Sessions!

[1337-Dev]

OMG, I hate sessions! I think ive learnt that globals OFF suits me better though. Can someone point me to a tutorial that uses globals OFF. A simple sessions tutorial that helps u code the basic session for a login script. I really need one but i cant seem to find one that helps me enough .

[probonic]

session_start();
 // do whatever with the session variables, e.g.:
 $_SESSION['foo'] = 'bar';
 session_end(); 

session_start() will generate a new session ID if the user doesn't currently have a session. The way I do sessions for logging in is :-

// dologin.php :
 session_destroy();  // make sure we start a new session
 session_start();
 // check $_POST['password'] is ok
 $_SESSION['username'] = $_POST['username'];
 header('Location: main.php');
 session_end(); 

// main.php :
 session_start();
 if (!$_SESSION['username'] || $_SESSION['username'] == '') {
     // No session or session is invalid - throw back to the login form
     header('Location: index.php');
 }
 // Rest of page goes here
 session_end(); 

That's a very simplistic set of scripts but it shows you the basics.

Hope this helps you.

[1337-Dev]

WOW that really does help thanks a lot. How would i maintain this for all the pages i wanted to keep "member only". Would it be something like:

session_start();
if (!$_SESSION['username'] || $_SESSION['username'] == '') {
    // No session or session is invalid - throw back to the login form
    header('Location: index.php');
}
else {
// load the page 
}
session_end();
session_destroy(); 

Or something along those lines.

Oh and im confused about:

// dologin.php :
session_destroy();  // make sure we start a new session
session_start();
// check $_POST['password'] is ok
$_SESSION['username'] = $_POST['username'];
header('Location: main.php');
session_end(); 

because i dont know how to impliment this into the rest of my login.php code, so say it does the database checks, and if its all sucessfull etc, then the session is started using the submitted username, using the above code.

[1337-Dev]

This is my login.php code if it helps(the part that would concern you): I submitted it seperate to make it easier to read.

mysql_select_db($db)or die("Could not select the database");
    if($loguser=="guest" && $logpass=="guest"){
    echo "Thank you. You have logged in as <b>Guest</b>. You will be re-directed to the website very soon.";
    echo "<META http-equiv='refresh' content='5;URL=index2.php'>";
    }
        else {
        $query="SELECT * FROM users WHERE username='$loguser' && password='$logpass'";
        $result=mysql_query($query);
            if(mysql_num_rows($result) < 1){
            echo "One or more of the details you tried were invalid, please go back and try again.";
            } 
                else {
                echo "Congratulations you logged in successfully as <b>$loguser</b>. You will be re-directed to the website very soon.";
                echo "<META http-equiv='refresh' content='5;URL=index2.php?username=".$_POST['loginuser']."'>";
                }
            
        }
}
?> 

[maxor]

This is my login.php code if it helps(the part that would concern you): I submitted it seperate to make it easier to read.
<snip>

mysql_select_db($db)or die("Could not select the database");
    if($loguser=="guest" && $logpass=="guest"){
    echo "Thank you. You have logged in as <b>Guest</b>. You will be re-directed to the website very soon.";
    echo "<META http-equiv='refresh' content='5;URL=index2.php'>";
    }
        else {
        $query="SELECT * FROM users WHERE username='$loguser' && password='$logpass'";
        $result=mysql_query($query);
            if(mysql_num_rows($result) < 1){
            echo "One or more of the details you tried were invalid, please go back and try again.";
            } 
                else {
                                                   session_destroy();
                                                   session_start();
                                                   $_SESSION['username'] = $loguser;
                                                   session_end();
                echo "Congratulations you logged in successfully as <b>$loguser</b>. You will be re-directed to the website very soon.";
                echo "<META http-equiv='refresh' content='5;URL=index2.php?username=".$_POST['loginuser']."'>";
                }
            
        }
}
?> 

Give this a shot.

[1337-Dev]

I can't tonight because for some reason the domain wont let me access using FTP. Ill update login.php tomorrow, and try it out, and ill post what happens. Thanks .