Jump to content

session destroy woes.


calmchess

Recommended Posts

Hi a session destroy problem .........hi i'm usingĀ  start_session in one page but it gets redirected and processed by a few other php pages during my login process .........so when i try to make a logout page and destroy the session i get a pesky session not intialized error but the session is still active in the browser and i can make calls to it....how do i destroy such a session? intializing the session on the logout page is not an option because then i get session already started errors....what do i do about this problem?

Link to comment
Share on other sites

hmmm well thats kinda complex there is a few hundred lines of code but it goes something like this user goes to login page and session is started ......the user logs in and his username is stored in the session then the user is redirected to the "main" page and given the option to continue using the site or they can logout if they choose the logout link then they are redirected to logout.php the code there says unset ($_SESSION'username'); and then update session array and then destroy session at that point i get could not destroy session because session not initialize error ...I will show you the main page where the session is created and the page where the session is destroyed that should be enough code for you to come up with the solution.

Ā 

login.php



<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>video_chat</title>
</head>
<body>
<?
start_session();
/**
* Checks whether or not the given username is in the
* database, if so it checks if the given password is
* the same password in the database for that user.
* If the user doesn't exist or if the passwords don't
* match up, it returns an error code (1 or 2). 
* On success it returns 0.
*/
function confirmUser($username, $password){
Ā   global $conn;
Ā   /* Add slashes if necessary (for query) */
Ā   if(!get_magic_quotes_gpc()) {
$username = addslashes($username);
Ā   }

Ā   /* Verify that user is in database */
Ā   $q = "select password,picpath from login where username = '$username'";
Ā   $result = mysql_query($q,$conn);

Ā   if(!$result || (mysql_numrows($result) < 1)){
Ā  Ā  Ā  return 1; //Indicates username failure


Ā   }

Ā   /* Retrieve password from result, strip slashes */
Ā   $dbarray = mysql_fetch_array($result);
Ā   $dbarray['password']Ā  = stripslashes($dbarray['password']);
Ā   $password = stripslashes($password);
Ā   $picpath = $dbarray['picpath'] ;
Ā   $_SESSION['picpath'] = $picpath;
Ā   
Ā  
Ā  
Ā  

Ā   /* Validate that password is correct */
Ā   if($password == $dbarray['password']){
Ā  Ā  Ā  return 0; //Success! Username and password confirmed
Ā  

Ā   }
Ā   else{
Ā  Ā  Ā  return 2; //Indicates password failure
Ā   }
}

/**
* checkLogin - Checks if the user has already previously
* logged in, and a session with the user has already been
* established. Also checks to see if user has been remembered.
* If so, the database is queried to make sure of the user's 
* authenticity. Returns true if the user has logged in.
*/
function checkLogin(){
Ā   /* Check if user has been remembered */
Ā   if(isset($_COOKIE['cookname']) && isset($_COOKIE['cookpass'])){
Ā  Ā  Ā  $_SESSION['username'] = $_COOKIE['cookname'];
Ā  Ā  Ā  $_SESSION['password'] = $_COOKIE['cookpass'];
Ā   }

Ā   /* Username and password have been set */
Ā   if(isset($_SESSION['username']) && isset($_SESSION['password'])){
Ā  Ā  Ā  /* Confirm that username and password are valid */
Ā  Ā  Ā  if(confirmUser($_SESSION['username'], $_SESSION['password']) != 0){
Ā  Ā  Ā  Ā   /* Variables are incorrect, user not logged in */
Ā  Ā  Ā  Ā   unset($_SESSION['username']);
Ā  Ā  Ā  Ā   unset($_SESSION['password']);
Ā  Ā  Ā  Ā   return false;
Ā  Ā  Ā  }
Ā  Ā  Ā  return true;
Ā   }
Ā   /* User not logged in */
Ā   else{
Ā  Ā  Ā  return false;
Ā   }
}

/**
* Determines whether or not to display the login
* form or to show the user that he is logged in
* based on if the session variables are set.
*/
function displayLogin(){
Ā   global $logged_in;
Ā   if($logged_in ){
Ā  
Ā   
?>
<a href="http://localhost/secure_php/logout.php" title="reRegister">logout</a>
<object classid="clsid:d27cdb6e-ae6d-11cf-96b8-444553540000" codebase="http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=7,0,0,0" width="1024" height="500" id="final_record_broadcaster" align="middle">
<param name="allowScriptAccess" value="sameDomain" />
<param name="movie" value="final_record_broadcaster.swf" />
<param name="quality" value="high" /><param name="bgcolor" value="#ffffff" />
<embed src="final_record_broadcaster.swf" quality="high" bgcolor="#ffffff" width="1024" height="500" name="final_record_broadcaster" align="middle" allowScriptAccess="sameDomain" type="application/x-shockwave-flash" pluginspage="http://www.macromedia.com/go/getflashplayer" />
</object>

<?
}
Ā   else{
Ā  ?>
Ā  <h1>Login</h1>
<form action="" method="post">
<table align="left" border="0" cellspacing="0" cellpadding="3">
<tr><td>Username:</td><td><input type="text" name="user" maxlength="30"></td></tr>
<tr><td>Password:</td><td><input type="password" name="pass" maxlength="30"></td></tr>
<tr><td colspan="2" align="left"><input type="checkbox" name="remember">
<font size="2">Remember me next time</td></tr>
<tr><td colspan="2" align="right"><input type="submit" name="sublogin" value="Login"></td></tr>
<tr><td colspan="2" align="left"><a href="register.php">Join</a></td></tr>
</table>
</form>
Ā  
Ā  <?
Ā   }
}


/**
* Checks to see if the user has submitted his
* username and password through the login form,
* if so, checks authenticity in database and
* creates session.
*/
if(isset($_POST['sublogin'])){
Ā   /* Check that all fields were typed in */
Ā   if(!$_POST['user'] || !$_POST['pass']){
Ā  Ā  Ā  die('You didn\'t fill in a required field.');
Ā   }
Ā   /* Spruce up username, check length */
Ā   $_POST['user'] = trim($_POST['user']);
Ā   if(strlen($_POST['user']) > 30){
Ā  Ā  Ā  die("Sorry, the username is longer than 30 characters, please shorten it.");
Ā   }

Ā   /* Checks that username is in database and password is correct */
Ā   $md5pass = md5($_POST['pass']);
Ā   $result = confirmUser($_POST['user'], $md5pass);

Ā   /* Check error codes */
Ā   if($result == 1){
Ā  Ā  Ā  die('That username doesn\'t exist in our database.');
Ā   }
Ā   else if($result == 2){
Ā  Ā  Ā  die('Incorrect password, please try again.');
Ā   }

Ā   /* Username and password correct, register session variables */
Ā   $_POST['user'] = stripslashes($_POST['user']);
Ā   $_SESSION['username'] = $_POST['user'];
Ā   $_SESSION['password'] = $md5pass;
Ā   

Ā   /**
Ā  Ā  * This is the cool part: the user has requested that we remember that
Ā  Ā  * he's logged in, so we set two cookies. One to hold his username,
Ā  Ā  * and one to hold his md5 encrypted password. We set them both to
Ā  Ā  * expire in 100 days. Now, next time he comes to our site, we will
Ā  Ā  * log him in automatically.
Ā  Ā  */
Ā   if(isset($_POST['remember'])){
Ā  Ā  Ā  setcookie("cookname", $_SESSION['username'], time()+60*60*24*100, "/");
Ā  Ā  Ā  setcookie("cookpass", $_SESSION['password'], time()+60*60*24*100, "/");
Ā   }

Ā   /* Quick self-redirect to avoid resending data on refresh */
Ā   echo "<meta http-equiv=\"Refresh\" content=\"0;url=$HTTP_SERVER_VARS[php_SELF]\">";
Ā   return;
}

/* Sets the value of the logged_in variable, which can be used in your code */
$logged_in = checkLogin();

?>

</body>
</html>

Ā 

logout.php

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
</head>
<?

include("database.php");
include("login.php");

/**
* Delete cookies - the time must be in the past,
* so just negate what you added when creating the
* cookie.
*/
if(isset($_COOKIE['cookname']) && isset($_COOKIE['cookpass'])){
Ā   setcookie("cookname", "", time()-60*60*24*100, "/");
Ā   setcookie("cookpass", "", time()-60*60*24*100, "/");
}

?>

<html>
<title>Logging Out</title>
<body>

<?

if($logged_in){
Ā   
?>
<h1>Error!<br>You areĀ  currently logged in, logout failed. Close browser window to logout <a href=\"main.php\">OK</a></h1>
Ā   
<?
}
else{
Ā   /* Kill session variables */
Ā   unset($_SESSION['username']);
Ā   unset($_SESSION['password']);

Ā   $_SESSION = array(); // reset session array
Ā   session_destroy('username','password','picpath');Ā   // destroy session.

?>
<h1>Logged Out<br>You have successfully <b>logged out</b></h1>

<?
Ā   }

?>


</body>
</html>

Link to comment
Share on other sites

i did that but when i try to use start_session(); in logout.php i get the error cannot send session cache limiter -headers already sent errors so how do i kill the session that was started 1 or 2 pages previous to the logout script being called.??

Link to comment
Share on other sites

they mean put the star tat the top

Ā 

see this

Ā 

<?

session_start();

?>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head>

<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />

<title>video_chat</title>

</head>

<body>

Ā 

Ā 

Link to comment
Share on other sites

Correct me if Im wrong but arn't session destroyed automaticly when the user leaves

the site? This is the case for me on a couple of my sites. when you leave the site.....and come back.... you have to start the login process over. isn't that a sign of session destroy? May not anwser your question, but Im inqizitive and want to know :P

Link to comment
Share on other sites

sure the session is destroyed when a user logs off but what if they don't close their browser window and they are out there cruiseing around with a session in their browser some people like the option of being able to logout especially if they don't want their username id or password to be remembered my scripts allow a username and password to be remembered if the user so desires it.

Link to comment
Share on other sites

This thread is more than a year old. Please don't revive it unless you have something important to add.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.