Forum Moderators: coopster
In summary the login script is:
//start session
session_start();
header("Cache-control: private"); //IE 6 Fix
//if login details correct
$_SESSION['user'] = $user; //set user id
$_SESSION['password'] = md5($pswd); //set encrypted password
I then test that these session variable are set correctly on other pages that require users to be logged in.
It works for most users, and I have not been able to replicate the problem myself, but it is a recurring problem for a certain subset of users. I sometimes suggest a fresh install of a new browser which does tend to help, but I would really love to solve the problem completely.
I presume that the session variable are not being set correctly, but I can't think why this would be. Ensuring cookies are enabled on the browser doesn't seem to help.
Any Ideas? What should I look at?
Really appreciate any help!
Essentially they all say that after logging they are unable to view the "member only" pages, and are asked to login again. Going on what d40sithui has said, leads me to wonder whether the problem might be in the "checking user is logged in" code. Here is a summary of the function that does just that;
//Select the password for this user from the db
$sql = "SELECT pswd FROM user WHERE user_id = '$user_id' AND email = '$email'";
$result = mysql_query($sql);
//only proceed if there is just one such result
if (mysql_num_rows($result) == 1){
$res = mysql_fetch_row($result);
if ($_SESSION['password'] == md5(strtolower($res[0]))){
return true;
}
else{
//return false;
}
}
else{
//return false;
}
if ($_SESSION['password'] == md5(strtolower($res[0]))){to be a bit suspicious
//posts to local vars
$email=$_POST['email'];
$pswd=$_POST['pswd'];
$mess=$_GET['message'];
//check for just 1 of 2 entries .. give seperate error
if(($email && !$pswd) ¦¦ (!$email && $pswd)){
header("Location: ../login/login.php?error=2");
die('');
}
//if both email and password present
if($email && $pswd) {
//connect
connect();
$email = strtolower($email);
$pswd = strtolower($pswd);
//select the uid for the entry that corresponds to the username and password entered
$sql = "SELECT user_id, name FROM user WHERE email ='$email' AND pswd = '$pswd'";
$result = mysql_query($sql);
//if there is such entry then...
if(mysql_num_rows($result)){
$res = mysql_fetch_row($result);
//set the session variables
$_SESSION['contact_name'] = $res[1];//set contact name
$_SESSION['user_id'] = $res[0]; //set user id
$_SESSION['email'] = $email; //set email
$_SESSION['pswd'] = md5($pswd); //set encrypted password
.....
}
2)The way you check is user is logged in is kind of impractical. It is legit, but the majority of systems usually only check for the user id in the session(not the password). If it's present, the user is logged in and you've already checked the validity of the user using the login form. Furthermore, you shouldn't store passwords in the session because it just provides another way for someone to get it.
3) One minor thing is you should always use clean your data before actually making any transactions in the database. At the very least, use mysql_real_escape_string() to all data before comparing to ones in the database. This will help prevent any SQL Injection attempts.
4) All the passwords that are stored in your database should be encrypted - just in case someone gains access to the database, they still wont be able to see the actual password. It looks here as though only the password that you store in the session is encrypted.
