Question

I try tow write a login-page in php, however i have problems with a session-problem.

I have a index.php file, which should display internal/login page. Source:

<?php
include ("session_management.php");

if($_SESSION["UserID"] == -1 )
    include("login.php");
else
    include("calendar.php");
?>

my session_management.php looks like this:

<?php

    if(session_status() == PHP_SESSION_ACTIVE) {
        PRINT "session exists<br>";
        //session exists...
    }
    else {
        session_start();
                PRINT "new session<br>";

        $_SESSION["Username"] = 0;
        $_SESSION["UserID"] = -1;
    }
?>

and finally, my login.php file:

<?php
    if ($_SERVER['REQUEST_METHOD'] == 'POST') {
        if (isset ($_POST["username"]) && isset ($_POST["pwd"])
                && $_POST["username"] != '' && $_POST["pwd"] != ''){
            $_SESSION["UserID"] = 1;
            $_SESSION["Username"] = "abc";

        }
        else
            PRINT "need name AND pwd";
    }
//.. some code...

i have no idea why that doesn’t work (userid is -1 all the time, also after login, so login.php is shown all the time)

thanks for your help!

Answer 1

session_status() == PHP_SESSION_ACTIVE always returns false because you do not perform a session_start() before your test.

You always need to do a session_start(). It will either start a new session if a session cookie was not recieved, or reopen the existing session.

Change your session_management.php to this:

<?php
    session_start();
    if ( empty($_SESSION["Username"]) ) $_SESSION["Username"] = 0;
    if ( empty($_SESSION["UserID"]) ) $_SESSION["UserID"] = -1;
?>

And it’ll work.

If you at some point really want to destroy the session (logout):

<?php
    session_start();
    session_regenerate_id(true);
?>