Forum Moderators: coopster
I just want to say thanks to any help in advance.
I have a webpage that is setup to use PHP sessions. I am using an IF ELSE statement to determine whether to show a login box, or a welcome message. When i login, it successfully recognizes that i have logged in and displays the welcome message as opposed to the login box. Upon refresh of the page or if i navigate away and come back, the login box appears again as if my session does not exist anymore.
My question, how can i set it up so that my session will remain active until i either logout, or close the IE window all together. I dont want my session to be terminated if i just navigate away from the page or refresh it
THANKS!
Here is the code...Am i doing something that is not commonly practiced or is my code not up to par?
THANKS!
<?php
session_start();
include ("/var/secure/db.php");
$sql = mysql_connect("$db_ip","$db_user","$db_pass");
if (! $sql) {
die('Could not connect to server: ' . mysql_error());
}
elseif(! mysql_select_db("$db_name", $sql)){
die('Could not open database: ' . mysql_error());
}
$_SESSION['username'] = mysql_real_escape_string($_POST['username']);
$_SESSION['password'] = mysql_real_escape_string($_POST['password']);
$select = "select * from table
where username = '" . $_SESSION['username'] . "'
and password= '" . $_SESSION['password'] . "'";
$query = mysql_query( $select );
$array = mysql_fetch_array($query);
$_SESSION['firstname'] = $array['firstname'];
$_SESSION['lastname'] = $array['lastname'];
$_SESSION['address'] = $array['address'];
$_SESSION['city'] = $array['city'];
$_SESSION['state'] = $array['state'];
$_SESSION['zipcode'] = $array['zipcode'];
$_SESSION['homephone'] = $array['homephone'];
$_SESSION['workphone'] = $array['workphone'];
$_SESSION['email'] = $array['email'];
?>
<?php
if ( mysql_num_rows( $query ) == 1 )
{
echo "<strong>Welcome ",$_SESSION['firstname']," ",$_SESSION['lastname'],"</strong> ¦ ","<a href='#' title='My Account'>My Account ¦ </a>","<a href='#' title='Logout'>Logout ¦</a>";
}
else
{
echo "<form name='login' action='' method='post'>";
echo "User Name:<input name='username' type='text' title='User Name' />";
echo "Password:<input name='password' type='password' title='Password' />";
echo "<input type='submit' value='Go' />";
echo "</form>";
}
?>
$sql = mysql_connect("$db_ip","$db_user","$db_pass") or die('Could not connect to server: '.mysql_error());
mysql_select_db("$db_name", $sql) or die('Could not ...');
Have you checked your sessions using a constant value? Like $_SESSION['email'] = 'test@example.com';
As if you get test@ then the problem lies with the database and not the sessions.
Also, I just wanted to make a comment about my initial post. I said i dont want the session to be terminated when i navigate away or refresh the page. Refreshing the page will actually resubmit the POST and will tehrefore give the desired result...so in actuallity, i dont want the session to terminate if i navigate away and then come back...
<?php
session_start();
include ("/secure/db.php");
$sql = mysql_connect("$db_ip","$db_user","$db_pass");
if (! $sql) {
die('Could not connect to server: ' . mysql_error());
}
elseif(! mysql_select_db("$db_name", $sql)){
die('Could not open database: ' . mysql_error());
}
if ($_SESSION['id']) {
}
else
{
$_SESSION['username'] = mysql_real_escape_string($_POST['username']);
$_SESSION['password'] = mysql_real_escape_string($_POST['password']);
$select = "select * from table
where username = '" . $_SESSION['username'] . "'
and password= '" . $_SESSION['password'] . "'";
$query = mysql_query( $select );
$array = mysql_fetch_array($query);
$_SESSION['id'] = $array['id'];
$_SESSION['firstname'] = $array['firstname'];
$_SESSION['lastname'] = $array['lastname'];
$_SESSION['address'] = $array['address'];
$_SESSION['city'] = $array['city'];
$_SESSION['state'] = $array['state'];
$_SESSION['zipcode'] = $array['zipcode'];
$_SESSION['homephone'] = $array['homephone'];
$_SESSION['workphone'] = $array['workphone'];
$_SESSION['email'] = $array['email'];
}
function logout()
{
$_SESSION = array();
session_destroy();
setcookie("username", NULL, time()-3600);
setcookie("password", NULL, time()-3600);
header("Location: index.php");
}
if (isset($_GET["logout"]))
logout();
?>
<?php
if ($_SESSION['id'])
{
echo "<strong>Welcome ",$_SESSION['firstname']," ",$_SESSION['lastname'],"</strong> ¦ ","<a href='#' title='My Account'>My Account ¦ </a>","<a href='#' title='Logout'>Logout ¦</a>";
}
else
{
echo "<form name='login' action='' method='post'>";
echo "User Name:<input name='username' type='text' title='User Name' />";
echo "Password:<input name='password' type='password' title='Password' />";
echo "<input type='submit' value='Go' />";
echo "</form>";
}
?>
Your revision is ok but it's a good idea to get into the habit of checking for an empty result from a query:
$query = mysql_query( $select );
if(mysql_num_rows($query)) {
$array = mysql_fetch_array($query);
$_SESSION['id'] = $array['id'];
.
.
} // EndIf got valid name/pass
As a side note, if the variables used in your connect line are strings you don't really need the quotes - they don't hurt anything, but it's extra typing ;)
$sql = mysql_connect($db_ip,$db_user,$db_pass);
And another side note (there's nothing wrong with the way you're doing it), you can refer to array elements inside quotes by surrounding them with curly braces:
$select = "select * from table
where username = '{$_SESSION['username']}'
and password= '{$_SESSION['password']}'";
Good work, really you figured it out on your own.
Thanks Again!
setcookie("password", NULL, time()-3600);
Am I correct in assuming that you are storing a password in a cookie?
I put it in the session, as cookies are written in plan text and assuming you are using http not https these will be available for all to see. As the session cookie links the person to there session data you can store passwords in the session and use those when they are needed.
