Question

I have a question about PHP sessions. I use a session to keep a visitor logged in. I have made a site before with this and works perfect. Now I am making a Facebook app.

When logging in (checking if user is registered in database), I register id. After that I use:

if(session_is_registered("id"))
{
echo "Logged in";
}

So if it shows “Logged in” in the browser, I am absolutely sure that the session is registered. But when I go to the next page (which has session_start(); at the top of the page), there’s no session anymore. But if I go to the logout page (with session_destroy();), and then proceed to the login, the session is registered correctly. Also if I close all the browser windows and then go to login, it won’t register correctly.

I tried destroying the session right before registering the ‘id’, but that also doesn’t work.

I’m guessing I made a basic error, so someone on here should be able to help me without wasting a lot of time.

Please help me. I have wasted days on this.
Thanks in advance.

---

More code:

Where session is registered:

$id_query = mysql_query ("
    SELECT * FROM Tour11_deelnemers WHERE fb_id = '$user'");
    while ($record = mysql_fetch_assoc ($id_query))
        {
        $id = $record['deelnemer_id'];
        }
if($id > 0)
{
$speelid = $id;
session_register("speelid");
}

After that to check if it is registered:

if(session_is_registered("speelid"))
{
echo "Ingelogd";
}

session_is_registered() is same as isset() for $_SESSION.

So the thing I don’t understand is while session_is_registered() is true after it is registered, on the next page it is false again 🙁 unless I login immediately after going to logging out page (session_destroy();). So even if i destroy the session just before restarting it and registering again, it doesn’t help.

Answer 1

Here is a solution for you.

Set the session like this:

if(!isset($_SESSION['speelid'])){
   $id_query = mysql_query ("SELECT * FROM Tour11_deelnemers WHERE fb_id = '$user'");
        while ($record = mysql_fetch_assoc ($id_query)){
            $id = $record['deelnemer_id'];
        }
    if($id > 0){
        $_SESSION['speelid'] = $id;
    }
}

Check if a session is set like this:

if(isset($_SESSION['speelid'])){
    echo "Ingelogd";
}

Update

It seems like the issue is related to >= IE6 refusing to accept the session cookie generated by the php, when a .php file is referred from an .html file on a different server.

.HTML to .PHP session IE issue

When using session
variables in a .php file referred by a
frame (.html, or other file type) at a
different server than the one serving
the .php:

Under these conditions IE6 or later
silently refuses the session cookie
that is attempted to create (either
implicitly or explicitly by invoquing
session_start()).

As a consequence, your session
variable will return an empty value.

According to MS kb, the workaround is
to add a header that says your remote
.php page will not abuse from the fact
that permission has been granted.

Place this header on the .php file
that will create/update the session
variables you want:

Here is a full thread on this issue

Solution

The solution is to add this at the very top of the page which will SET the session.

<?php header('P3P: CP="CAO PSA OUR"'); ?>