重定向后,Php会话变量丢失

时间:2014-06-24 15:33:16

标签: php session redirect

您好我一直在寻找解决此问题的周。我有一个登录代码,在输入您的信息后,登录表单将信息发送到php页面,该页面运行包含的函数,包括检查数据库并保存信息(如果匹配),然后返回true。 php页面然后重定向到运行登录检查功能的主页,但会话不存在。

我已经确定我有session_start();在所有页面的顶部 标题有一个exit();在它之后,重定向是标题('Location:../ home.php'); 我检查了phpinfo(); 我试过session_write_close();和session_regenerate_id(true);, session_regenerate_id(); iv选中Session save path / temp

会话保存所有内容,直到重定向iv回显到每个帮助网站和页面

这是登录

    if (login($email, $password, $mysqli) == true) {
    // Login success
    session_write_close();
    header('Location: ../home.php');
    exit();
} else {
    // Login failed 
    header('Location: ../signIn.php?error=1');
    exit();
}

我在登录功能中保存会话,当我在这里回复它们时它们仍然存在但是在重定向之后我在loginCheck函数中回显并且没有任何内容。

这是使用

的会话功能
function sec_session_start() {
$session_name = 'sec_session_id';
$secure = 'SECURE';

$httponly = true;

if (ini_set('session.use_only_cookies', 1) === FALSE) {
    header("Location: ../error.php?err=Could not initiate a safe session (ini_set)");
    exit();
}

$cookieParams = session_get_cookie_params();
session_set_cookie_params($cookieParams["lifetime"], $cookieParams["path"], $cookieParams["domain"], $secure, $httponly);

session_name($session_name);
session_start();
session_regenerate_id();
}

这是我的loginCheck剂量使它通过第一个如果没有会话

function login_check($mysqli) {
// Check if all session variables are set 
echo $_SESSION['hello'];
echo $_SESSION['username'];
echo $_SESSION['user_id'];
echo $_SESSION['login_string'];
echo 'hello';

if (isset($_SESSION['user_id'], $_SESSION['username'], $_SESSION['login_string'])) {
//if ($_SESSION['Logging'] == "correct") {
    echo 'hello';
    $user_id = $_SESSION['user_id'];
    $login_string = $_SESSION['login_string'];
    $username = $_SESSION['username'];

    // Get the user-agent string of the user.
    $user_browser = $_SERVER['HTTP_USER_AGENT'];


    if ($stmt = $mysqli->prepare("SELECT password 
                                  FROM company_users 
                                  WHERE id = ? LIMIT 1")) {
        // Bind "$user_id" to parameter. 
        $stmt->bind_param('i', $user_id);
        $stmt->execute();   // Execute the prepared query.
        $stmt->store_result();

        if ($stmt->num_rows == 1) {
            // If the user exists get variables from result.
            $stmt->bind_result($password);
            $stmt->fetch();
            $login_check = hash('sha512', $password . $user_browser);

            if ($login_check == $login_string) {
                // Logged In!!!! 
                return true;
            } else {
                // Not logged in 
                return false;
            }
        } else {
            // Not logged in 
            return false;
        }
    } else {
        // Not logged in 
        return false;
    }
} else {
    // Not logged in 

    return false;
  }
}

这是表格

<form class="form-horizontal" action="includes/signInValidation.php"  method="POST" name='login_form'>

        <div class="form-group">
            <label class="col-lg-2 control-label ">Email</label>
            <div class="col-lg-10">
                <input class="form-control textBox" id="email" name='email' placeholder="Email" type="email">
            </div>
        </div>

        <div class="form-group">
            <label class="col-lg-2 control-label ">Password</label>
            <div class="col-lg-10">
                <input class="form-control textBox" id="password" nam='password' placeholder="Password" type="password">
            </div>
        </div>

        <div class="form-group">
            <label class="col-lg-2 control-label "></label>
            <div class="col-lg-10">
                <input class="btn btn-success"  type="button" value='Login' onclick='formhash(this.form, this.form.password);' >
            </div>
        </div>
    </form>

这是登录功能

function login($email, $password, $mysqli) {
// Using prepared statements means that SQL injection is not possible.
if ($stmt = $mysqli->prepare("SELECT id, username, password, salt 
    FROM company_users
   WHERE email = ?
    LIMIT 1")) {
    $stmt->bind_param('s', $email);  // Bind "$email" to parameter.
    $stmt->execute();    // Execute the prepared query.
    $stmt->store_result();


    // get variables from result.
    $stmt->bind_result($user_id, $username, $db_password, $salt);
    $stmt->fetch();

    // hash the password with the unique salt.
    $password = hash('sha512', $password . $salt);
    if ($stmt->num_rows == 1) {
        // If the user exists we check if the account is locked
        // from too many login attempts 

        if (checkbrute($user_id, $mysqli) == true) {
            // Account is locked 
            // Send an email to user saying their account is locked
            return false;
        } else {
            // Check if the password in the database matches
            // the password the user submitted.
            if ($db_password == $password) {

                // Password is correct!
                // Get the user-agent string of the user.
                $user_browser = $_SERVER['HTTP_USER_AGENT'];
                // XSS protection as we might print this value
                $user_id = preg_replace("/[^0-9]+/", "", $user_id);
                $_SESSION['user_id'] = $user_id;
                // XSS protection as we might print this value
                $username = preg_replace("/[^a-zA-Z0-9_\-]+/", "", $username);
                $_SESSION['username'] = $username;
                $_SESSION['login_string'] = hash('sha512', $password . $user_browser);

                return true;




                //echo $_SESSION['username'];
                //echo $_SESSION['user_id'];
                //echo $_SESSION['login_string'];
                // Login successful.

            } else {
                // Password is not correct
                // We record this attempt in the database
                $now = time();
                $mysqli->query("INSERT INTO login_attempts(user_id, time)
                                VALUES ('$user_id', '$now')");
                return false;
            }
        }
    } else {
        // No user exists.
        return false;
    }

    //$_SESSION['check'] = 'hello';
  }
}

signInValidation

<?php
include_once 'db/dbConnect.php';
include_once 'functions.php';
sec_session_start();
if (isset($_POST['email'], $_POST['p'])) {
    $email = $_POST['email'];
    $password = $_POST['p']; // The hashed password.
if (login($email, $password, $mysqli) == true) {
    // Login success
    //$_SESSION['loggedIn'] = 'true';
    session_write_close();
    header('Location: ../profile.php');
    exit();
} else {
    // Login failed 
    header('Location: ../signIn.php?error=1');
    exit();
}
} else {
    // The correct POST variables were not sent to this page. 
    echo 'Invalid Request';
}

2 个答案:

答案 0 :(得分:0)

我自己有这个问题。最终解决方案是我没有使用带有Location:标头的绝对URI

这样做而不是'../home.php':

header('Location: http://yourdomain.com/home.php');

答案 1 :(得分:0)

使代码尽可能简单。没有必要回应确认会话设置。您需要一起重新设计流程

<?php

session_start();


if ( !isset(  $_SESSION['user_id'] ) )

  { header("location:index");
}