0

Just edited php sliding jquery panel form and it doesn't work, actually registration works but login doesn't. I erased some code that doesn't matter in my problem...

Please ignore these error messages in this strange language.

<?php
error_reporting(0);
define('INCLUDE_CHECK',true);
require_once($_SERVER['DOCUMENT_ROOT'] . '/config.php');

session_start();
session_name('avaLogin');
session_set_cookie_params(2*7*24*60*60);

if($_SESSION['id'] && !isset($_COOKIE['avaRemember']) && !$_SESSION['rememberMe'])
{

$_SESSION = array();
session_destroy();

}


if(isset($_GET['logoff']))
{
$_SESSION = array();
session_destroy();
echo('<script type="text/javascript">window.location = "' . $SITE_URL .'"</script>');
    exit;
}

if($_POST['submit']=='Zaloguj')
{

// Checking whether the Login form has been submitted

$err = array();
// Will hold our errors


if(!$_POST['username'] || !$_POST['password'])
    $err[] = 'Wszystkie pola muszą być wypełnione!';

if(!count($err))
{
    $_POST['username'] = mysql_real_escape_string($_POST['username']);
    $_POST['password'] = mysql_real_escape_string($_POST['password']);
    $_POST['rememberMe'] = (int)$_POST['rememberMe'];
    echo '';
    // Escaping all input data

    $row = mysql_fetch_assoc(mysql_query("SELECT id,usr FROM ava_members WHERE usr='{$_POST['username']}' AND pass='".md5($_POST['password'])."'"));

    if($row['usr'])
    {
        // If everything is OK login

        $_SESSION['usr']=$row['usr'];
        $_SESSION['id'] = $row['id'];
        $_SESSION['rememberMe'] = $_POST['rememberMe'];

        // Store some data in the session

        setcookie('avaRemember',$_POST['rememberMe']);

        }
    else $err[]='Zły login i/lub hasło!';
}

if($err)
$_SESSION['msg']['login-err'] = implode('<br />',$err);
// Save the error messages in the session



echo('<script type="text/javascript">window.location = "' . $SITE_URL .'"</script>');
        exit;
    }
    else if($_POST['submit']=='Zarejestruj')
    {
    // If the Register form has been submitted

    $err = array();

    if(strlen($_POST['username'])<4 || strlen($_POST['username'])>32)
    {
        $err[]='Twój login musi mieć pomiędzy 3 i 32 znaki!';
    }

    if(preg_match('/[^a-z0-9\-\_\.]+/i',$_POST['username']))
    {
        $err[]='Twoje hasło zawiera niedozwolone znaki!';
    }

    if(!checkEmail($_POST['email']))
    {
        $err[]='Twój e-mail jest nieprawidłowy!';
    }

    if(!count($err))
    {
        // If there are no errors

        $pass = substr(md5($_SERVER['REMOTE_ADDR'].microtime().rand(1,100000)),0,6);
        // Generate a random password

        $_POST['email'] = mysql_real_escape_string($_POST['email']);
        $_POST['username'] = mysql_real_escape_string($_POST['username']);
        // Escape the input data


        mysql_query("   INSERT INTO ava_members(usr,pass,email,regIP,dt)
                        VALUES(

                            '".$_POST['username']."',
                            '".md5($pass)."',
                            '".$_POST['email']."',
                            '".$_SERVER['REMOTE_ADDR']."',
                            NOW()

                        )");

        if(mysql_affected_rows($avalink)==1)
        {
            send_mail(  '[email protected]',
                        $_POST['email'],
                        $SITE_NAME . ' - Twoje hasło',
                        'Twoje hasło to: '.$pass);

            $_SESSION['msg']['reg-success']='Wysłaliśmy do Ciebie e-mail z nowym hasłem!';
        }
        else $err[]='Ten login jest już w użyciu!';
    }

    if(count($err))
    {
        $_SESSION['msg']['reg-err'] = implode('<br />',$err);
    }   

    echo('<script type="text/javascript">window.location = "' . $SITE_URL .'"</script>');
    exit;
}

$script = '';

if($_SESSION['msg'])
{
    // The script below shows the sliding panel on page load

    $script = '
    <script type="text/javascript">

        $(function(){

            $("div#panel").show();
            $("#toggle a").toggle();
        });

    </script>';

}
?>

    <link rel="stylesheet" type="text/css" href="<?php echo $LOGIN_URL; ?>/style.css" media="screen" />
    <link rel="stylesheet" type="text/css" href="<?php echo $LOGIN_URL; ?>/login_panel/css/slide.css" media="screen" />

    <script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"></script>

    <!-- PNG FIX for IE6 -->
    <!-- http://24ways.org/2007/supersleight-transparent-png-in-ie6 -->
    <!--[if lte IE 6]>
        <script type="text/javascript" src="login_panel/js/pngfix/supersleight-min.js"></script>
    <![endif]-->

    <script src="<?php echo $LOGIN_URL; ?>/login_panel/js/slide.js" type="text/javascript"></script>

    <?php echo $script; ?>
</head>

<body>

<!-- Panel -->
<div id="toppanel">
    <div id="panel">
        <div class="content clearfix">
            <div class="left">
                <h2>REGULAMIN</h2>      
                <p class="grey">Rejestracja i/lub logowanie oznaczają akceptację <a href="<?php echo $RULES_URL; ?>">regulaminu.</a>
                Jeśli jeszcze się z nim nie zapoznałeś to zapraszamy.</p>
                <h2>DOŁĄCZ DO NAS</h2>
                <p class="grey">Rejestrując się uzyskasz dostęp do szerokiej gamy polskich komiksów avatar the last airbender!</p>
            </div>


            <?php

            if(!$_SESSION['id']):

            ?>

            <div class="left">
                <!-- Login Form -->
                <form class="clearfix" action="" method="post">
                    <h1>Logowanie</h1>

                    <?php

                        if($_SESSION['msg']['login-err'])
                        {
                            echo '<div class="err">'.$_SESSION['msg']['login-err'].'</div>';
                            unset($_SESSION['msg']['login-err']);
                        }
                    ?>

                    <label class="grey" for="username">Login:</label>
                    <input class="field" type="text" name="username" id="username" value="" size="23" />
                    <label class="grey" for="password">Hasło:</label>
                    <input class="field" type="password" name="password" id="password" size="23" />
                    <label><input name="rememberMe" id="rememberMe" type="checkbox" checked="checked" value="1" /> &nbsp;Pamiętaj mnie</label>
                    <div class="clear"></div>
                    <input type="submit" name="submit" value="Zaloguj" class="bt_login" />
                </form>
            </div>
            <div class="left right">            
                <!-- Register Form -->
                <form action="" method="post">
                    <h1>Jeszcze nie masz konta?!</h1>       

                    <?php

                        if($_SESSION['msg']['reg-err'])
                        {
                            echo '<div class="err">'.$_SESSION['msg']['reg-err'].'</div>';
                            unset($_SESSION['msg']['reg-err']);
                        }

                        if($_SESSION['msg']['reg-success'])
                        {
                            echo '<div class="success">'.$_SESSION['msg']['reg-success'].'</div>';
                            unset($_SESSION['msg']['reg-success']);
                        }
                    ?>

                    <label class="grey" for="username">Login:</label>
                    <input class="field" type="text" name="username" id="username" value="" size="23" />
                    <label class="grey" for="email">Email:</label>
                    <input class="field" type="text" name="email" id="email" size="23" />
                    <label>Hasło zostanie Ci wysłane.</label>
                    <input type="submit" name="submit" value="Zarejestruj" class="bt_register" />
                </form>
            </div>

            <?php

            else:

            ?>

            <div class="left">

            <h1>Panel użytkownika</h1>

            <p>Twoja subskrypcja wygasa <?php echo '???'; ?></p>
            <a href="?logoff">Wyloguj się</a>

            </div>

            <div class="left right">
            </div>

            <?php
            endif;
            ?>
        </div>
    </div> <!-- /login -->  

    <!-- The tab on top --> 
    <div class="tab">
        <ul class="login">
            <li class="left">&nbsp;</li>
            <li>Witaj <?php echo $_SESSION['usr'] ? $_SESSION['usr'] : 'Gościu';?>!</li>
            <li class="sep">|</li>
            <li id="toggle">
                <a id="open" class="open" href="#"><?php echo $_SESSION['id']?'Rozwiń panel':'Login | Reje';?></a>
                <a id="close" style="display: none;" class="close" href="#">Zwiń panel</a>          
            </li>
            <li class="right">&nbsp;</li>
        </ul> 
    </div> <!-- / top -->
</div>
</body>
</html>

The problem is that here:

    <li>Witaj <?php echo $_SESSION['usr'] ? $_SESSION['usr'] : 'Gościu';?>!</li>

user does not appear... i tried many ways to fix it and guess what? everything works but after redirect to other page usr doesnt exists... CHMOD 755. What's wrong with it?

1
  • 1
    Your code is vulnerable to SQL injection attacks, and yYassuming that queries will NEVER fail. You should NOT be nesting database calls. Always check return values. You should also NOT be overwriting values in the superglobals. Commented Sep 24, 2013 at 16:19

2 Answers 2

2

As documented for session_name(), you MUST set the session name BEFORE you call session_start(). You are also changing the session cookie parameters AFTER session_start().

You cannot do this. session settings must be changed BEFORE you start the session.

Sign up to request clarification or add additional context in comments.

Comments

1

I suspect that you working on the session before you've started it may be the problem.

2 Comments

Look at session_start(); at the beginning of code. EDIT: Right, after using session_destroy() he have to start session again.
I edited it like u said but it still doesnt work properly ._.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.