4

I found the source of the problem #2. It is the use of session_register(foo).

I put the following to my handle_registration.php.

session_register("foo");
session_register("foo2");

$foo2 = $_POST['email'];
$foo['email'] = $_POST['email']

The problem still persists, since no variables are stored to my session cookie.


This is the logic of my login script.

  1. Solved by Pascal Martin and The Disintegrator: Which is the right place to put the function session_write_close in generating sessions for login?
  2. How can you get a permanent session for user "session" such that a new session is not started each time index.php is loaded?

I have the session_start() at the beginning of my index.php.

The very Beginning of my index.php

 session_start();       
 if($_SESSION['logged_in'] == false) {
     $random_number = rand(1,100000);                                                       
     session_id($random_number);
     session_id['email'] = '';
 }

while the very end of my index.php

<?php
session_write_close();        // Session code ends here!
?>

I have right after the very beginning of the session code the validation process of user's password by

 $dbconn = pg_connect("host=localhost port=5432 dbname=masi user=masi password=123");
 $result = pg_prepare($dbconn, "query22", "SELECT passhash_md5 FROM users
         WHERE email=$1;");

 $passhash_md5 = pg_execute($dbconn, "query22", array($_REQUEST['email']));     
 // users from registration/login form
 if ($passhash_md5 == md5($_REQUEST['password'])) {
     $_SESSION['logged_in'] = true;
     $_SESSION['email'] = $_REQUEST['email'];
     $_SESSION['passhash_md5'] = md5($_REQUEST['password']);
 }

 // this may be unnecessary if the passhash_md5 cannot be changed by the user 
 $passhash_md5_2 = pg_execute($dbconn, "query22", array($_SESSION['email']));  
 // users staying in the site
 if ($passhash_md5_2 == $_SESSION['passhash_md5'])) {
     $_SESSION['logged_in'] = true;
 }  

The code generates me continuously random sessions such that no user's data is being saved for the user. I replaced each $_REQUEST after the login/registration handlers by $_SESSION in my code, since $_REQUEST does not include $_SESSION - still the same problem and I cannot see the username in the homepage after registration/login.

4 Answers 4

3

You should use output buffering to prevent this

<?php
ob_start();
everything here
ob_end_flush();
?>

You can't send headers once the normal output takes place.

4
  • A great practice for PHP is to not complete your <?php tag at the bottom of the file. This will prevent inadvertent output from being generated that way. The actual error message that you are seeing is due to the fact that your headers have already been sent. You cannot send a new cookie in the headers (to alter the session_id) after you have already written your headers out. Aug 13, 2009 at 4:41
  • That being said, it is a little missleading to use session_regenerate_id at the bottom of your php file. Aug 13, 2009 at 4:41
  • 3
    Maybe it's an OCD, but I can't let a tag unclosed. Do I need help? Aug 13, 2009 at 4:47
  • @Thank you for solving the first problem! Aug 13, 2009 at 5:08
2

Your code looks like this :

                             -- content cut --
</html>
<?php
session_regenerate_id(true);               // Session code ends here!
session_write_close();
?>

You definitly have some output (the whole content of your page, actually) before session_regenerate_id is called ; hence the error.

The problem is not with "empty lines" or spaces : it is with output ; and HTML is output ;-)

Like the call to session_start, the call to session_regenerate_id should be done at the beginning of the script, before anything is sent to the browser.
So, here, in the block at the "top" of your index.php.


EDIT : more thoughts.

BTW? I'm not sure you actually need to call session_write_close ; I've probably never used that function, I believe... And, quoting the doc :

Session data is usually stored after your script terminated without the need to call session_write_close()

The only case you might need to call this function yourself is if you are doing long calculations :

session data is locked to prevent concurrent writes only one script may operate on a session at any time. When using framesets together with sessions you will experience the frames loading one by one due to this locking. You can reduce the time needed to load all the frames by ending the session as soon as all changes to session variables are done.

But this doesn't seem to be your case, as you are calling this at the end of your script.

So, you could try removing the (useless ?) call to that function...


And, about session_regenerate_id : do you really need to call this function on each page ?

I suppose never calling it would be enough for your site to work... Even if you might want to call it when the user logs in, for security precautions (If I remember correctly, it's nice to call this function whenever the privileges level of a user changes)

Same about session_id, btw : do you really need to call this function on each page ?

6
  • Thank you for solving the first problem! Aug 13, 2009 at 5:08
  • You're welcome :-) I've edited my answer with a couple more thoughts ; maybe they'll help too... Aug 13, 2009 at 5:53
  • Thank you for the explanations of the 2nd update! - I implemented your suggestions for improvements. The site continuously still generates the session id such that the user's data is not transferred to the next page. Aug 13, 2009 at 13:44
  • If you do not want data transferred to another page, just don't store it in the session. If you want the data transfered to another page, well, just use session_start and no other session_anything function ; that should be well enough... Aug 13, 2009 at 18:57
  • @Pascal: My session_id is the same in all pages. The problem at the moment is to assign variables to each session by session_register. Aug 14, 2009 at 0:56
1

session_regenerate_id — Update the current session id with a newly generated one

If you use it the way you are, you will be generating new sessions over and over.

session_id — Get and/or set the current session id

You are setting a new session every time with a random number.

Actually, the only thing you NEED to use sessions is to put a session_start() statement at the beginning of the script.

2
  • I implemented your suggestions for improvements. My site continuously still regenerate the session id such that the user's data is not transferred to the next page. Aug 13, 2009 at 13:43
  • I haven't seen your comment. Do you still having problems? Aug 26, 2009 at 1:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.