will learn how to create a basic form using some HTML5 and PHP for later processing. Set up your basic HTML file. Open your form tag and set the method and action attributes.: (CODE) Set up your first few inputs one for the name and …

911 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

17 Experts available now in Live!

Get 1:1 Help Now