Question

I have a code below where it checks to see if a teacher is logged in or not. The $_SESSION variables to check teacher’s login in status through session is in the
member.php script.

<?php

session_start();

include('member.php');
include('teachername.php');
...

if ((isset($username)) && (isset($userid))){ 


...

}else{ 

echo "Please Login to Access this Page | <a href='./teacherlogin.php'>Login</a>";

}

?>

Now If the session has expired then it displays the Please Login to Access this Page message which is correct. But the problem I have that is that when Sessions
have expired, it starts displaying undefined $_SESSION variables notices on this page as I have sessions on this page.

But it does not show notices on every page after session expires. It only shows it for pages where the user has to confirm to log out. You see in the include(teachername.php) code
it displays the log out code which is this below:

<?php

...

        echo "Logged In: <b>{$_SESSION['teacherforename']} {$_SESSION['teachersurname']}</b> | <a id='teachlogout' href='./teacherlogout.php'>Logout</a>";
        echo "<br/><a id='resetlink' href='./resetpass.php'>Reset Your Password</a>";

        ?>

When the user clicks on the Logout link, it performs a session_destroy() which is below:

<?php

        if ((isset($username)) && (isset($userid))){

        session_destroy();

            echo "You have been Logged Out | <a href='./home.php'>Home</a>";
        }

        else {

            echo "You are Not Logged In";

        }



        ?>

What I am asking is that is it not destroying the session variables when the session has expired in some pages because of the confirmation I have placed in these
pages where user needs to confirm before being logged out because it seems like the only pages that is having problem showing undefined session variable errors are all
on these pages, the other php scripts don’t have this problem when session runs out.

Below is code for confirmation for logout:

$(function() {   

    function logoutHandler() {
    return confirm("You are currently creating an Assessment, are you sure you want to logout?" + "\n" + "(Your current assessment details will be lost)" + "\n");
}

$('#teachlogout').click(logoutHandler); 

#teachlogout is id of the logout link

Answer 1

You should check whether the session variable is set before trying to use it. I’d put that code outside the echo statement. e.g.

$firstname = isset($_SESSION['teacherforename'])?$_SESSION['teacherforename']:'';

And then treat a user without a name as not logged in.