Trying to create a simple login page but my session seems to not be starting....

[psquillace]

Hello All:

 

I created a simple login form for my site which I cannot get to work and I do not understand why.  The login page is a simple username and password page and it connects to the db and all works fine as far as logging in.

 

It is when I want content blocked on other pages that is the problem.

 

On the very top of those pages I have,

 

session_start();

if (!(isset($_SESSION['myusername']) && $_SESSION['mypassword'] != '')) {
header ("Location: login.php");

exit();
}

 

For some reason though, when I go to the home page after successfully logging in, I go to the login page again.

 

The form action for that login is like this,

 

session_start();

$host="localhost"; // Host name
$username="wholesale_admin"; // Mysql username
$password="blackjack21"; // Mysql password
$db_name="kardwell_wholesale"; // Database name
$tbl_name="members"; // Table name

// Connect to server and select databse.
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");

// username and password sent from form
$myusername=$_POST['myusername'];
$mypassword=$_POST['mypassword'];

// To protect MySQL injection 
$myusername = stripslashes($myusername);
$mypassword = stripslashes($mypassword);
$myusername = mysql_real_escape_string($myusername);
$mypassword = mysql_real_escape_string($mypassword);

$sql="SELECT * FROM $tbl_name WHERE username='$myusername' and password='$mypassword'";
$result=mysql_query($sql);

// Mysql_num_row is counting table row
$count=mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if($count==1){

// Register $myusername, $mypassword and redirect to file "login_success.php"
session_register("myusername");
session_register("mypassword");
header("location:login_success.php");

}else {

echo include('wrong_username.htm');
}

 

Is there something I am doing wrong that someone can help me here get this working?

 

 

Thanks for any help with this,

 

Paul

 

 

[jl5501]

change these lines

 

session_register("myusername");
session_register("mypassword");

 

to

 

$_SESSION['myusername'] = $myusername;
$_SESSION['mypassword'] = $mypassword;

[Wolphie]

Use $_SESSION['variable_name'] = 'variable_value';

 

Also, I strongly advise that you not store the username and password in sessions. Use a flag, for example:

 

<?php
session_start();

if (!isset($_SESSION['logged'])) {
  // You are not allowed here
}
else {
  // Welcome back, user
}
?>

[psquillace]

Thanks Guys for all your help, one last question on this though.

 

I got it to work... FINALLY.... bleh.... but now, I want to say....

 

if (isset($_SESSION['myusername'])) {

 

make url HTTPS and if not just HTTP

 

is that possible or is that not how SSL works?

 

Thanks for any help or advice on this,

 

Paul