Probably because you are not stating session_start() anywhere ... that I can see anyhow.
Overall this login method (never mind the class) is taking on an awful lot of responsibility.
A class ought to do one single thing, and do it properly.
It is OK to have a class which does very little but tells lots of other smaller classes what to do, delegating and orchestrating if you will.
Here are some pseudocode-ish ideas, not to strip your class down to one single thing, but to achieve a bit of a halfway house, so you should still recognise what it does - but also appreciate how some of the complexity and rigidity can be stripped out.
PHP Code:
class LoginValidator {
function __constructor(PDO $PDO ){
// set up your pdo as a member (property)
}
function checkCredentials($user ='', $password=''){
// just do one single select here ;
$query = "SELECT id, name, farmname, level FROM users WHERE email=:email AND password = :password";
on success -- tell $this->startSession($session_vars) to start the session
return true;
else (on fail)
return false;
}
private function startSession($session_vars){
// this imagines using another class which serves to be used in many places in your code
// either pass an array of values as an argument
// or access private members which checkCredentials() would set up for you
$s = new Session($session_vars);
}
}
// usage -- where $pdo is created elsewhere, it is already set up, you just pass it as an argument...
if( user and password are set ) {
$lv = new LoginValidator($pdo);
}
if( $lv->checkCredentials($_POST['user'], $_POST['password']) is false ){
NOW redirect the user to somewhere else
} else {
redirect the user back to the page
}
I am hinting at the existence of a simple Session class which does not yet exist, but is simple enough to code up (never mind find on the web somewhere)
Going back to the CheckCredentials class idea above (I have no idea what your class is called) even this name CheckCredentials is not accurate because as I have written it it is more accurately a CheckCredentialsAndStartSession class (I remember calling a similar class "Bouncer" -- as in a doorman

)
But still, it is now orchestrating, delegating to other classes what to do.
It does one basic thing (sort of), it checks to see if an instance of user and pass exist in the db
It delegates to a Session class
It is given an instance of a PDO which it needs to do its job (it should not care whether that is using a mysql or sqlite driver)
It leaves the responsibility of redirecting the user to the userland coder, though this could be another class too ...
You will notice I have completely ignored your clean() method, I can only guess what that does and surmise that it is not adding anything to the party at all.
Notice it does NOT check whether user and pass are even set, it is pretty dumb in that respect. You could smarten it up, you could start adding an array of different error messages ... but they would differ depending on which application was using it -- the downside would be that it would start cluttering up your LoginValidator.
Now the trick is, can you alter LoginValidator slightly so that it is not forever tied to your users/farm application?
Then you can use it, like the Session class, in many more of your development tasks.
My example is not meant to be perfect by any means, just some ideas to get you thinking, if some of this makes sense to you and interests you then it could be time to do some OOP study.
Bookmarks