Making Session Variables Available in Consecutive Pages

Need session variable in later pages

[mvaz]

Hi All, I have just completed a login page for a little website I am developing as a hobby. What happens here is when a registered user logs in, his/her details like, login date, ip address are captured and logged in a separate table called memb_log, which has user_name as the unique field, same as the members table.

Now, I have figured out how to work on sessions in the login processing page, though I am not sure if this is the correct way.
session_start();
session_register('user_name');
$_SESSION['username'] = $user_name;
$_SESSION['login_time'] = $login_time;

However, when the user logs in with the correct credentials, his user name appears on the next page, which makes me believe that the above session is working.

There is a link to a separate page for logging out which destroys the session. However, before this happens, I want to update a field in the log table to show the time logged out. This must be the same row of the last log in, therefore I presume, I will be safe to say:

////On the logout Page
session_start();
if(session_is_registered('user_name')) {
$user_name = $_SESSION['username'];
$login_time = $_SESSION["$login_time"];
//session variable is registered, user is ready to logout
include_once $_SERVER['DOCUMENT_ROOT']."/mysite/includes/db_conx.php";
$logout_time =date('Y-m-d H:i:s');
$sql = "UPDATE member_log SET logout_time='$logout_time' WHERE user_name='$user_name' AND login_time='$login_time'";
mysql_query($sql);
mysql_close();

However, with the above script, the table is not update with the logout time.

Please could the experts review my code and advise where I have gone wrong with my sessions.

As this is the first time I am trying sessions, I am a bit lost and confused and therefore, any help is gratefully accepted. Thanks - Melwyn

[penders]

session_start(); 
session_register('user_name'); 
$_SESSION['username'] = $user_name; 
$_SESSION['login_time'] = $login_time;

I do not think you need to use session_register() here. (session_register() is deprecated as of 5.3.0) And in any case I would have thought it should be 'username' and not 'user_name' (to match the value in $_SESSION[])...?

if(session_is_registered('user_name')) { 
 $user_name = $_SESSION['username']; 
 $login_time = $_SESSION["$login_time"];

I would have thought that $_SESSION["$login_time"] would cause a "Notice - undefined Index" warning? Since $login_time is probably undefined at this stage. So, $login_time is probably not being read from your session and consequently your SQL UPDATE is failing. Do you have error_reporting(E_ALL) enabled? I think this should read:

if (isset($_SESSION['username'])) { 
 $user_name = $_SESSION['username']; 
 $login_time = $_SESSION['login_time'];

Registering a variable with $_SESSION [uk2.php.net]

Use of $_SESSION (or $HTTP_SESSION_VARS with PHP 4.0.6 or less) is recommended for improved security and code readability. With $_SESSION, there is no need to use the session_register(), session_unregister(), session_is_registered() functions.