Databases
StackOverflow2013
Postsdbo
POCan't make SESSION to work
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POCan't make SESSION to work
    text
    copied!<p>Here is the story. I'm coding (fairly) simple login in PHP with no database. Yes, I do agree, it's unsecure and dirty way to do it but I'm just learning. Anyway, the code is simple and everything works fine except the session. I'm trying to make attacker stop accessing <code>panel.php</code> which is protected page only administrator can enter. The <code>index.php</code> is login page with form.</p> <p><strong>config.php</strong></p> <pre><code>&lt;?php $loginToken = '123456'; $uname = 'test'; $upass = '123123'; $a_login = 'index.php'; $a_panel = 'panel.php'; $a_list = 'list.php'; $a_add = 'add.php'; $a_other = 'other.php'; ?&gt; </code></pre> <p><strong>index.php</strong> (Login form - for some reason, SO does not allow me to paste the code correctly):</p> <blockquote> <pre><code>&lt;?php // Load &amp; start a session before everything session_start(); // If session is already loaded, get into panel area if ($_SESSION['login'] == "1") { Header("Location: $a_panel"); } // Load configuration file include_once('cfg/config.php'); if (isset ( $_POST ['username'] )) { $password = $_POST ['password']; $username = $_POST ['username']; if ($password == $upass &amp;&amp; $username == $uname) { header ( "Location: $a_panel" ); exit (); } } ?&gt;&lt;html&gt; &lt;head&gt; &lt;title&gt;Test&lt;/title&gt; &lt;link rel="stylesheet" href="css/login.css" media="all" /&gt; &lt;/head&gt; &lt;body&gt; &lt;br /&gt;&lt;br /&gt; &lt;center&gt;&lt;a href="index.php"&gt;&lt;img src="images/logo_b.png" /&gt;&lt;/a&gt;&lt;/center&gt; &lt;br /&gt;&lt;br /&gt; &lt;?php if (isset($_GET['nToken'])) // A little bit of security (index.php?nToken=123456) { if ($_GET['nToken'] == $loginToken) { ?&gt; &lt;form id="login" action="" method="post"&gt; &lt;fieldset id="inputs"&gt; &lt;input name='username' id="username" type="text" placeholder="Username" autofocus required&gt; &lt;input name='password' id="password" type="password" placeholder="Password" required&gt; &lt;/fieldset&gt; &lt;fieldset id="actions"&gt; &lt;input type="submit" id="submit" value="Log in"&gt; &lt;/fieldset&gt; &lt;/form&gt; &lt;?php } } echo ' &lt;/body&gt; &lt;/html&gt;'; ?&gt; </code></pre> </blockquote> <p><strong>panel.php</strong> (Administrator area)</p> <pre><code>&lt;?php session_start(); // Insert a config file require_once('cfg/config.php'); // Check if logged (and if loaded display buttons) if ($_SESSION['login'] == "1") { ?&gt; &lt;head&gt; &lt;title&gt; Admin panel @ TEST &lt;/title&gt; &lt;link rel="stylesheet" href="css/bg.css" media="all" /&gt; &lt;center&gt;&lt;img src="images/header_1.png" /&gt;&lt;/center&gt; &lt;div class="hot-container"&gt; &lt;p&gt; &lt;a href="#" class="btn btn-blue"&gt;Listing&lt;/a&gt; &lt;a href="#" class="btn btn-blue"&gt;Add new&lt;/a&gt; &lt;a href="#" class="btn btn-blue"&gt;Settings&lt;/a&gt; &lt;/p&gt; &lt;p&gt; &lt;/p&gt; &lt;/div&gt; &lt;?php } ?&gt; </code></pre> <p>As far as I know, code should work fine as <code>session_start()</code> is posted everywhere where it needs to be (except config.php) but session is not registered. When I access the <code>panel.php</code> with information I enter into form (from configuration file) I get a blank page, thus, that is not everything. Even if I access the page by entering "/panel.php" into URL, I get blank page.</p> <p>Now I'm curious is it just me and my level of knowledge or there is some correction I have to do in php.ini :) Just to note I was trying to get as much info from SO with same questions before but didn't work no matter what.</p> <p>Thanks!</p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload