0

I'm using a PHP challenge response script to facilitate my users logging into my site. I found this code online somewhere a few years ago so didn't write it myself and therefore don't understand it as well as I probably should.

Anyway, it's been working fine but I noticed that when a user's session expires, sometimes they are unable to login again and have to resort to using a different browser. The issue seems to clear itself up after some time but I don't know why or how.

Sometimes, it's as simple as closing the browser and opening it again, but other times that doesn't work either. It just keeps giving the session expired message. I don't know if this is a browser bug or if there is something I can do in my code to prevent this from happening. I have seen this happen in Chrome and users have complained of it happening also in IE.

Here is my code (with the unimportant stuff stripped out):

if (isset($_SESSION[challenge]) && isset($_POST[username]) && isset($_REQUEST[response])) {
  // Authenticate user stuff goes here

} else {
  $error = "Session expired or not established. You may need to close your browser and reopen it.";

  $encryptederror = encrypt(urlencode($error),$encryptionkey);
  header("Location:index.php?con=login&error=".$encryptederror);
  exit;
}

How do I prevent the code from continuously going into the else statement when the user tries to login again?

7
  • This is interesting: $_POST["username"] will only come in from a form - and only when the form is submitted. You are aware that you AND all the tests so that if ANY ONE TEST FAILS then the user will be sent to the 'login' system? On a separate note, please do not use $_REQUEST, use $_POST or $_GET directly. Jun 22, 2014 at 1:02
  • It's the session['challenge'] that is returning a blank but I don't understand why. I have confirmed that it gets set on the login page but by the time I get to my authenticate script it has been forgotten.
    – Vincent
    Jun 22, 2014 at 14:43
  • Are you running session_start() before trying to use the $_SESSION array? Jun 22, 2014 at 14:50
  • Yes I am. I am calling if(session_start()){authenticate();} and then within the authenticate function I have the problem. Do you think maybe calling session_start() within the function rather than before it would make a difference?
    – Vincent
    Jun 24, 2014 at 18:19
  • While you sort out the code, have a 'bootstrap.php' script that is called every time your code starts by doing 'include_once'. In that script have: session_start(); and the connection to your database. That way you know that there will Always be a session and a database connection available everywhere in your code. What is 'bootstrap.php'? Explanation here. Mine, has autoloader settings, logging setup, application defines etc. Jun 24, 2014 at 20:41

1 Answer 1

0

You missed quotes around names in the $_POST and $_SESSION

2
  • Sadly, all PHP does is issue 'notice' level alerts about this situation. It works as you would expect as if the names been quoted. tested on PHP 5.3.18 Jun 22, 2014 at 0:25
  • I'm suing PHP 5.4.0. I added the quotes as you suggested but it makes no difference. I am still getting directed into the else statement for some reason.
    – Vincent
    Jun 22, 2014 at 0:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.