session destroy woes.

calmchess · July 4, 2007

Hi a session destroy problem .........hi i'm using start_session in one page but it gets redirected and processed by a few other php pages during my login process .........so when i try to make a logout page and destroy the session i get a pesky session not intialized error but the session is still active in the browser and i can make calls to it....how do i destroy such a session? intializing the session on the logout page is not an option because then i get session already started errors....what do i do about this problem?

teng84 · July 4, 2007

may we see how you start and destroy your session

calmchess · July 4, 2007

hmmm well thats kinda complex there is a few hundred lines of code but it goes something like this user goes to login page and session is started ......the user logs in and his username is stored in the session then the user is redirected to the "main" page and given the option to continue using the site or they can logout if they choose the logout link then they are redirected to logout.php the code there says unset ($_SESSION'username'); and then update session array and then destroy session at that point i get could not destroy session because session not initialize error ...I will show you the main page where the session is created and the page where the session is destroyed that should be enough code for you to come up with the solution.

login.php



<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>video_chat</title>
</head>
<body>
<?
start_session();
/**
* Checks whether or not the given username is in the
* database, if so it checks if the given password is
* the same password in the database for that user.
* If the user doesn't exist or if the passwords don't
* match up, it returns an error code (1 or 2). 
* On success it returns 0.
*/
function confirmUser($username, $password){
   global $conn;
   /* Add slashes if necessary (for query) */
   if(!get_magic_quotes_gpc()) {
$username = addslashes($username);
   }

   /* Verify that user is in database */
   $q = "select password,picpath from login where username = '$username'";
   $result = mysql_query($q,$conn);

   if(!$result || (mysql_numrows($result) < 1)){
      return 1; //Indicates username failure


   }

   /* Retrieve password from result, strip slashes */
   $dbarray = mysql_fetch_array($result);
   $dbarray['password']  = stripslashes($dbarray['password']);
   $password = stripslashes($password);
   $picpath = $dbarray['picpath'] ;
   $_SESSION['picpath'] = $picpath;
   
  
  
  

   /* Validate that password is correct */
   if($password == $dbarray['password']){
      return 0; //Success! Username and password confirmed
  

   }
   else{
      return 2; //Indicates password failure
   }
}

/**
* checkLogin - Checks if the user has already previously
* logged in, and a session with the user has already been
* established. Also checks to see if user has been remembered.
* If so, the database is queried to make sure of the user's 
* authenticity. Returns true if the user has logged in.
*/
function checkLogin(){
   /* Check if user has been remembered */
   if(isset($_COOKIE['cookname']) && isset($_COOKIE['cookpass'])){
      $_SESSION['username'] = $_COOKIE['cookname'];
      $_SESSION['password'] = $_COOKIE['cookpass'];
   }

   /* Username and password have been set */
   if(isset($_SESSION['username']) && isset($_SESSION['password'])){
      /* Confirm that username and password are valid */
      if(confirmUser($_SESSION['username'], $_SESSION['password']) != 0){
         /* Variables are incorrect, user not logged in */
         unset($_SESSION['username']);
         unset($_SESSION['password']);
         return false;
      }
      return true;
   }
   /* User not logged in */
   else{
      return false;
   }
}

/**
* Determines whether or not to display the login
* form or to show the user that he is logged in
* based on if the session variables are set.
*/
function displayLogin(){
   global $logged_in;
   if($logged_in ){
  
   
?>
<a href="http://localhost/secure_php/logout.php" title="reRegister">logout</a>
<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7,0,0,0" width="1024" height="500" id="final_record_broadcaster" align="middle">
<param name="allowScriptAccess" value="sameDomain" />
<param name="movie" value="final_record_broadcaster.swf" />
<param name="quality" value="high" /><param name="bgcolor" value="#ffffff" />
<embed src="final_record_broadcaster.swf" quality="high" bgcolor="#ffffff" width="1024" height="500" name="final_record_broadcaster" align="middle" allowScriptAccess="sameDomain" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer" />
</object>

<?
}
   else{
  ?>
  <h1>Login</h1>
<form action="" method="post">
<table align="left" border="0" cellspacing="0" cellpadding="3">
<tr><td>Username:</td><td><input type="text" name="user" maxlength="30"></td></tr>
<tr><td>Password:</td><td><input type="password" name="pass" maxlength="30"></td></tr>
<tr><td colspan="2" align="left"><input type="checkbox" name="remember">
<font size="2">Remember me next time</td></tr>
<tr><td colspan="2" align="right"><input type="submit" name="sublogin" value="Login"></td></tr>
<tr><td colspan="2" align="left"><a href="register.php">Join</a></td></tr>
</table>
</form>
  
  <?
   }
}


/**
* Checks to see if the user has submitted his
* username and password through the login form,
* if so, checks authenticity in database and
* creates session.
*/
if(isset($_POST['sublogin'])){
   /* Check that all fields were typed in */
   if(!$_POST['user'] || !$_POST['pass']){
      die('You didn\'t fill in a required field.');
   }
   /* Spruce up username, check length */
   $_POST['user'] = trim($_POST['user']);
   if(strlen($_POST['user']) > 30){
      die("Sorry, the username is longer than 30 characters, please shorten it.");
   }

   /* Checks that username is in database and password is correct */
   $md5pass = md5($_POST['pass']);
   $result = confirmUser($_POST['user'], $md5pass);

   /* Check error codes */
   if($result == 1){
      die('That username doesn\'t exist in our database.');
   }
   else if($result == 2){
      die('Incorrect password, please try again.');
   }

   /* Username and password correct, register session variables */
   $_POST['user'] = stripslashes($_POST['user']);
   $_SESSION['username'] = $_POST['user'];
   $_SESSION['password'] = $md5pass;
   

   /**
    * This is the cool part: the user has requested that we remember that
    * he's logged in, so we set two cookies. One to hold his username,
    * and one to hold his md5 encrypted password. We set them both to
    * expire in 100 days. Now, next time he comes to our site, we will
    * log him in automatically.
    */
   if(isset($_POST['remember'])){
      setcookie("cookname", $_SESSION['username'], time()+60*60*24*100, "/");
      setcookie("cookpass", $_SESSION['password'], time()+60*60*24*100, "/");
   }

   /* Quick self-redirect to avoid resending data on refresh */
   echo "<meta http-equiv=\"Refresh\" content=\"0;url=$HTTP_SERVER_VARS[php_SELF]\">";
   return;
}

/* Sets the value of the logged_in variable, which can be used in your code */
$logged_in = checkLogin();

?>

</body>
</html>

logout.php

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
</head>
<?

include("database.php");
include("login.php");

/**
* Delete cookies - the time must be in the past,
* so just negate what you added when creating the
* cookie.
*/
if(isset($_COOKIE['cookname']) && isset($_COOKIE['cookpass'])){
   setcookie("cookname", "", time()-60*60*24*100, "/");
   setcookie("cookpass", "", time()-60*60*24*100, "/");
}

?>

<html>
<title>Logging Out</title>
<body>

<?

if($logged_in){
   
?>
<h1>Error!<br>You are  currently logged in, logout failed. Close browser window to logout <a href=\"main.php\">OK</a></h1>
   
<?
}
else{
   /* Kill session variables */
   unset($_SESSION['username']);
   unset($_SESSION['password']);

   $_SESSION = array(); // reset session array
   session_destroy('username','password','picpath');   // destroy session.

?>
<h1>Logged Out<br>You have successfully <b>logged out</b></h1>

<?
   }

?>


</body>
</html>

john010117 · July 4, 2007

First of all, I suggest you put session_start() at the beginning of login.php. Then, in logout.php, you have to start the session first, then destroy it.

calmchess · July 4, 2007

i did that but when i try to use start_session(); in logout.php i get the error cannot send session cache limiter -headers already sent errors so how do i kill the session that was started 1 or 2 pages previous to the logout script being called.??

john010117 · July 4, 2007

Did you put session_start() at the very beginning of both files?

calmchess · July 4, 2007

yes even before any html........it looks like this

<? start_session();?>
<html></html>

calmchess · July 5, 2007

bump anybody know what i should do?

teng84 · July 5, 2007

session_destroy('username','password','picpath');

change to

session_destroy(); i guess its better

teng84 · July 5, 2007

yes even before any html........it looks like this
<? start_session();?>
<html></html>

:-\ :-\ :-\ :-\ :-\

session_start(); not that start_session

teng84 · July 5, 2007

they mean put the star tat the top

see this

<?

session_start();

?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

<title>video_chat</title>

</head>

<body>

calmchess · July 5, 2007

yes i've done that but still all the errors that i previously described

teng84 · July 5, 2007

i tried to edit your code but theres a cokie and a session im confuze what is real session or cookie

dewey_witt · July 5, 2007

Correct me if Im wrong but arn't session destroyed automaticly when the user leaves

the site? This is the case for me on a couple of my sites. when you leave the site.....and come back.... you have to start the login process over. isn't that a sign of session destroy? May not anwser your question, but Im inqizitive and want to know

calmchess · July 5, 2007

sure the session is destroyed when a user logs off but what if they don't close their browser window and they are out there cruiseing around with a session in their browser some people like the option of being able to logout especially if they don't want their username id or password to be remembered my scripts allow a username and password to be remembered if the user so desires it.

Sign In

session destroy woes.

Recommended Posts

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Join the conversation

Important Information