[RESOLVED] STRANGE session problem

Hey everyone,

This is driving me NUTS! I finished up some final changes today on my website. I noticed once I put it live, it was having problems with the sessions. It works fine on my computer (using xampp).

I have session_start and ob_start in my header.php file (which is included on every file that is part of the website). I have a login page to handle the login. Here’s a little snippet of the code that handles the login (I X’ed out sensitive information):

[code=php]$username = $_POST[‘username’];
$password = sha1($_POST[‘password’]);
$login = $_POST[‘login’];

if(isset($_POST[‘login’])) {

if ($username && $password) {
$connect = mysql_connect(“xxxxx”, “xxxxx”, “xxxxx”) or die(“Can’t connect to database!”);
mysql_select_db(“xxxxx”) or die(“Couldn’t find the correct database!”);
$query = mysql_query(“SELECT * FROM users WHERE username =’$username'”);
$numrows = mysql_num_rows($query);

if($numrows != 0) {
while ($row = mysql_fetch_assoc($query))
{
$dbusername = $row[‘username’];
$dbpassword = $row[‘password’];
$dbname = $row[‘name’];
$dbadmin = $row[‘admin’];
}

if ($username==$dbusername && $password==$dbpassword) {
$_SESSION[‘username’] = $dbusername;
$_SESSION[‘name’] = $dbname;
$_SESSION[‘admin’] = $dbadmin;
header(‘Location: /’);
exit;
}
else {
echo “Incorrect password!”;
}
}
else
echo(“That user doesn’t exist!”);
}
else {
echo(“Please enter a username and a password!”);
}
}[/code]

The last thing I have is a footer page that is included on every page of the site just like the header. Here is a little snippet of the code that handles the logout/checking if you’re logged in:

[code=php]if(!isset($_SESSION[‘username’]) || isset($_POST[‘logout’]) || !isset($_SESSION[‘name’]))
echo ‘<a href=”login.php”>Login</a> &copy; 2009-‘.date(“Y”).’ <a href=”contact.php”>Aaron Wood</a>’;
elseif($_SESSION[‘username’] && $_SESSION[‘admin’] == 1)
echo “Welcome “.$_SESSION[‘name’].”. You are an administrator. <form class=’logout’ name=’logout’ method=’post’ action='”.$PHP_SELF.”‘>
<input type=’hidden’ name=’logout’ /><a href=’javascript: document.logout.submit();’>Logout </a></form> &copy; 2009-“.date(‘Y’).” <a href=’contact.php’>Aaron Wood</a>”;
else
echo “Welcome “.$_SESSION[‘name’].”. <form class=’logout’ name=’logout’ method=’post’ action=”.$PHP_SELF.”>
<input type=’hidden’ name=’logout’ /><a href=’javascript: document.logout.submit();’>Logout </a></form> &copy; 2009-“.date(‘Y’).” <a href=’contact.php’>Aaron Wood</a>”;
if(isset($_POST[‘logout’])) {
session_destroy();
header(‘Location: /’);
exit;
}[/code]

I am completely stumped because it works fine on my end but not on the live server. Logging in on the live server works okay, and it redirects me to the home page once you log in (which is good). After that, if I click on another page (Contact me for example), my footer does not show me being logged in or a logout button. Another VERY strange issue is on the [URL=”http://aaronjwood.com/projects.php?type=newsletter&name=nerej”]nerej[/URL] and [URL=”http://aaronjwood.com/projects.php?type=newsletter&name=nyrej”]nyrej[/URL] newsletter pages, the footer says I’m logged in as nerej or nyrej (depending on which one you’re viewing). That page only uses $_GET to determine what newsletter to show. It’s almost as if it injects nerej or nyrej into the session somehow.

This is driving me absolutely nuts and I’ve spent too much time on it today ? Anyone have any ideas as to what in the WORLD is happening?

Thanks a bunch!

Also in #PHP _↴