Session keeps logging me out - php

Question

Ok, So on my main login php page I have this:
<?php
session_start();
require 'connect.php';
if(mysqli_connect_errno()) {
echo 'Failed to Connect to MySQL' . mysqli_connect_errno();
}
if(isset($_POST['submit'])) {
//Variables
$user = $_POST['username'];
$pass = md5 ($_POST['password']);
//prevent MySQL Inject
$user = stripslashes($user);
$pass = stripslashes($pass);
$query = mysqli_query($con, "SELECT * FROM tech WHERE username = '$user' and password = '$pass'") or die("Can not query the DB");
$count = mysqli_num_rows($query);
if($count == 1) {
$_SESSION['username'] = $user;
$url = 'home.php';
echo '<META HTTP-EQUIV=Refresh CONTENT="0; URL='.$url.'">';
} else {
echo 'Username and Password do not match! Try Again';
$url = 'carelogin.php';
echo '<META HTTP-EQUIV=Refresh CONTENT="2; URL='.$url.'">';
session_destroy();
}
}
?>
And then, On every page at the very top I have this.
<?php
session_start();
require_once 'connect.php';
if(!isset($_SESSION['username'])) {
echo "<h1>You are not an authorised user</h1>";
$url = 'carelogin.php';
echo '<META HTTP-EQUIV=Refresh CONTENT="1; URL='.$url.'">';
} else {
}
?>
After about 30 seconds or so from not touching my mouse on any of those pages if I click REFRESH or if I go forward or backwards, It keeps logging me out. I don't understand. I have all the sessions set but within just 30 seconds I get logged out.
Someone please modify my code to allow me to stay logged in until I click log out Thank you guys!

Answer 1

I think you will find that people will suggest a framework for this sort of thing, however, if you are going to attempt a login, you will probably want to split your script out more thoroughly to accommodate both cleaner and more expandable code. Also, make sure to use ini_set("display_errors",1); error_reporting(E_ALL); above session_start() to be alerted on any errors/warnings happening on the page when testing the site (turn off error reporting in live environment).
Here is a bit of more complex code than what you have, but it should protect you from injection. Note all the folders for each of the files should be in relation to the domain root. Also note, you need to store all your passwords in your database using the password_hash() function. You can use some of this, all of this, none of this, but if you do use it, make sure to look through the PHP manual to understand what all this is doing:
/core.processor/classes/class.DatabaseConfig.php
// This is your database. Fill out the credentials in the connect() method
// I use PDO because I think personally it's easier to use
class DatabaseConfig
{
private static $singleton;
public function __construct()
{
if(empty(self::$singleton))
self::$singleton = $this->connect();
return self::$singleton;
}
// This is the method that creates the database connection
public function connect($host = "localhost", $username = "username", $password = "password", $database = "database")
{
// Create connection options
// 1) Make PDO Exception errors, 2) Do real binding 3) By default prefer fetching associative arrays
$opts = array( PDO::ATTR_ERRMODE => PDO::ERRMODE_EXCEPTION,
PDO::ATTR_EMULATE_PREPARES => false,
PDO::ATTR_DEFAULT_FETCH_MODE => PDO::FETCH_ASSOC);
$conn = new PDO('mysql:host='.$host.';dbname='.$database, $username, $password,$opts);
// Send back the database connection. You can use a "utf-8" character setting here as well...
return $conn;
}
}
/core.processor/classes/class.QueryEngine.php
// This is a simple query engine. It allows for binding (or not binding)
class QueryEngine
{
private $results;
private static $singleton;
public function __construct()
{
if(empty(self::$singleton))
self::$singleton = $this;
return self::$singleton;
}
// This method sends queries to your database
public function query($sql = false,$bind = false)
{
$this->results = 0;
// Create database connection
$db = new DatabaseConfig();
// Attempt to connect and fetch data
try {
// Bind or not bind, provided there is a bind array
// This is important to look up!
if(!empty($bind)) {
$query = $db ->connect()
->prepare($sql);
$query->execute($bind);
}
else {
$query = $db ->connect()
->query($sql);
}
$this->results = $query;
}
catch (PDOException $e)
{
die($e->getMessage());
}
return $this;
}
// This method will fetch an the associative array if used with select statement
public function fetch()
{
while($row = $this->results->fetch())
$result[] = $row;
return (!empty($result))? $result : 0;
}
}
/core.processor/classes/class.HeaderProcessor.php
// This class deals with functions that should happen before the page outputs to the browswer
class HeaderProcessor
{
private static $userData;
// This method just sits and waits for actions to happen
// This method should expand with whatever you plan to do in the future
public static function eventListener($array = array())
{
if(isset($array['action'])) {
if($array['action'] == 'login') {
if(self::getLogin($array['username'],$array['password'])) {
if(self::setSession(self::$userData)) {
$_SESSION['password'] = NULL;
}
header("Location: home.php");
exit;
}
}
elseif($array['action'] == 'logout') {
session_destroy();
header("Location: loggedout.php");
exit;
}
}
}
// Process login
private static function getLogin($user,$pass)
{
$query = new QueryEngine();
$getUser = $query ->query("SELECT * FROM `users` WHERE `username` = :0",array($user))
->fetch();
if($getUser == 0)
return false;
self::$userData = $getUser[0];
// Verify the password hash (this is why you need to store your passwords differently in your db
return password_verify($pass,$getUser[0]['password']);
}
// Assign session variables
private static function setSession($userData)
{
$_SESSION = array_filter(array_merge($userData,$_SESSION));
return true;
}
// This can set options for your site, I just threw in timezone
// as well as the class autoloader
public static function initApp($settings = false)
{
$timezone = (!empty($settings['timezone']))? $settings['timezone'] : 'America/Los_Angeles';
include_once(FUNCTIONS_DIR."/function.autoLoader.php");
date_default_timezone_set($timezone);
}
}
/core.processor/functions/function.autoLoader.php
// This function will auto load your classes so you don't have to always
// include files. You could make a similar function to autoload functions
function autoLoader($class)
{
if(class_exists($class))
return true;
if(is_file($include = CLASS_DIR.'/class.'.$class.'.php'))
include_once($include);
}
/config.php
/*** This config is located in the root folder and goes on every page ***/
// Start session
session_start();
// Define common places
define("ROOT_DIR",__DIR__);
define("CLASS_DIR",ROOT_DIR.'/core.processor/classes');
define("FUNCTIONS_DIR",ROOT_DIR.'/core.processor/functions');
// Require the page initializer class
require_once(CLASS_DIR."/class.HeaderProcessor.php");
// Initialize the autoloader for classes
// Load timezone
// You can put any other preset in this method
HeaderProcessor::initApp();
// Here is where you put in events like login, logout, etc...
HeaderProcessor::eventListener($_POST);
// Use this function to help load up classes
spl_autoload_register('autoLoader');
/login.php
<?php
// add in the config file
require(__DIR__."/config.php");
?><!DOCTYPE html>
<html>
<meta charset="UTF-8">
<title>My Login</title>
<head>
</head>
<body>
<form id="loginForm" method="post" action="">
<input name="username" type="text" />
<input name="password" type="password" />
<input name="action" type="hidden" value="login" />
<input type="submit" value="LOGIN" />
</form>
</body>
</html>

Answer 2

Please increase session timeout with this:
// server should keep session data for AT LEAST 1 hour
ini_set('session.gc_maxlifetime', 3600);
// each client should remember their session id for EXACTLY 1 hour
session_set_cookie_params(3600);
session_start(); // ready to go!

Answer 3

First you need to find out what your php settings are:
create an info.php file at the root of your project with the following lines:
<?php
phpinfo();
Load the page on your browser and locate the following variable:
session.gc_maxlifetime
It is likely that your sessions have been set to expire after a very short period of time (the default is about 24 mins but the value displayed is in seconds - 1440). In your case, this value might be equal to 30
To change it to your preferred length of time, you need to change your php settings as follows(ensure you have the right permissions to make write changes on your server):
Locate your php.ini settings file. It is likely located in the following location on your linux server:
/etc/php/7.0/apache2/php.ini
You should open this file with your editor of choice, e.g. nano on your command line as follows:
sudo nano /etc/php/7.0/apache2/php.ini
Locate the following variable:
session.gc_maxlifetime
Change the corresponding value to a longer time span such as 1 day which you can calculate as follows: 1day * 24hrs * 60mins * 60secs = 86400secs
Set it up as follows:
session.gc_maxlifetime = 86400
Save the file and restart apache as follows from your command line:
sudo service apache2 restart
Reload your info.php file and the changes should have taken effect.

Answer 4

EDIT: I remove my first Suggestion
Or try my code
Here it will check if you are connected to your database I name it connect.inc.php
<?php
if(!mysql_connect('localhost', 'root', '')|| !mysql_select_db('byp_db'))
{
die(mysql_error());
}
?>
Next I created my core.inc.php where it will check if you are already in session you will use the loggedin() method in that
<?php
error_reporting(E_ALL ^ E_NOTICE);
ob_start();
session_start();
$current_file = $_SERVER['SCRIPT_NAME'];
$http_referer = $_SERVER['HTTP_REFERER'];
function loggedin() {
if(isset($_SESSION['user_p_info_id'])&&!empty($_SESSION['user_p_info_id'])) {
return true;
}else {
return false;
}
}
function getuserfield($field){
$query = "SELECT `$field` FROM `user_p_info` where `user_p_info_id`='".$_SESSION['user_p_info_id']."'";
if($query_run = mysql_query($query)){
if($query_result = mysql_result($query_run, 0, $field)){
return $query_result;
}
}
}
?>
Next is you will create your log-in form
<?php
require 'connections/connect.inc.php';
require 'connections/core.inc.php';
if(isset($_POST['uname']) && isset($_POST['password'])){
$uname = $_POST['uname'];
$pword = $_POST['password'];
//echo $uname;
//echo $pword;
if(!empty($uname)&&!empty($pword)){
$query_login = "SELECT * FROM user_a_info where username = '$uname' and password = '$pword'";
//echo $query_login;
$query_result = mysql_query($query_login);
$num_rows = mysql_num_rows($query_result);
if($num_rows == 0){
?>
<script type="text/javascript">
alert("Invalid Data !");
</script>
<?php
}else{
//echo "validated";
$user_p_info_id = mysql_result($query_result, 0, 'user_p_info_id');
$_SESSION['user_p_info_id']=$user_p_info_id;
header('Location: index.php');
}
}
}
?>
<form action="login.php" method="POST">
<p> USERNAME : <input type="text" name="uname" /> </p>
<p> PASSWORD : <input type="password" name="password" /> </p>
<p> <input type="submit" value="LOGIN" /> </p>
</form>
And then your log-out function will look like this
<?php
require 'core.inc.php';
session_destroy();
header('Location: ../index.php');
?>
Just take note that if you want to check whether you are in session or not just put this condition
<?php
require 'connections/connect.inc.php';
require 'connections/core.inc.php';
if(loggedin()) {
// Do something
}
?>
Hope this helps