asked on 9/7/2011

php Session issues

I am trying to control access to some web site "back end" pages via session & session variables.

I am using a technique I have used on other sites & it has always worked perfectly, until now.

Maybe there is a change in php 5?

See attached php files.

The chk_login.php is used to check the validity of the login & go to the admin menu. The admin_menu.php is self-explanatory.

But they don't work. After the timeout, the admin_menu page is just a blank page with the <!DocTYPE and <html tags at the top, rest of page completely blank.

What's wrong?

Thanks
admin-menu.php
chk-login.php

PHP

Last Comment

Richard Korts

9/8/2011

Ray Paseur

9/7/2011

The correct design pattern for PHP client authentication is available in this article.
https://www.experts-exchange.com/Web_Development/Web_Languages-Standards/PHP/A_2391-PHP-login-logout-and-easy-access-control.html

Please read it over and have a look at the code samples. It is intentionally simplistic, but it is the foundation of "how it's done."

Cornelia Yoder

9/7/2011

Make sure the webpages are all under the same domain level directory. Session variables do not persist across domains.

ASKER CERTIFIED SOLUTION

haloexpertsexchange

9/7/2011

THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.

View this solution by signing up for a free trial.

Members can start a 7-Day free trial and enjoy unlimited access to the platform.

See Pricing Options

Start Free Trial

Ray Paseur

9/7/2011

Here is the chk-login.php script annotated with some comments. Error checking is important when you are running queries. MySQL is not a black box -- it can and will fail for reasons that are outside of your control. You would want to trap these failures and take appropriate action.

<? // THIS USES THE SHORT-OPEN TAG.  SUGGEST YOU CONVERT TO THE FULL TAG LIKE <?php

// THIS NEEDS TO BE THE FIRST LINE OF EVERY SCRIPT
error_reporting(E_ALL);

// set up database
$Host = "db380492857.db.1and1.com";
$User = "dbo380492857";
$Password = "abcxyz";
$DBName = "db380492857";

// THE FOLLOWING INSTRUCTION CAN FAIL, AND MUST BE TESTED FOR SUCCESS
$Link = mysql_connect ($Host, $User, $Password);

// THE FIELDS HERE NEED TO BE ESCAPED
$qry = "SELECT * from admin where code = '" . $_POST['uc'] . "' and password = '" . $_POST['pwd'] . "'";

// THIS FUNCTION IS DEPRECATED - CHANGE IT. http://php.net/manual/en/function.mysql-db-query.php
$res = mysql_db_query ($DBName, $qry, $Link);

// HOW DO YOU KNOW WHAT VALUE IN IN $res?  YOU HAVE TO TEST IT BEFORE YOU TRUST IT IN ANOTHER FUNCTION
$n = mysql_num_rows($res);

// WHAT WOULD YOU DO IF $n == 3?  MAYBE YOU NEED A LIMIT IN THE QUERY
if ($n == 0) {
	header("Location: login.php?bad=1");
	exit;
}

// THE SESSION IS NOT STARTED UNLESS THE LOGIN IS SUCCESSFUL?  THAT IS A RECIPE FOR CONFUSION
session_start();
$_SESSION['vavusr'] = $_POST['pwd'];
$_SESSION['user'] = $_POST['uc'];
$_SESSION['alast_used'] = time();	
header("Location: admin_menu.php");
exit;

// THE ZEND CODING STANDARD RECOMMENDS ELIMINATING THE CLOSING PHP TAG. OMIT IT.
?>

Open in new window

Ray Paseur

9/7/2011

Regarding this, Session variables do not persist across domains.

I think the issue might be across sub-domains? That may or may not be true. If you need session variables to persist across sub-domains, it is easy enough to make it happen. You just have to set the session cookie yourself. If you do not set the session cookie yourself, the PHP session handler will set a cookie that does not persist across sub-domains. No cookie persists across domains - cookies are domain-specific.

Ray Paseur

9/7/2011

Same general comments apply to admin-menu.php -- you need to use error_reporting(E_ALL) to see what might be going on. You need to replace the deprecated code, etc. You might want to ask yourself why you are testing $tdiff and mucking up the client session. PHP has its own session timeout mechanism. I think I would use that instead or trying to write my own.

Richard Korts

9/8/2011

ASKER

To Ray_Paseur:

Thank you for all your comments & your impressive tutorial on this general subject.

However, I have been successfully using the technique I described on other sites.

As it turns out, the comment by haloexpertsexchange:solved the problem, moving the session_start to the beginning resolved the issue.