managing session file separately to include in all file

Question

After logging, session will start. So i have to manage session.php in all my other files to manage session. Here is my login file:

<?php 
    if(isset($_POST['submit']))
    {
        include("connect.php");
        $user=mysqli_real_escape_string($con, $_POST['email']);
        $pass=mysqli_real_escape_string($con, $_POST['password']);
        $sql="SELECT * FROM users WHERE email='".$user."' AND password='".$pass."' ";
        $query=mysqli_query($con, $sql) or die(mysqli_error($con));
        $count=mysqli_num_rows($query);
        if($count==1)
        {   
            $row=mysqli_fetch_array($query);
            session_start();
            $_SESSION['user_id']=$row['uid'];
        }
        else {
            header("location:../index.php?error=1");
        }
        if(isset($_SESSION["user_id"])) {   
            header("location:../home.php");
        }
    }    
?>

And in sessions.php:

<?php
    session_start();
    session_regenerate_id();
    if($_SESSION["user_id"]) 
    {
        include("connect.php");
        $m1 = "select * from users where uid='".$_SESSION['user_id']."'";
        $m2 = mysqli_query($con, $m1);
        $m3 = mysqli_fetch_array($m2);
        $_SESSION['username'] = $m3['fname'].' '.$m3['lname'];
    } 
    else 
    if(!isset($_SESSION['user_id']))
    {
        header("location:index.php");
    }
?>

As the session is started in login.php itself, i get error in sessions.php 'Session is already started'. But if i remove session_start();, it redirects to index.php (login form). I am confused.

Can somebody help me in this?

Don't rely on the `real_escape_string()` functions to prevent SQL injection, [they alone are not sufficient](https://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string). You should use prepared statements with bound parameters, via either the [**mysqli**](https://secure.php.net/manual/en/mysqli.prepare.php) or [**PDO**](https://secure.php.net/manual/en/pdo.prepared-statements.php) drivers. [**This post**](https://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) has some good examples. — Alex Howansky, Nov 17 '17 at 15:09
**Never** store plain text passwords. Instead use [`password_hash()`](http://us3.php.net/manual/en/function.password-hash.php) and [`password_verify()`](http://us3.php.net/manual/en/function.password-verify.php). If you're using a version of PHP prior to 5.5, do **not** use MD5 or SHA1 to hash passwords. Instead you can use [this compatibility pack](https://github.com/ircmaxell/password_compat). — Alex Howansky, Nov 17 '17 at 15:09
@ Alex Howansky: yes i am using password_hash and Thanks for article on SQL injection. — user2669924, Nov 17 '17 at 15:14
You haven't said how/where you've included your sessions.php file into your login.php file (I'm assuming you have, though), but basically you just have to make sure your code follows a path where session_start(); isn't ever called twice. — ADyson, Nov 17 '17 at 15:15
there is not need to ass sessions.php in login file as the session starts from there itself right?. i have other files like dashboard.php, home.php... in that how do i manage session? — user2669924, Nov 17 '17 at 15:20
_"yes i am using password_hash"_ I'm confused. Your example quite clearly does not use password_hash or any other hashing. Did you post the wrong code? — Alex Howansky, Nov 17 '17 at 15:20
I just wanted to know the problem with sessions and managing sessions. so i have posted this raw code. — user2669924, Nov 17 '17 at 15:25
If this is not your real code, then post the relevant parts of your real code, not a made-up version, then we can understand exactly what you're doing, and there's less chance of mistakes in your re-creation. Anyway you said quite clearly "As the session is started in login.php itself, i get error in sessions.php". This means that both those files must be included within the same execution sequence somehow - either one is including the other, or a 3rd script is including both of them. Otherwise login.php could not be causing a problem in session.php. — ADyson, Nov 17 '17 at 16:19

score 0 · Answer 1 · answered Jan 31 '19 at 07:18

Many commenters have pointed out issues with the question as asked. I can't comment, so I'll offer this bit of advice.

die(mysqli_error($con))

These errors should go to a log file, not printed for the user to see. Someone could find vulnerabilities in your system by reading the error message and exploit them. Don't make it easy for them!

score 0 · Answer 2 · answered Jan 31 '19 at 07:50

<?php 
        session_start();
        $user_id =  $_SESSION['user_id'];
        if(isset($_POST['submit']))
        {
            include("connect.php");
            $user=mysqli_real_escape_string($con, $_POST['email']);
            $pass=mysqli_real_escape_string($con, $_POST['password']);
            $sql="SELECT * FROM users WHERE email='".$user."' AND password='".$pass."' ";
            $query=mysqli_query($con, $sql) or die(mysqli_error($con));
            $count=mysqli_num_rows($query);
            if($count==1)
            {   
                $row=mysqli_fetch_array($query);

                $_SESSION['user_id']=$row['uid'];
            }
            else {
                header("location:../index.php?error=1");
            }
            if(isset($_SESSION["user_id"])) {   
                header("location:../home.php");
            }
        }    
    ?>

And in sessions.php:

<?php
    session_start();
    session_regenerate_id();
    if($user_id) 
    {
        include("connect.php");
        $m1 = "select * from users where uid='".$user_id."'";
        $m2 = mysqli_query($con, $m1);
        $m3 = mysqli_fetch_array($m2);
        $_SESSION['username'] = $m3['fname'].' '.$m3['lname'];
    } 
    else 
    if(!isset($user_id))
    {
        header("location:index.php");
    }
?>

a comment or two about how your changes correct the OP's error would benefit greatly! — JoSSte, Jan 31 '19 at 08:11

managing session file separately to include in all file

2 Answers2