Question

I am trying to store a session variable in the login page and then carry it over to the member page but for some reason the session variables are not storing when you go over to the member page.

<?php
error_reporting(E_ALL ^ E_NOTICE);
session_start();
$userid = $_SESSION['userid'];
$username = $_SESSION['username'];

?>

then a bunch of html. then next php code is…

<?php

$form = "<form action='login.php' method='post'>
<table>
<tr>
<td><input type='text' name='user' /></td>
</tr>
<tr>
<td><input type='password' name='password' /></td>
</tr>
<tr>
<td><input type='submit' name='loginbtn' value='Login' /></td>
</tr>
</table>
</form>";

if ($_POST['loginbtn']) {
$user = $_POST['user'];
$password = $_POST['password'];

if ($user) {
    if ($password){
        require("connect.php");

        $password = md5(md5("kjfiufj".$password."GSA54"));
        //make sure login info is correct
        $query = mysql_query("SELECT * FROM users WHERE username='$user'");
        $numrows = mysql_num_rows($query);

        if ($numrows == 1) {
            $row = mysql_fetch_assoc($query);
            $dbid = $row['id'];
            $dbuser = $row['username'];
            $dbpassword = $row['password'];
            $dbactive = $row['active'];

            if ($password == $dbpassword) {
                if ($dbactive == 1) {
                //set session info
                    $_SESSION['userid'] = $dbid;
                    $_SESSION['username'] = $username;


                    echo "logged in as        <strong>$dbuser</strong>. <a href='member.php'>Click here</a> to go to the member page.";
                }
                else
                    echo "User not active";
            }
            else
                echo "Wrong password.";
        }
        else
            echo "The username you entered was not found";

        mysql_close();
    }
    else 
        echo "What's the password brah?";


}
else 
    echo "What's the user name brah?";



}
else 
    echo $form;
?>

The code for the member page is

    <?php
error_reporting(E_ALL ^ E_NOTICE);
session_start();
$userid = $_SESSION['userid'];
$username = $_SESSION['username'];

?>

<?php
if ($username && $userid) {
    echo "Welcome <strong>$username</strong>,<a href='logout.php'>Logout</a>.";
}

else
    echo "Please login to acces this page <a href='login.php'>Login here</a>";



?>

Answer 1

Are you calling session_start() in your login page?

You have to call session_start() in every page that is going to access session variables if you have not set session.auto_start runtime configuration option to true.

EDIT

Actually, your $_SESSION['userid'] probably isn’t empty, because you’re actually assigning a defined variable to it as $_SESSION['userid'] = $dbid;

However, you are creating your $_SESSION['username'] by assigning the value of $username to it which seems to be undefined.

Maybe

$_SESSION['username'] = $username;

should be

$_SESSION['username'] = $dbuser;