Member Avatar for backendcode

hello friends,
Help me plz.any body can tell me how to pass a value from one page to another page by using a session. After login page.

Help me plz

login.php

<form name="join" action="check_login.php" method="post" onsubmit="return validate_form(join)">
<table border="0px">
<tr><td align="left">E-mail: </td><td><input type="text" name="email" value="" class="form_field" /></td></tr>
<td>&nbsp;</td>
<tr><td align="left">Password: </td><td><input type="password" name="password" value="" class="form_field" /></td></tr>
<td>&nbsp;</td>
<tr><td></td><td align="right"><span style="width:150px; float:left; font-family:'Times New Roman', Times, serif; color:#CC0000"><a href="join.php">Not a member yet? <em>Register Now</em></a></span><input type="submit" name="submit" value="Login" /></td></tr>
</table><br />

</form>

check_login.php


<?php session_start()?>

<?php
$host="localhost";
$user="root";
$pass="";
$db_name="oma";
$con=mysql_connect($host,$user,$pass) or die(mysql_error());
$sql=mysql_select_db($db_name,$con);


$email=$_POST;
$password=$_POST;

$select="SELECT * FROM users WHERE email='$email' and password='$password'";
$result=mysql_query($select);
if(mysql_num_rows($result) > 0)
{
$_SESSION=$email;
header("location:home.php");
}
else{


header("location:login_wrong.php");

}


?>

  • 6 Contributors
  • 8 Replies
  • 129 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by backendcode

Dani AI

Generated

The original check_login.php has several bugs and security problems: form values are read incorrectly, the session array is overwritten, plain SQL is built from user input, and passwords appear to be handled in clear text. and were right to stress that a session must be started on every page that reads or writes session data; ’s idea of dumping the whole $_POST into $_SESSION is convenient but dangerous (it can store the plaintext password and overwrite existing session keys).

Minimal, modern checklist (apply to the login script):

  • Call session_start() before any output.
  • Read inputs like $_POST['email'] and $_POST['password'].
  • Use prepared statements (PDO or mysqli) to avoid SQL injection.
  • Store only a non-sensitive user identifier in the session (for example $_SESSION['user_id']), not the password.
  • Regenerate the session ID after successful login to prevent fixation.

Example login-check (conceptual; adapt credentials/column names):

// start session and connect with PDO, then:
$email = $_POST['email'] ?? '';
$password = $_POST['password'] ?? '';

$stmt = $pdo->prepare('SELECT id, password_hash FROM users WHERE email = ? LIMIT 1');
$stmt->execute([$email]);
$user = $stmt->fetch(PDO::FETCH_ASSOC);

if ($user && password_verify($password, $user['password_hash'])) {
    session_regenerate_id(true);
    $_SESSION['user_id'] = $user['id'];
    $_SESSION['email'] = $email;
    header('Location: home.php');
    exit;
}
header('Location: login_wrong.php');
exit;

On any protected page (home.php), start the session and check the session key before showing content:

session_start();
if (empty($_SESSION['user_id'])) { header('Location: login.php'); exit; }
echo 'Hello, '.htmlspecialchars($_SESSION['email'], ENT_QUOTES, 'UTF-8');

Troubleshooting tips: "Headers already sent" usually means output (or a UTF-8 BOM) occurred before session_start/header. Verify the session cookie in the browser, ensure session.save_path is writable, and prefer HTTPS with session.cookie_secure and httponly flags. For broader best practices, see the OWASP Session Management Cheat Sheet (https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html).

Recommended Answers

All 8 Replies

Member Avatar for backendcode

thnx a lot

Member Avatar for Member #671080

Read the tutorials as rajarajan07 suggested, but for a quick answer to your question, if you just add

<?php
session_start();
?>

to the top of home.php, you should be able to use the variable $_SESSIOIN. Remember to sanitize the $_POST data before you use it though.


Zagga

Member Avatar for Bandwidth Media

Note* You should have the session_start() code at the top of every page you intent to use session data with.

Member Avatar for backendcode

ok thnx a lot

Member Avatar for manzarr

i think this code help you
First send the variable to a script
<form method="post" action="array_script.php">
0.<br/>
<input type="text" name="first_name"/><br/><br/>

<input type="submit" name="submit"/> </form>
Move $_POST variable contents into $_SESSION
I will always need to call "session_start()" to use $_SESSION

<?php session_start();

$_SESSION = $_POST;

?>

Above I called the the session_start() function, created a session variable, and set that variable the values sent over via POST. Now I can access that $_SESSION variable from any page on my server.
Accessing $_SESSION Variable
I will always need to call "session_start()" to use $_SESSION

<?php session_start();

$first_name = $_SESSION

echo $first_name;

?>

Member Avatar for backendcode

thnx a lot ...

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.