Displaying username using $_SESSION['username']

Question

When I try to display the username of a logged-in user I get 'Welcome, 1' where 1 should be the username of the person logged in. This is my code in the members.php. The commented out line doesn't work either.

<?php
require_once('include.php');
?>
<?php
// echo "welcome, {$_SESSION['username']}";     
$user = $_SESSION['username'];

echo "Welcome $user";

?>

The user is logged in, I wonder if I've made a mistake in the check-login page. The code for the check_login page is:

<?php 
require_once('include.php');

$username = trim($_POST['user']);
$password = trim($_POST['pass']);

$username = stripslashes($username);
$password = stripslashes($password);
$username = mysql_real_escape_string($username);
$password = mysql_real_escape_string($password);

$sql="SELECT * FROM user WHERE username='$username' and password='$password';";
$result = mysql_query($sql);

$count = mysql_num_rows($result);

if($count !== 0){

$_SESSION['logged-in'] = true;
header("location:members.php?user=$username");
exit; 
}
else {
$_SESSION['logged-in'] = false;
header("location:login_again.php");
exit;
}
?>

which redirects to the members.php page upon successful login. Anybody have any ideas why the username is '1' everytime? Many thanks

You are passing the username in `$username = trim($_POST['user']);` not with the superglobal `$_SESSION` — MISJHA, May 17 '13 at 19:12

Manoj Purohit · Accepted Answer · 2013-05-17T19:11:14.377

1

there needs to be a session_start() somewhere at the top of your code

<?php session_start();
require_once('include.php');
?>
<?php
// echo "welcome, {$_SESSION['username']}";     
$user = $_SESSION['username'];

echo "Welcome $user";

?>

you also need to set it before accessing it with session_start at the top of this file also

if($count>0){
$_SESSION['username']=$username;
$_SESSION['logged-in'] = true;
header("location:members.php?user=$username");
exit; 
}

your code is open for sql injection attacks, Use prepared statements instead

edited May 17 '13 at 19:11

answered May 17 '13 at 19:04

Manoj Purohit

3,413
1
15
17

Thanks. Can you include the session_start() function in the include.php? – Matthew Lillistone May 17 '13 at 21:24
Thankyou, something simple then. – Matthew Lillistone May 17 '13 at 21:27

score 0 · Answer 2 · answered May 17 '13 at 19:08

In your check_login page I don't see either session_start and the code for saving username into session so that you can retrieve it on the other page.

In check_login page please add:

session_start();

at the start and then set:

$_SESSION['username'] = $username;

so that you can retrieve and display it on the other page.

score 0 · Answer 3 · answered May 17 '13 at 19:40

Please check following points.

Make sure you set username in the Session variable.

From your code, I do not see any line like following:

$_SESSION['username'] = $username

Without setting, you can get nothing.

If you did session_start() before using $_SESSION variable.

session_start() is required function to be called if you gonna use $_SESSION variable.

Displaying username using $_SESSION['username']

3 Answers3