Sessions Help

[Mundo]

<?
include "tpl/header.tpl";
include "tpl/navigation.tpl";

mysql_connect("localhost","root","");
mysql_select_db("ncfc");

$username = $_POST["username"];
$password = $_POST["password"];

$qry = mysql_query("SELECT * from users WHERE user_UserName='$username'and user_Password='$password'") or die ("Name and password not found or not matched");

$logon = mysql_fetch_array($qry);

$username = $logon['user_CommonName'];

if($logon) {
include "tpl/adminmenu.tpl";
$adminmenu = $_GET['adminmenu'];
echo $adminmenu;
}
else {
include "tpl/logon.tpl";
}

include "tpl/footer.tpl";

mysql_close();
?>

 

Ok, heres my code as it stands, I can login fine but what do I need to do when I want to carry this login to other pages? Would a cookie be the right answer?

 

if($logon) {

createcookie?

}

 

Any simple little example someone could give me?

 

Many thanks.

[Mundo]

Infact, I've decided to use sessions (it gives me more to write about afterwards)... Could somebody still give me a simple example? I thought a session would need to be stored in a MySQL DB, but all the tutorials say otherwise...!?

[Mundo]

<?
include "tpl/header.tpl";
include "tpl/navigation.tpl";

mysql_connect("localhost","root","");
mysql_select_db("ncfc");

$username = $_POST["username"];
$password = $_POST["password"];

$qry = mysql_query("SELECT * from users WHERE user_UserName='$username' and user_Password='$password'") or die ("Name and password not found or not matched");

$logon = mysql_fetch_array($qry);

$username = $logon['user_UserName'];

if($logon) {
@@	session_start();
$sid = session_id();
mysql_query("UPDATE users SET user_Session='$sid' WHERE user_UserName='$username'");
include "tpl/adminmenu.tpl";
session_destroy();
}
else {
include "tpl/logon.tpl";
}

include "tpl/footer.tpl";

mysql_close();
?>

 

Ok think I've got this right so far, but it seems to generate the same session_id() everytime? This can't be right? Maybe it's not destroying the old one...

[Mundo]

http://i40.tinypic.com/dcpzxx.png

 

From PHP.net:-

 

If you want to remove all variables from session and change SID first use

 

session_regenerate_id();

session_destroy();

 

if you do destroy first then regenerate_id your SID will not change

 

<?
include "tpl/header.tpl";
include "tpl/navigation.tpl";

mysql_connect("localhost","root","");
mysql_select_db("ncfc");

$username = $_POST["username"];
$password = $_POST["password"];

$qry = mysql_query("SELECT * from users WHERE user_UserName='$username' and user_Password='$password'") or die ("Name and password not found or not matched");

$logon = mysql_fetch_array($qry);

$username = $logon['user_UserName'];

if($logon) {
session_start();
$sid = session_id();
mysql_query("UPDATE users SET user_Session='$sid' WHERE user_UserName='$username'");
include "tpl/adminmenu.tpl";
session_regenerate_id();
session_destroy();
}
else {
include "tpl/logon.tpl";
}

include "tpl/footer.tpl";

mysql_close();
?>

 

What could be the problem here?! Why is it generating the same session_id everytime?

 

Basically I want to be able to visit /acp/index.php?sid=whatever&template=addnews so data can only be added to the database by somebody who is logged in...

[Mundo]

I'm totally confused here. The following:

session_start();

session_regenerate_id();

$sid = session_id();

echo $sid;

Works in it's own file but it will not work inside my IF statement...

[Mundo]

Ah, I sussed it. session_start() needs to be the first line so it can set the headers.

[jackpf]

Lol, did you actually make this thread so you can just talk to yourself? xD

[Cal]

I lol'd