Check if logged in - php

Question

Hi everyone,
Im trying to figure out why my script keeps redirecting to my login page. So far I haven't found it yet. Could someone explane to me which mistakes I'm making?
This is my code.
functions.php
function redirect_to($location = NULL) {
if ($location != NULL) {
header("Location: {$location}");
exit;
}
}
function include_layout_template($template="") {
include(SITE_ROOT.DS.'public'.DS.'layouts'.DS.$template);
}
index.php
<?php
require_once('../../includes/initialize.php'); ?>
<?php if (!$session->is_logged_in()) { redirect_to("login.php"); } ?>
<?php include_layout_template("admin_header.php"); ?>
Logout
<?php include_layout_template("admin_footer.php"); ?>
session.php
<?php
class Session {
public $logged_in = false;
public $user_id;
public $message;
function __construct() {
session_start();
$this->check_message();
$this->check_login();
if($this->logged_in) {
// actions to take right away if user is logged in
} else {
// actions to take right away if user is not logged in
}
}
public function login_user($user) {
if($user) {
$this->user_id = $_SESSION['user_id'] = $user->id;
$this->logged_in = true;
}
}
public function is_logged_in() {
return $this->logged_in;
}
public function logout() {
unset($_SESSION['user_id']);
unset($this->user_id);
$this->logged_in = false;
}
private function check_login() {
if(isset($_SESSION['user_id'])) {
$this->user_id = $_SESSION['user_id'];
$this->logged_in = true;
} else {
unset($this->user_id);
$this->logged_in = false;
}
}
private function check_message() {
// Is there a message stored in the session?
if(isset($_SESSION['message'])) {
// Add it as an attribute and erase the stored version
$this->message = $_SESSION['message'];
unset($_SESSION['message']);
} else {
$this->message = "";
}
}
}
$session = new Session();
//$message = $session->message();
user.php
<?php
require_once('../../includes/initialize.php');
class Users extends DatabaseQuery
{
protected $tablename = 'users';
protected $db_fields = array('id', 'first_name', 'last_name', 'password', 'username');
public $id;
public $first_name;
public $last_name;
public $password;
public $username;
public static function create_user($first_name, $last_name, $password, $username)
{
global $database;
$sql = "INSERT INTO users (";
$sql .= "first_name, last_name, password, username) ";
$sql .= "VALUES (";
$sql .= "'{$first_name}', '{$last_name}', '{$password}', '{$username}')";
$result = $database->query($sql);
return $result;
}
public static function find_username($username) {
global $database;
$sql = "SELECT * FROM users ";
$sql .= "WHERE username= '{$username}' ";
$sql .= "LIMIT 1";
$result = $database->query($sql);
$admin = mysqli_fetch_assoc($result);
return $admin;
}
public static function find_password($username, $password) {
global $database;
$sql = "SELECT * FROM users ";
$sql .= "WHERE username= '{$username}' ";
$sql .= "And password=".crypt($password) ;
$sql .= " LIMIT 1";
$result = $database->query($sql);
$admin = mysqli_fetch_assoc($result);
return $admin;
}
public static function password_check($password, $existing_hash) {
$hash = crypt($password, $existing_hash);
if ($hash === $existing_hash) {
return true;
} else {
return false;
}
}
public static function login($username, $password) {
$admin = self::find_username($username);
if ($admin) {
// found username, check password.
if (self::password_check($password, $admin['password'])) {
//password matches
return $admin;
} else {
//password does not match
return false;
}
} else {
// admin not found
return false;
}
}
}
$user = new Users();
login.php
<?php
/**
* FIRSTNAME LASTNAME PASSWORD USERNAME
* Coos Wolff secret Admin
* Kevin Doofus password Kevin
*/
include_once("../../includes/initialize.php");
if (isset($_POST['submit'])) {
$username = $_POST['username'];
$password = $_POST['password'];
$first_name = $_POST['first_name'];
$last_name = $_POST['last_name'];
$login = Users::login($username, $password);
if($login) {
$session->logged_in = true;
redirect_to('index.php');
} else {
redirect_to('login.php');
}
} ?>
<form id='login' action='create_user.php' method='post' accept-charset='UTF-8'>
<fieldset >
<legend>Create User</legend>
<input type='hidden' name='submitted' id='submitted' value='1'/>
<label for='username' >UserName:</label>
<input type='text' name='username' id='username' maxlength="50" />
<label for='password' >Password:</label>
<input type='password' name='password' id='password' maxlength="50" />
<label for='firstName' >FirstName:</label>
<input type='text' name='first_name' id='first_name' maxlength="50" />
<label for='lastName' >LastName:</label>
<input type='text' name='last_name' id='last_name' maxlength="50" />
<input type='submit' name='submit' value='Submit' />
</fieldset>
</form>
<hr /><br /><hr />
<form id='login' action='login.php' method='post' accept-charset='UTF-8'>
<fieldset >
<legend>Login</legend>
<input type='hidden' name='submitted' id='submitted' value='1'/>
<label for='username' >UserName:</label>
<input type='text' name='username' id='username' maxlength="50" VALUE="Kevin"/>
<label for='password' >Password:</label>
<input type='password' name='password' id='password' maxlength="50" />
<label for='firstName' >FirstName:</label>
<input type='text' name='first_name' id='first_name' maxlength="50" value="Kevin" />
<label for='lastName' >LastName:</label>
<input type='text' name='last_name' id='last_name' maxlength="50" value="Doofus"/>
<input type='submit' name='submit' value='Submit' />
</fieldset>
</form>
If I submit the form without the code to check if somebody is logged in the code works fine. But with the checking code it keeps redirecting me to the login page. After submitting the form I set $session->logged_in = true. But still nothing. I have look on google to see what im doing wrong. But I can't figure it out. I tried many different codes but it all ends up the same way. Redirecting me to the login in page. It's probably an easy fix. But I just can't see it. Could somebody tell me what I am doing wrong?
Kind Regards,
Coos

Answer 1

You are going to laugh when I tell you this. According to the documentation:
If the return is omitted the value NULL will be returned.
public function is_logged_in() {
// Add the return statement
return $this->logged_in;
}
It is returning NULL, which is a "falsy" value so your check thinks it's not logged in.