I'm using a login script (PHP, MySQL) which uses sessions. I need to create a variable so i can use it in the other pages?

Question

The PHP script I have for the login.php which is the form is the code below.

<?php 
include 'dbc.php';

$user_email = mysql_real_escape_string($_POST['email']);

if ($_POST['Submit']=='Login')
{
$md5pass = md5($_POST['pwd']);
$sql = "SELECT id,user_email FROM users WHERE 
        user_email = '$user_email' AND 
        user_pwd = '$md5pass' AND user_activated='1'"; 

$result = mysql_query($sql) or die (mysql_error()); 
$num = mysql_num_rows($result);

if ( $num != 0 ) { 

    // A matching row was found - the user is authenticated. 
   session_start(); 
   list($user_id,$user_email) = mysql_fetch_row($result);
    // this sets variables in the session 
    $_SESSION['user']= $user_email;  


    if (isset($_GET['ret']) && !empty($_GET['ret']))
    {
    header("Location: $_GET[ret]");
    } else
    {
    header("Location: myaccount.php");
    }
    //echo "Logged in...";
    exit();
    } 

header("Location: login.php?msg=Invalid Login");
//echo "Error:";
exit();     
}

?>

<link href="styles.css" rel="stylesheet" type="text/css">

<?php if (isset($_GET['msg'])) { echo "<div class=\"msg\"> $_GET[msg] </div>"; } ?>


<p>&nbsp;</p><table width="40%" border="0" align="center" cellpadding="0"     cellspacing="0">
  <tr> 
<td bgcolor="#d5e8f9" class="mnuheader" >
<div align="center"><font size="5"><strong>Login 
    Members</strong></font></div></td>
 </tr>
 <tr> 
<td bgcolor="#e5ecf9" class="mnubody"><form name="form1" method="post" action="">
    <p>&nbsp;</p>
    <p align="center">Your Email 
      <input name="email" type="text" id="email">
    </p>
    <p align="center"> Password: 
      <input name="pwd" type="password" id="pwd">
    </p>
    <p align="center"> 
      <input type="submit" name="Submit" value="Login">
    </p>
    <p align="center"><a href="register.php">Register</a> | <a        href="forgot.php">Forgot</a></p>
  </form></td>
 </tr>

I want to create a session vairable like the $_SESSION['user']= $user_email; which i can use in other pages. The problem is i don't know how to do so and i want to select a different row from my database called points. So it will be something like $sql = "SELECT id,user_email,points FROM users WHERE user_email = '$user_email' AND user_pwd = '$md5pass' AND user_activated='1'";

Like i say i want it to select the number of points so it can be used on all pages where the session has been start.

Here is an account page which echos the logged in user. But i want it to also echo the points row from my database.

  <?php
 session_start();
 if (!isset($_SESSION['user']))
 {
 die ("Access Denied");
 }
 ?> 
 <h2>My Account </h2>
 <?php if (isset($_SESSION['user'])) { ?>
 <p>Logged as <?php echo $_SESSION['user']; ?> 

   <a href="settings.php">Settings</a> 
 <a href="logout.php">Logout</a> </p>
<?php } ?>

Thank you for your help!

You code is vulnerable to [XSS attacks](https://en.wikipedia.org/wiki/Cross-site_scripting). Also please [don't use md5 to hash passwords](https://github.com/ircmaxell/password_compat). — PeeHaa, Apr 30 '13 at 11:16
You are using [an **obsolete** database API](http://stackoverflow.com/q/12859942/19068) and should use a [modern replacement](http://php.net/manual/en/mysqlinfo.api.choosing.php). — Quentin, Apr 30 '13 at 11:16
[md5 is insufficient protection for passwords](http://www.php.net/manual/en/faq.passwords.php#faq.passwords.fasthash) — Quentin, Apr 30 '13 at 11:17
Hmm, I would suggest to [RTFM](http://php.net/manual/en/features.sessions.php) about sessions .. — dbf, Apr 30 '13 at 11:17

score 1 · Answer 1 · answered Apr 30 '13 at 11:18

1

put the session_start() start of the page

<?php
session_start();

your code follows this line the variables were working.

answered Apr 30 '13 at 11:18

MKV

913
7
6

score 0 · Answer 2 · answered Apr 30 '13 at 11:16

You must place session_start() at the top of any pages you want to carry the session over to, so try that and see if that works :)

you should have the following to return a assoc array with the users details into a variable $user.

$sql = "SELECT * FROM users WHERE user_email = '{$_SESSION['user']}'";
$res = mysqli_query($sql);
$user = mysqli_fetch_assco($res);

Also, mysql_ is depreciated, so you should change all of your references of mysql_ to mysqli_

SQL Injection possibility in there – PeeHaa Apr 30 '13 at 11:24 — PeeHaa, Apr 30 '13 at 11:24

score 0 · Answer 3 · answered Apr 30 '13 at 11:19

0

To creat a session variable,try doing the same as $_SESSION['user']= $user_email So $_SESSION['WhateverYouWant']= $Anything

answered Apr 30 '13 at 11:19

PaxBin

111
3
14

Or Maybe i miss understood what you want exactly :) – PaxBin Apr 30 '13 at 11:22

I'm using a login script (PHP, MySQL) which uses sessions. I need to create a variable so i can use it in the other pages?

3 Answers3