$Session changes on new page

[panthro]

I'm having trouble with sessions changing on a second page.

login.php:
include 'nliheader.php'; (Header used at login time)

if(isset($_POST['submit'])){
$username = $_POST["username"];
$password = $_POST["password"];


$result = mysql_query("SELECT * FROM `grpgusers` WHERE `username`='$username'") or die ("Name and password not found or not matched");
$worked = mysql_fetch_array($result);
$user_class = new User($worked['id']);
$_SESSION['id'] = $worked['id'];
$_SESSION['username'] = $worked['username'];

if($worked['password'] == $password){
echo "You are logged in as ID " .$_SESSION['id'] ." and " . $_SESSION['username'] . " as your username. If this is not you. Log out and log back in.";


?>
Second page = header.php (main header after login)
session_start();

if (!isset($_SESSION['id'])) {


include('home.php');

die();

}


I added that "echo" line in login to see what $session was beeing set to. It shows correct EVERYTIME

After going to index.php (includes header.php) the $session 'id', stays as should. But it seems random that the $session 'user' is either correct or changes to the last registered user. even if comes back as correct user. Refreshing again, will result in "last registered username(incorrect). Can anyone help me out here?

[CrySet]

I havn't tested this, but this is very briefly what i would do:

<?php
include_once('nliheader.php');

if(isset($_POST['username'])){
$username = htmlentities($_POST["username"]);
$password = htmlentities($_POST["password"]);


$sql= "SELECT * FROM grpguser WHERE username='$username' AND password='$password' LIMIT 0,1";
$result = mysql_query($sql) or die('Cannot connect');
if(mysql_num_rows($result) != "0")
{
session_start();
$worked = mysql_fetch_array($result);
$user_class = new User($worked['id']);
$_SESSION['id'] = $worked['id'];
$_SESSION['username'] = $worked['username'];
echo "You have been logged in under the username: ".$worked["username"]."<br />";

}
else
{
//what happens if username & pass combo is not found
}

}
else
{
?>
<form action="login.php" method="post">
<table>
<tr><td>Username:</td><td><input type="text" name="username"></td></tr>
<tr><td>Password:</td><td><input type="password" name="password"></td></tr>
<tr><td></td><td><input type="submit" value="Login"></td></tr>
</table>
</form>
<?php
}
?>

[panthro]

First let me thank you for replying and putting efforts into correcting my problem.

After adding the "s" to "grpguser(s)
The code seems to work. I'll continue to test for changes throughout the day.


Looked good for a moment. however refreshing the index.php & header.php combo still results in a change of username ( The last registered member). I'll post the two affiliated files that occur after the login procces. (if you need the classes.php [an include in header] let me know)

The header: Minus the HTML for header and menu bar

<?

/*
$color[0] = "#333";
$color[1] = "#ddd";
$color[2] = "#444";
$color[3] = "#ffffff";
$color[4] = "#111";
$color[5] = "#000000";
$color[6] = "#666666";
$color[7] = "#FFFF00";
$color[8] = "#1E1E1E";
$color[9] = "#ffcc00";
$color[10] = "#4d75a0";
$color[11] = "#7d9fc4";
$color[12] = "#FFFF33";
*/


session_start();

if (!isset($_SESSION['id'])) {


include('home.php');

die();

}

include 'dbcon.php';

include 'classes.php';

include 'updates.php';
require_once("nbbc.php");

if ($_GET['action'] == "logout"){

session_destroy();

die('You have been logged out.<meta http-equiv="refresh" content="0;url=index.php">');

}



function microtime_float()

{

$time = microtime();

return (double)substr( $time, 11 ) + (double)substr( $time, 0, 8 );

}



microtime_float();

$starttime = microtime_float();



if (Is_User_Banned($_SESSION['id']) == 1){
?> <h1>Your account has been BANNED!! Reason:</h1><?php

echo "<h1>" . Why_Is_User_Banned($_SESSION['id']) . "</h1>";

die();

}

$user_class = new User($_SESSION['id']);

// get style info
$cresult = mysql_query("SELECT `value` FROM `styles` WHERE `style`='".$user_class->style."'");
$i = 0;
while($line = mysql_fetch_array($cresult, MYSQL_ASSOC)) {
$color[$i] = $line['value'];
$i++;
}
//get style info

$result = mysql_query("SELECT * FROM `serverconfig`");
$worked = mysql_fetch_array($result);
if($worked['serverdown'] != "" && $user_class->admin != 1){
die("<h1><font color='red'>SERVER DOWN<br><br>".$worked['serverdown']."</font></h1>");
}

$time = date(F." ".d.", ".Y." ".g.":".i.":".sa,time());

$result = mysql_query("UPDATE `grpgusers` SET `lastactive` = '".time()."', `ip` = '".$_SERVER['REMOTE_ADDR']."' WHERE `id`='".$_SESSION['id']."'");


function callback($buffer){
$user_class = new User($_SESSION['id']);

$checkhosp = mysql_query("SELECT * FROM `grpgusers` WHERE `hospital`!='0'");
$nummsgs = mysql_num_rows($checkhosp);
$hospital = "[".$nummsgs."]";
echo "$hospital";

$checkjail = mysql_query("SELECT * FROM `grpgusers` WHERE `jail`!='0'");
$nummsgs = mysql_num_rows($checkjail);
$jail = "[".$nummsgs."]";
echo "$jail";

$checkmail = mysql_query("SELECT * FROM `pms` WHERE `to`='$user_class->username' and `viewed`='1'");
$nummsgs = mysql_num_rows($checkmail);
$mail = "[".$nummsgs."]";
echo "$mail";

$checkmail = mysql_query("SELECT * FROM `events` WHERE `to`='$user_class->id' and `viewed` = '1'");
$numevents = mysql_num_rows($checkmail);
$events = "[".$numevents."]";
echo "$events";

$result = mysql_query("SELECT * from `effects` WHERE `userid`='".$user_class->id."'");
if (mysql_num_rows($result) != 0){
$effects = '<div class="headbox">Current Effects</div>';
while($line = mysql_fetch_array($result, MYSQL_ASSOC)) {
$effects .= '<a class="leftmenu" href="effects.php?view='.$line['effect'].'">'.$line['effect']." (".floor($line['timeleft']).")".'</a></ul><br />';
}
}
$out = $buffer;
// $out = str_replace("<!_-formexp-_!>", $user_class->maxexp, $out);
// $out = str_replace("<!_-expperc-_!>", $user_class->exppercent, $out);

$out = str_replace("<!_-formexp-_!>", $user_class->formattedexp, $out);
$out = str_replace("<!_-expperc-_!>", $user_class->exppercent, $out);


$out = str_replace("<!_-money-_!>", $user_class->money, $out);
$out = str_replace("<!_-formhp-_!>", $user_class->formattedhp, $out);
$out = str_replace("<!_-hpperc-_!>", $user_class->hppercent, $out);
$out = str_replace("<!_-formenergy-_!>", $user_class->formattedenergy, $out);
$out = str_replace("<!_-energyperc-_!>", $user_class->energypercent, $out);
$out = str_replace("<!_-formawake-_!>", $user_class->formattedawake, $out);
$out = str_replace("<!_-awakeperc-_!>", $user_class->awakepercent, $out);
$out = str_replace("<!_-formnerve-_!>", $user_class->formattednerve, $out);
$out = str_replace("<!_-nerveperc-_!>", $user_class->nervepercent, $out);
$out = str_replace("<!_-points-_!>", $user_class->points, $out);
$out = str_replace("<!_-level-_!>", $user_class->level, $out);
$out = str_replace("<!_-hospital-_!>", $hospital, $out);
$out = str_replace("<!_-jail-_!>", $jail, $out);
$out = str_replace("<!_-mail-_!>", $mail, $out);
$out = str_replace("<!_-events-_!>", $events, $out);
$out = str_replace("<!_-effects-_!>", $effects, $out);
$out = str_replace("<!_-cityname-_!>", $user_class->cityname, $out);

return $out;
}

ob_start("callback");


?>
*************************************************

The index.php

<?
include 'header.php';


setcookie("user", $username, time()+900); /* Expires in a week */
?>
<tr>
<td class="contenthead">General Information</td>
</tr>
<tr>
<td class="contentcontent">
<table width='100%'>
<tr>
<td width='15%'>Name:</td>
<td width='35%'><a href='profiles.php?id=<? echo $user_class->id; ?>'><? echo $user_class->formattedname; ?></a></td>
<td width='15%'>HP:</td>

<td width='35%'><?php echo $user_class->formattedhp; ?></td>
</tr>

<tr>
<td width='15%'>Level:</td>
<td width='35%'><? echo $user_class->level; ?></td>
<td width='15%'>Energy:</td>
<td width='35%'><?php echo $user_class->formattedenergy; ?></td>

</tr>

<tr>
<td width='15%'>Money:</td>
<td width='35%'>$<? echo $user_class->money; /*money_format('%(#10n', $user_class->money);*/ ?></td>
<td width='15%'>Awake:</td>
<td width='35%'><?php echo $user_class->formattedawake; ?></td>
</tr>

<tr>
<td width='15%'>Bank:</td>
<td width='35%'>$<? echo $user_class->bank; /*money_format('%(#10n', $user_class->bank);*/ ?></td>
<td width='15%'>Nerve:</td>
<td width='35%'><?php echo $user_class->formattednerve; ?></td>
</tr>

<tr>
<td width='15%'>EXP:</td>

<td width='35%'><?php echo $user_class->formattedexp; ?></td>
<td width='15%'>Work EXP:</td>
<td width='35%'><? echo $user_class->workexp; ?></td>
</tr>
<tr>
<td width='15%'>Prostitutes:</td>
<td width='35%'><?php echo $user_class->hookers; ?></td>
<td width='15%'>Marijuana:</td>
<td width='35%'><?php echo $user_class->marijuana; ?></td>
</tr>
</table>
</td>
</tr>

<tr>
<td class="contenthead">Attributes</td>
</tr>
<tr>
<td class="contentcontent">
<table width='100%'>
<tr>
<td width='15%'>Strength:</td>
<td width='35%'><? echo $user_class->strength; ?></td>

<td width='15%'>Defense:</td>
<td width='35%'><? echo $user_class->defense; ?></td>
</tr>

<tr>
<td width='15%'>Speed:</td>
<td width='35%'><? echo $user_class->speed; ?></td>
<td width='15%'>Total:</td>

<td width='35%'><? echo $user_class->totalattrib; ?></td>
</tr>
</table>
</td>
</tr>

<tr><td class="contenthead">Battle Stats</td></tr>
<tr><td class="contentcontent">
<table width='100%'>
<tr>
<td width='15%'>Won:</td>
<td width='35%'><? echo $user_class->battlewon ?></td>
<td width='15%'>Lost:</td>
<td width='35%'><? echo $user_class->battlelost; ?></td>

</tr>

<tr>
<td width='15%'>Total:</td>
<td width='35%'><? echo $user_class->battletotal; ?></td>
<td width='15%'>Money Gain:</td>
<td width='35%'>$<? echo $user_class->battlemoney; ?></td>
</tr>
</table>
</td>
</tr>

<tr>
<td class="contenthead">Crime Stats</td>
</tr>
<tr>
<td class="contentcontent">
<table width='100%'>

<tr>
<td width='15%'>Succeeded:</td>
<td width='35%'><? echo $user_class->crimesucceeded; ?></td>
<td width='15%'>Failed:</td>
<td width='35%'><? echo $user_class->crimefailed; ?></td>
</tr>

<tr>
<td width='15%'>Total:</td>

<td width='35%'><? echo $user_class->crimetotal; ?></td>
<td width='15%'>Money Gain:</td>
<td width='35%'>$<? echo $user_class->crimemoney; ?></td>
</tr>
</table></td>
</tr>
<?
include 'footer.php';
?>