More problems with Sessions!

[rocky48]

I am trying to make my site more secure by staring a session at login which uses the user_id to identify a user.

I had a previous post which was to change password, which I eventually found was due to not putting ob_start before the session start.

 

Using this method I tried adding the same to another file, so that an intruder can't circumvent the login procedure.

When I run this file all I get is a blank screen, no errors are shown.  I added to show errors:

ini_set('display_errors',1);
error_reporting(E_ALL);

Here is the script that is not working:

<?php # MFC1066 - Club_Info.php
// This is the main page for the site.

ob_start();
session_start();
ini_set('display_errors',1);
error_reporting(E_ALL);
// Include the configuration file:
require_once ('includes/config.inc.php');
// Set the page title and include the HTML header:
$page_title = 'Club Info';
include ('includes/header1.html');

// If no user_id session variable exists, redirect the user:
if (!isset($_SESSION[$uid])) {
	$url = BASE_URL . 'index.php'; // Define the URL.
	ob_end_clean(); // Delete the buffer.
	header("Location: $url");
	exit(); // Quit the script.
?>
<?php
include ('includes/info.html');
?>
<?php // Include the HTML footer file:
include ('includes/footer1.html');
?>

Here is the Login script:

<?php # - login.php
// This is the login page for the site.
//ini_set('display_errors',1);
//error_reporting(E_ALL);
// Start output buffering:
ob_start();
session_start();
$uid=$_SESSION('user_id');
require_once ('includes/config.inc.php'); 
$page_title = 'Login';
include ('includes/header1.html');


if (isset($_POST['submitted'])) {
	require_once('includes/Connect_login.php');
	
	
	// Validate the email address:
	if (!empty($_POST['email'])) {
		$e = mysqli_real_escape_string ($dbc, $_POST['email']);
	} else {
		$e = FALSE;
		echo '<p class="error">You forgot to enter your email address!</p>';
	}
	
	// Validate the password:
	if (!empty($_POST['pass'])) {
		$p = mysqli_real_escape_string ($dbc, $_POST['pass']);
	} else {
		$p = FALSE;
		echo '<p class="error">You forgot to enter your password!</p>';
	}
	
	// Validate the BMFA No:
	if (!empty($_POST['BMFA'])) {
		$b = mysqli_real_escape_string ($dbc, $_POST['BMFA']);
	} else {
		$b = FALSE;
		echo '<p class="error">You forgot to enter your BMFA number!</p>';
	}
	
	if ($e && $p && $b) { // If everything's OK.
	
		// Query the database:
		$q = "SELECT user_id, first_name, user_level, BMFA_No FROM users WHERE (email='$e' AND pass=SHA1('$p') AND BMFA_No= ('$b')) AND active IS NULL";		
		$r = mysqli_query ($dbc, $q) or trigger_error("Query: $q\n<br />MySQL Error: " . mysqli_error($dbc));
		
		if (@mysqli_num_rows($r) == 1) { // A match was made.

			// Register the values & redirect:
			$_SESSION = mysqli_fetch_array ($r, MYSQLI_ASSOC);
			$_SESSION['loggedin']='user_id';
			
			mysqli_free_result($r);
			mysqli_close($dbc);
							
			$url = BASE_URL . 'mempage.php'; // Define the URL:
			ob_end_clean(); // Delete the buffer.
			header("Location: $url");
			exit(); // Quit the script.
				
		} else { // No match was made.
			echo '<p class="error">Either the email address and password entered do not match those on file or you have not yet activated your account.</p>';
			
		}
		
	} else { // If everything wasn't OK.
		echo '<p class="error">Please try again.</p>';
	}
	
	mysqli_close($dbc);

} // End of SUBMIT conditional.

?>

<h1>Login</h1>
<p>Your browser must allow cookies in order to log in.</p>

<form action="login3.php" method="post">
	<fieldset>
	<p><b>Email Address:</b> <input type="text" name="email" size="20" maxlength="40" /></p>
	<p><b>Password:</b> <input type="password" name="pass" size="20" maxlength="20" /></p>
	<p><b>BMFA No:</b> <input type="text" name="BMFA" size="20" maxlength="20" /></p>
	<div align="center"><input type="submit" name="submit" value="Login" /></div>
	<input type="hidden" name="submitted" value="TRUE" />
	</fieldset>
</form>
<h2>Forgot your password?  Click on this link:<a href="forgot_password.php"target="_blank">Forgot Password</a></h2>
<?php // Include the HTML footer.
include ('includes/footer1.html');
?>

I have isolated the problem to the redirect code lines 15 - 19, but can't see why it does not work!

Please can you help?

[Jacques1]

I see dozens of reasons why this doesn't work. You should read the replies.

 

This line:

if (!isset($_SESSION[$uid])) {

uses the content of a variable named “uid” as the index. But there is no such variable in your code. I guess you meant the literal string “user_id”.

 

Read the replies from your last thread and start programming more systematically. Right now, it seems like you just randomly shuffle fragments around.

Edited March 10, 2017 by Jacques1