Session and Back hyperlink

[ballouta]

Hello

 

I am using sessions for a simple login system.

the user will arrive to one of the pages where he needs to go back to his main page when he first loged in. when I press on "back to main page' link (login.php) the page gives an error, I have to login again!

 

how do I solve this problem?

 

thank you

 

[john-formby]

Can you post your code?

[waynew]

Wait while I rub my temples and see your code.

[ballouta]

Hi

the login.php page contains the following code:

 

<?php
session_start();

// html code goes here

include('CMS/global.inc.php');

$user=$_POST['user'];
$pass=$_POST['pass'];
$_SESSION['username'] = "$user"; // my old code was using the variable $user, then I had to use sessions so i wrote this line

$query = "SELECT * FROM `members` WHERE `user` = '$user' and `pass` = '$pass' AND `blk` = 'N' ";
$result = mysql_query($query);
$row = mysql_fetch_array($result);

	if (mysql_num_rows($result) > 0) {
echo "
<ul>
<li><font face='Verdana' size='2'><a href='upload/sendfile.php'>Send *ask file</a></font></li>
<li><font face='Verdana' size='2'><a href='../check.php'>Check for received files</a></font></li>
<li><font face='Verdana' size='2'><a href='credits.php'>Show credits history</a></font></li>
<li><font face='Verdana' size='2'><a href='history.php'>Show/Download files history</a></font></li>
<li><font face='Verdana' size='2'><a href='edit.php'>Edit account</a></font></li>";
</ul>";
}
else { echo "error"; }

?>

 

the above links are the pages in each member page. If I open the history.php page, i can see some data,,, ok.

when I press on a link in history page (Back to Main Page which login.php), the page doesn't work...

 

Note that history page have some queries to view history for files processes.

 

How do i fix this problem so the user can return back to his main page using a hyperlink?

 

thanks alot

 

 

[widox]

Do your other pages (check.php, credit.php, history.php) call session_start(); at the top of them?

 

Do those pages also POST to login.php? The way it's written says to always set $_SESSION['username'] to $user which is a POST variable. So, if your just using a plain HTML link, the session variable won't be set to anything because $_POST['user'] doesn't exist. You need to add a check in there to only set $_SESSION vars when say your login form is submitted to it.

Something like this:

if($_POST['loginFormSubmitted']) {
   $user=$_POST['user'];
   $pass=$_POST['pass'];
   $_SESSION['username'] = "$user";
} else {
   print_r($_SESSION);
}

 

So now when any of your other pages link to this page it will not try and set the $_SESSION var, but instead just display them. Try it out.

 

BTW

You should also be doing some sanitizing of those variables before you use them in queries!!

[ikmyer]

Wait while I rub my temples and see your code.

 

that actually work ??

[ballouta]

thank you all esp. widox

 

i will fix my code and test it then come back

 

take care