0

I am making a website that allows users to login, so when I login it logs in, but if i refresh the page the session ends? I know that it should not be doing this. Basically my problem is my page is destroying the session when the page is refreshed. Any help would be much appreciated!

Heres my main login code:

if(isset($_POST['username'])&&isset($_POST['password'])) {
    $username = $_POST['username'];
    $password = $_POST['password'];
    $password_hash = md5($password);

    if (!empty($username)&&!empty($password)) {
        $query = "SELECT * FROM employees WHERE username = '$username' AND password = '$password_hash'";
        $query_run = mysql_query($query);
        $mysql_num_rows = mysql_num_rows($query_run);

        if ($mysql_num_rows == 0) {
            echo 'Unable to log in, username and/or password does not match!'.'<br><br>';
            echo '<a href = "#">Try Again!</a>';
        } else if ($mysql_num_rows == 1) {
            $user_id = mysql_result($query_run, 0, 'id');
            $first_name = mysql_result($query_run, 0, 'firstname');
            $last_name = mysql_result($query_run, 0, 'lastname');
            $user_name = mysql_result($query_run, 0, 'username');
            $pass_word = mysql_result($query_run, 0, 'password');
            $email = mysql_result($query_run, 0, 'email');
            $grade = mysql_result($query_run, 0, 'Security Clearance');
            $_SESSION['user_id']=$user_name;
        }
    }
}

Heres my core.php

    ob_start();
session_start();

function loggedin() {
    if(isset($_SESSION['user_id'])&&!empty($_SESSION['user_id'])) {
        return true;
    } else {
        return false;
    }
}

Heres my index page (the page the user see's when logged in)

    require 'core.php';
    require 'connect.inc.php'; 
    // The page to connect to my MySQL db
include 'main_login.inc.php';

    if (loggedin()) {
    // if logged in : do stuff  
    }
} else { 
    // if its not logged in : redirect
    // If User Is Not Logged: Redirect To Jamie Co Home
    header('Location: #');
}
New Europe
  • 31
  • 7
  • 1
    Is `session_start();` inside all your files? – Funk Forty Niner Jan 22 '14 at 23:07
  • Sidenote: You're using deprecated `mysql_*` functions along with using `md5` for password storage. Using both of these is highly discouraged, rendering your code [Open to SQL injection](http://stackoverflow.com/q/60174/) – Funk Forty Niner Jan 22 '14 at 23:09
  • Also this line is making me raise a brow `WHERE username = '$username' OR email = '$username'` why two instances of `$username` ? You may have meant to use `WHERE username = '$username' OR email = '$email'` which seems the most likely cause, or part of it. – Funk Forty Niner Jan 22 '14 at 23:14
  • It looks like he wants to log in with either username or email as username – milo5b Jan 22 '14 at 23:17
  • I'm aware of that, but this line doesn't make sense `WHERE username = '$username' OR email = '$username'` since there is a variable called `$email` @milo5b --- I doubt very much that the username and email are the same in both columns. – Funk Forty Niner Jan 22 '14 at 23:18
  • @Fred-ii- I think the variable $email is only to collect the result - however, if he wants to say either username o email he might have an operator precedence problem (username = $username OR email = $username) AND password = $password - but obviously he should use PDO as you noted :) – milo5b Jan 22 '14 at 23:22
  • I'm not convinced, since we/I don't know the OP's table schema. The OP isn't collecting, is querying the `email` column for a username, which theoretically should be an email address. This is just too vague a question to even bother putting in an answer until I know what the `full picture` looks like ;-) @milo5b – Funk Forty Niner Jan 22 '14 at 23:25
  • yep I agree, let's see if we get more info – milo5b Jan 22 '14 at 23:27
  • The question went up 1/2 hour ago and no word from the OP since comments were posted 2 minutes after. I hope the OP isn't expecting a `Magical Answer` to just appear that will fix everything, and it sure won't be coming from me, not now anyway. @milo5b – Funk Forty Niner Jan 22 '14 at 23:36
  • no Fred I don't expect a magical answer to anything nor should any programmer because we all encounter bugs and some are more than we can handle. I've also been reading all of the comments and tried everything suggested. @Fred -ii- – New Europe Jan 23 '14 at 04:23
  • Ok. Now, instead of using a function for this, the one that you have being `loggedin()` why not directly check if the session name is set instead, without the function? Because I tend to think that `if (loggedin())` is failing. – Funk Forty Niner Jan 23 '14 at 04:26
  • I have tried removing the function `loggedin()` and changing the `$_SESSION[''];` variable. I was also wondering if anyone knew whether it's the HTML affecting it because it works fine without the HTML – New Europe Jan 23 '14 at 04:46
  • This could be a factor `$_SESSION['user_id']=$user_name;` you should probably using `$_SESSION['user_id']=$_POST['username'];` instead. Have a look at this Question and Answer on SO >>> http://stackoverflow.com/q/20584584/ which may help you out. – Funk Forty Niner Jan 23 '14 at 05:02

1 Answers1

0

I have solved the problem by changing the session to a token, i'm not to sure why this works but it does!

New Europe
  • 31
  • 7