ammonkc
I'm trying to make a login and logout script for a page but for some reason its not working very well for me. it seems to work fine until I try to logout. it seems to destroy the session variables, but it still lets me view the page.
heres my login code:
here is the script at the top of the page that checks if logged in:
and here is my logout script:
for some reason the unset() isn't working for me. this is the exact same script that I've used on many other sites, but for some reason its giving me errors now. so I commented out the unset() and it doesn't give me errors. but the page will still get past the login check after I logout.
heres my login code:
| Code: |
| <?php
session_start(); /** this is the login script. it checks the database to see if the use has permission to access admin areas **/ if (isset($_POST['loginBtn'])) { require("config.php"); require("opendb.php"); if (!get_magic_quotes_gpc()) { $_POST['username'] = addslashes($_POST['username']); }//end magic quotes if statement /** here i set some variables up **/ $loginError = ""; $username = $_POST['username']; $password = stripslashes($_POST['password']); /** here I query the db with the username and password entered**/ $sql = "SELECT * FROM login WHERE username = '$username'"; $result = mysql_query($sql) or die('SELECT error while loggin you in: '.mysql_error()); $loginInfo = mysql_fetch_array($result, MYSQL_ASSOC); /** authenticate login information **/ if (mysql_num_rows($result)==0) { $loginError .= "That username does not exist in our database.\n"; die('That username does not exist in our database.'); }//end if statement /** check that passwords match **/ $loginInfo['password'] = stripslashes($loginInfo['password']); if ($password != $loginInfo['password']) { $loginError .= "Invalid password, please try again."; die('Invalid password, please try again.'); }else{ $_SESSION['loggedIn'] = true; $_SESSION['access'] = $loginInfo['access']; $_SESSION['username'] = $username; if ($_POST['loc']==1) { header("location:index.php"); }elseif ($_POST['loc']==2) { header("location:admin/index.php"); } }//end if else statement }else{ ?> |
here is the script at the top of the page that checks if logged in:
| Code: |
| <?php
session_start(); if (empty($_SESSION['loggedIn'])) { header("location:../login.php?loc=2"); } ?> |
and here is my logout script:
| Code: |
| <?php
/** log the user out**/ if (empty($_SESSION['loggedIn'])) { //die('You are not logged in so you cannot log out.'); } /**the unset() isn't working keeps giving me errors unset($_SESSION['username']); unset($_SESSION['access']); unset($_SESSION['loggedIn'];**/ // kill session variables $_SESSION = array(); // reset session array session_destroy(); // destroy session. header("location:index.php");// redirect them to anywhere you like. ?> |
for some reason the unset() isn't working for me. this is the exact same script that I've used on many other sites, but for some reason its giving me errors now. so I commented out the unset() and it doesn't give me errors. but the page will still get past the login check after I logout.
