0

So for a school project I'm trying to make a login page were the user get's to see additional pages when he logs in. So far I can get a user to create an account and to get the data from the database. However, when I refresh the page to go to a different .php file where the additional pages are located. He doesn't seem to save the session and therefor he keeps loading the 'basic' page. I am new to all of this and I'm trying to learn. But at the moment I'm quit stuck. Any help would be greatly appreciated!

I'have got my index page where I distinguish wich page shoudl be loaded. If the user isn't logged in , he goes to header.php. If he is succesfully logged in he should go to headerlogin.php. That is where I am stuck. I've set up my database and that is working just fine.

index


<!-- Wrapper -->
<div id="wrapper">

    <!-- Header -->
    <?php
    //if user is not logged in show :
    if(!isset($_SESSION["user"])){
        $headerSentence = "Belgian Urban Exploring ";
        include('header.php');
    } else { //if user is logged in show :

        $headerSentence = "Welcome " . $_SESSION["user"] . "!";
        include('headerlogin.php');
    }

    //if user is logged in and not admin show :

    //else show :
    ?>

header

            <div class="modal-dialog modal-dialog-centered" role="document">
                <div class="modal-content">
                    <div class="modal-header">

                        <h5 class="modal-title" id="exampleModalCenterTitle">Log in: </h5>
                        <button type="button" class="close" data-dismiss="modal" aria-label="Close">
                            <span aria-hidden="true">&times;</span>
                        </button>
                    </div>
                    <div class="modal-body">
                        <form action="dologin.php" id="loginForm" method="POST">
                            <h4 id="userCreationMsg"></h4>
                            <div class="input">
                                <span id="loginError" class="SpecialRed"></span>
                                <label for="username">Username:</label>
                                <input type="text" name="username" id="loginUsername" value="<?php $valuesLogIn["username"] ?>">
                            </div>
                            <div class="input">
                                <label for="username">Password:</label>
                                <input type="password" name="password" id="loginPassword" value="<?php $valuesLogIn["password"]?>">
                            </div>

                            <div>
                                <span class="specialRed loginErrorMessage"></span>
                            </div>
                            <div class="input">
                                <input type="submit" id="submitLogin" value="logIn">
                            </div>
                            <div>
                                <input type="text" name="staylogged" placeholder="Write 'OK' if u want to stay logged in" value="<?php $valuesLogIn["stayloggedin"]?>">
                            </div>
                        </form>
                    </div>
                    <div class="modal-footer">
                        <button type="button" class="btn btn-primary" id="btn-signup">Don't have an account? Sign up here</button>
                        <button type="button" class="btn btn-secondary close-btn" data-dismiss="modal">Close</button>
                    </div>
                </div>
            </div>
        </div>

dologin


if($_SERVER['REQUEST_METHOD'] == 'POST') {

    if(isset($_POST["username"]) && isset($_POST["password"])){

        include_once "database/UserDB.php";
        $password = $_POST["password"];
        $hashed_password = hash("SHA512", $password);
        $result = UserDB::checkUserLogin($hashed_password, $_POST["username"]);
        if($result->username == $_POST["username"]){
            $data["success"] = true;
        }

    } else { $data["error"] = "Not al values are set";}
} else {
    $data["error"] = $_POST . "has no value";
}



if($result == true) {
    session_start();
    $_SESSION["user"] = $_POST["username"];
    $_SESSION["userid"] = $result->userId;

    if (isset($_POST["staylogged"])) {
        if ($_POST["staylogged"] === "OK") {
            //16years
            setcookie("UserIdCookie", $result->userId, time() + 60 * 60 * 24 * 6004, "/");
            setcookie("UserCookie", $result->username, time() + 60 * 60 * 24 * 6004, "/");
        } else {
            //3hours
            setcookie("UserIdCookie", $result->userId, time() + 60 * 60 * 2, "/");
            setcookie("UserCookie", $result->username, time() + 60 * 60 * 2, "/");
        }
    }
}
echo json_encode($data);

?>

Any information that could be useful would be helpful. The ideal scenario would be that someone could tell me why he won't load headerlogin.php.

Tim Lewis
  • 27,813
  • 13
  • 73
  • 102
Inyea
  • 47
  • 1
  • 7
  • 2
    Where is your `session_start` call? – Jonnix Aug 06 '19 at 20:31
  • Also https://stackoverflow.com/questions/490440/php-session-seemingly-not-working – Patrick Q Aug 06 '19 at 20:33
  • I'm sorry, I was struggeling with the layout. I've placed my session_start() in the dologin.php – Inyea Aug 06 '19 at 20:36
  • 1
    As indicated in the suggested duplicate(s), you need to use `session_start()` in _every_ file where you want to use `$_SESSION`, and it needs to be called before using the global. – Patrick Q Aug 06 '19 at 20:39

1 Answers1

0

First, carry out these usual checks:

  1. Make sure session_start(); is called before any sessions are being called. So a safe bet would be to put it at the beginning of your page, immediately after the opening <?php declaration before anything else. Also ensure there are no whitespaces/tabs before the opening <?php declaration.
  2. After the header redirect, end the current script using exit(); (Others have also suggested session_write_close(); and session_regenerate_id(true), you can try those as well, but I'd use exit();)
  3. Make sure cookies are enabled in the browser you are using to test it on.
  4. Ensure register_globals is off, you can check this on the php.ini file and also using phpinfo(). Refer to [this][1] as to how to turn it off.
  5. Make sure you didn't delete or empty the session
  6. Make sure the key in your $_SESSION superglobal array is not overwritten anywhere
  7. Make sure you redirect to the same domain. So redirecting from a www.yourdomain.com to yourdomain.com doesn't carry the session forward.
  8. Make sure your file extension is .php (it happens!)

https://stackoverflow.com/a/17242347/3739838

little_coder
  • 564
  • 3
  • 13