Session variables not working php

Question

Here are the code of my login page where the login script checks for the authenticity of the user and then redirects to inbox page using header function.

<?php
session_start();

include_once('config.php');
$user=htmlentities(stripslashes($_POST['username']));
$password=htmlentities(stripslashes($_POST['password']));
// Some query processing on database    

if(($id_user_fetched<=$id_max_fetched) && ($id_user_fetched!=0)){
$_SESSION['loggedIn'] = 'yes';
    header("Location:http://xyz/inbox.php?u=$id_user_fetched");
    //echo 'Login Successful';
    }else{
        echo 'Invalid Login';
        echo'<br /> <a href="index.html">Click here to try again</a>';
        }
}else{
    echo mysqli_error("Login Credentials Incorrect!");
    }
?>

The inbox.php page looks like this:

<?php
session_start(); 
echo 'SESSION ='.$_SESSION['loggedIn'];
if($_SESSION['loggedIn'] != 'yes'){
echo $message = 'you must log in to see this page.';
//header('location:login.php');
}
 //REST OF THE CODE

?>

Now with the above code, the inbox.php always shows the output: SESSION=you must log in to see this page. Which means that either the session variable is not being setup or the inbox.php is unable to retrieve the session variable. Where am i going wrong?

It should be `echo "Login Credentials Incorrect!" ;` not `echo mysqli_error("Login Credentials Incorrect!");` — undone, Oct 30 '13 at 19:31
Can you debug to confirm that the conditions of your `if` statement evaluates to `true`? (i.e echo a statement in the true and false block to see which one is firing) — Crackertastic, Oct 30 '13 at 19:32
1. do you call both scripts from the same domain? 2. do you use any kind of session_name, session_id, session_set_cookie? 3. session_start returns value, do you check it? — Iłya Bursov, Oct 30 '13 at 19:32
@Crackertastic Yes i can assure you that they evaluate to true. checked several times — Arihant, Oct 30 '13 at 19:33
@Arihant `if (!session_start()) die('Cannot start session');` — Iłya Bursov, Oct 30 '13 at 19:35
@undone i have omitted the not needed code here just to simplify the code for readers for the particular problem — Arihant, Oct 30 '13 at 19:35
@Arihant enable output of all errors in php.ini: error_reporting = E_ALL | E_STRICT display_errors = On display_startup_errors = On restart webserver, it will output several notices, maybe will give us clue — Iłya Bursov, Oct 30 '13 at 19:40
@IlyaBursov i added error_reporting(E_ALL); to the script and it gives no errors :/ — Arihant, Oct 30 '13 at 19:42
@Arihant error_reporting will not work with startup errors, so please do what I told, during restart you will also can get several notices — Iłya Bursov, Oct 30 '13 at 19:43
@Arihant it is impossible, your code should produce notices at least — Iłya Bursov, Oct 30 '13 at 20:01
could it possibly be a server error? i tried the most basic test examples as under: session.php session2.php: — Arihant, Oct 30 '13 at 20:17
If you are using a Content Delivery Network, make sure the header `PHPSESSID` is being forwarded — nathanfranke, Jan 21 '20 at 01:28

score 51 · Answer 1 · edited May 23 '17 at 12:25

51

Make sure session_start(); is called before any sessions are being called. So a safe bet would be to put it at the beginning of your page, immediately after the opening <?php tag before anything else. Also ensure there are no whitespaces/tabs before the opening <?php tag.

After the header redirect, end the current script using exit(); (Others have also suggested session_write_close(); and session_regenerate_id(true), you can try those as well, but I'd use exit();).

Make sure cookies are enabled in the browser you are using to test it on.

Ensure register_globals is off, you can check this on the php.ini file and also using phpinfo(). Refer to this as to how to turn it off.

Make sure you didn't delete or empty the session.

Make sure the key in your $_SESSION superglobal array is not overwritten anywhere.

Make sure you redirect to the same domain. So redirecting from a www.yourdomain.com to yourdomain.com doesn't carry the session forward.

Make sure your file extension is .php (it happens!).

PHP session lost after redirect

edited May 23 '17 at 12:25

Community

1
1

answered Oct 30 '13 at 20:00

revo

47,783
14
74
117

could it possibly be a server error? i tried the most basic test examples as under: session.php session2.php: – Arihant Oct 30 '13 at 20:13
2

I have same problem. Cause: there was no free disk space! – Cuarcuiu Nov 30 '15 at 17:12
same problem for me. i try to print the page using google cloud print but the session are closed/cleared. how to fix that – Karthi Feb 28 '17 at 12:44
Regarding #4: This feature has been DEPRECATED as of PHP 5.3.0 and REMOVED as of PHP 5.4.0. http://php.net/manual/en/security.globals.php – Chiwda Aug 28 '17 at 09:47
For me this problem is caused by no disk space, as Cuarculu. I suggest revo to add this cause in his list. Thanks – Tama Oct 04 '18 at 09:00
Seems so simple, but adding `exit;` was the solution for me after 30 minutes of (virtually) tearing my hair out. – jcgoble3 Mar 27 '20 at 02:51
2

#7 was key, being logged in on www and then testing on url without www makes session disappear! – Captain Fantastic May 05 '20 at 14:49
The 4th point of register_globals was very helpful. It solved my problem. Thank you. – Darshan Jain Sep 25 '20 at 13:26

Vadman · Answer 2 · 2018-04-20T03:29:31.730

12

I had the same issue for a while and had a very hard time figuring it out. My problem was that I had the site working for a while with the sessions working right, and then all of the sudden everything broke.

Apparently, your session_save_path(), for me it was /var/lib/php5/, needs to have correct permissions (the user running php, eg www-data needs write access to the directory). I accidentally changed it, breaking sessions completely.

Run sudo chmod -R 700 /var/lib/php5/ and then sudo chown -R www-data /var/lib/php5/ so that the php user has access to the folder.

edited Apr 20 '18 at 03:29

answered Jan 28 '14 at 03:16

Vadman

141
2
5

777 is a bad set of permissions for the session save folder. You need to change the ownership of the folder to allow the web server to write to it and prevent all other access. – user2182349 Aug 10 '15 at 12:28
1

HOOOOLY SHIT man, all the best in your life, I was literally crying because I couldn't get session onto the next page. – Rok Dolinar Mar 31 '16 at 20:09

score 8 · Answer 3 · edited Feb 05 '18 at 21:55

8

If you use a connection script, dont forget to use session_start(); at the connection too, had some trouble before noticing that issue.

edited Feb 05 '18 at 21:55

Community

1
1

answered Oct 01 '15 at 16:53

Luis Felipe de Melo

349
5
10

1

Oh! I had one form where I input username and try to use that username on other page. Basically, my mistake was to not call `session_start()` on another page where I retrieve that username. Thanks. That really helped. – Omkar76 Jul 29 '21 at 05:29

score 3 · Answer 4 · edited Nov 05 '16 at 13:38

3

Maybe if your session path is not working properly you can try session.save_path(path/to/any folder); function as alternative path. If it works you can ask your hosting provider about default path issue.

edited Nov 05 '16 at 13:38

Andrey Moiseev

3,914
7
48
64

answered Nov 05 '16 at 12:24

Ashraf Ali

31
1

score 2 · Answer 5 · answered Oct 30 '13 at 20:25

2

Just talked to the hosting service, it was an issue at their end. he said " your account session.save_path was not set as a result issue arise. I set it for you now."

And it works fine after that :)

answered Oct 30 '13 at 20:25

Arihant

3,847
16
55
86

score 2 · Answer 6 · answered Oct 31 '20 at 10:12

2

Maybe it helps others, myself I had

session_regenerate_id(false);

I removed it and all ok!

after login was ok... ouch!

answered Oct 31 '20 at 10:12

Oliver M Grech

3,071
1
21
36

score 1 · Answer 7 · answered Jul 05 '16 at 06:55

1

I had similar issue and with the cookie domain:

    ini_set('session.cookie_domain', '.domain.com');

the domain was setup wrong so all sessions were ignored because the user cookie was never set right hope this will help someone.

answered Jul 05 '16 at 06:55

talsibony

8,448
6
47
46

score 1 · Answer 8 · answered Sep 23 '17 at 19:57

1

The other important reason sessions can not work is playing with the session cookie settings, eg. setting session cookie lifetime to 0 or other low values because of simple mistake or by other developer for a reason.

session_set_cookie_params(0)

answered Sep 23 '17 at 19:57

Jacek Dziurdzikowski

2,015
2
13
20

score 0 · Answer 9 · answered May 24 '17 at 18:26

0

I encountered this issue today. the issue has to do with the $config['base_url'] . I noticed htpp://www.domain.com and http://example.com was the issue. to fix , always set your base_url to http://www.example.com

answered May 24 '17 at 18:26

Devqxz

51
1
6

score 0 · Answer 10 · answered May 25 '18 at 12:07

I was also facing the same problem i did the following steps to resolve the issue

I edited the file /etc/php.ini and searched the path session.save_path = "/var/lib/php/session" you have to give your session info

2 After that just changed the permission given below *chown root.apache /var/lib/php/session * That's it. These above steps resolve my issue

score 0 · Answer 11 · answered Aug 12 '21 at 20:53

Ensure values you write to your session are simple types. Complex types can cause all session changes to be dropped from memory.

I made the mistake of accidentally setting a session variable with an object value. This prevented the session from serializing and saving. The session appeared to be valid until the page refreshed.

A good way to verify this is to do a var_dump() of $_SESSION and exit() to ensure you are writing exactly what you expect.

echo '<pre>Session: ';
var_dump($_SESSION);
echo '</pre>';
exit();

In my case I could fix the issue by casting my username to string as follows:

$_SESSION['Username'] = (string)$userData->Username;

Cost: 1 nights sleep.

score 0 · Answer 12 · answered Dec 05 '22 at 19:11

0

In my case none of above are working then I use ob_clean at the top and it worked like a charm.

ob_clean();
session_start();

answered Dec 05 '22 at 19:11

Hadayat Niazi

1,991
3
16
28

Session variables not working php

12 Answers12

Linked

Related