PHP isset function for website session not working correctly

Question

So i'm trying to do implement a log in for a website and I want it to change the menu bar on the top. However I do not get the desired outcome when using php sessions

I use session_start at the beginning

<?php
session_start();
?>

And then in order to change the menu bar I use

<?php
    if (!isset($_SESSION['username'])){
 ?>
<ul>
    <li><a href="Index.php">Home</a></li>
    <li><a href="About.php">About</a></li>
    <li><a onclick="document.getElementById('log').style.display='block'" style="width:auto;">Log In</a> </li>
</ul>
<?php
    }else if (isset($_SESSION['username'])){
?>
<ul>
    <li><a href="Index.php">Home</a></li>
    <li><a href="About.php">About</a></li>
    <li><a href="#logout">PLEASE LOG OUT</a></li>
</ul>
<?php
    }
?>

My modal box and script for the log is is the following is

<div id="log" class="modal">
    <form class="modal-content animate" action="logindata.php" method="post">
        <div class="container">
            <label for="uname"><b>Username</b></label>
            <input type="text" placeholder="Enter Username" name="usrname" required>
            <label for="psw"><b>Password</b></label>
            <input type="password" placeholder="Enter Password" name="psw" required>
            <button type="submit">Login</button>
        </div>
        <div class="container">
            <button type="button" onclick="document.getElementById('id01').style.display='none'" class="cancelbtn">Cancel</button>
        </div>
    </form>
</div>
<script>
    // Get the modal
    var modal = document.getElementById('log');
    // When the user clicks anywhere outside of the modal, close it
    window.onclick = function(event) {
        if (event.target == modal) {
            modal.style.display = "none";
        }
    }
</script>

And my logindata.php contains the following

<?php
$servername = "localhost";
$username = "root";
$password = "";
$dbname = "phpmysql";
$conn = new mysqli($servername, $username, $password, $dbname);
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}
$user1 = $email1 = $pass1 = "";
if ($_SERVER["REQUEST_METHOD"] == "POST") {
  $user1 = test_input($_POST["usrname"]);
  $pass1 = test_input($_POST["psw"]);
}  
function test_input($data) {
  $data = trim($data);
  $data = stripslashes($data);
  $data = htmlspecialchars($data);
  return $data;
}
$sql = "SELECT username, password, email FROM users";
$result = $conn->query($sql);
$row = $result->fetch_array();
if ($row["username"]==$user1 && $row["password"]==$pass1) {    
session_start();  
$_SESSION["username"] = $row["username"];
//$_SESSION["email"] = $row["email"];
header("Location: Main_login_authentication.php"); 
} else {
         header("Location: Denied.php"); 
}
$conn->close();
?>

I know its not a good tactic to send passwords over plaintext.

Do not use `test_input()`. It is a useless function, which will damage your data. — Dharman, Apr 15 '20 at 18:01
**Never store passwords in clear text or using MD5/SHA1!** Only store password hashes created using PHP's [`password_hash()`](https://php.net/manual/en/function.password-hash.php), which you can then verify using [`password_verify()`](https://php.net/manual/en/function.password-verify.php). Take a look at this post: [How to use password_hash](https://stackoverflow.com/q/30279321/1839439) and learn more about [bcrypt & password hashing in PHP](https://stackoverflow.com/a/6337021/1839439) — Dharman, Apr 15 '20 at 18:01

score -1 · Accepted Answer · answered Apr 15 '20 at 13:41

session_start needs to be at the first line of your code... i see that you have this on the other page but, this one was still wrong ;) otherwise, before the isset do a: print_r($_SESSION);

<?php
session_start(); 
$servername = "localhost";
$username = "root";
$password = "";
$dbname = "phpmysql";
$conn = new mysqli($servername, $username, $password, $dbname);
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
}
$user1 = $email1 = $pass1 = "";
if ($_SERVER["REQUEST_METHOD"] == "POST") {
  $user1 = test_input($_POST["usrname"]);
  $pass1 = test_input($_POST["psw"]);
}  
function test_input($data) {
  $data = trim($data);
  $data = stripslashes($data);
  $data = htmlspecialchars($data);
  return $data;
}
$sql = "SELECT username, password, email FROM users";
$result = $conn->query($sql);
$row = $result->fetch_array();
if ($row["username"]==$user1 && $row["password"]==$pass1) {     
$_SESSION["username"] = $row["username"];
//$_SESSION["email"] = $row["email"];
header("Location: Main_login_authentication.php"); 
} else {
         header("Location: Denied.php"); 
}
$conn->close();
?>

PHP isset function for website session not working correctly

1 Answers1