header() redirection/session variable problem

[Nick Whitelegg]

Hello,

I'm having an odd problem with combining an authentication session
variable with header() redirection. Basically I have an authentication
script which checks a username/password. If the login is correct a
session variable containing the username is set and the user is
redirected to the (restricted access) main menu page.

The problem is, the FIRST (and only the first) time the user attempts
to login, the "Session variable not set" error message comes up when
the user is redirected to the private page. However the SECOND attempt
to login works.

Can anyone shed some light on this? The relevant code is below; system
is PHP4.3.1 on IIS, 5 I think. The error didn't occur when the PHP was
4.2.x - is this a known 4.3 issue?

Thanks,
Nick

//////////////////////// Login/authentication script
////////////////////////

// Code to check for correct password snipped

// Save the username in a session variable. This will be used in all
// private pages.
$_SESSION['username'] = $username;

// Tried this to attempt to solve the problem. It didn't work.
// sleep(1);

// Redirect to private page

mysql_close($conn);
header("Location: main.php?page=0");

//////////////////// Private main index page
///////////////////////////////////

// Check the username session variable exists
if (isset($_SESSION['username']))
{
// Write out private page
}
else
{
echo "Session variable not set!<A HREF=login.html>Back to
login</A>";
exit;
}

[Jan Pieter Kunst]

In article <c12cf038.0309171127.3ca4290f@posting.google.com >,
[email]nick.whitelegg@solent.ac.uk[/email] (Nick Whitelegg) wrote:

> The problem is, the FIRST (and only the first) time the user attempts
> to login, the "Session variable not set" error message comes up when
> the user is redirected to the private page. However the SECOND attempt
> to login works.

You have to initialize or re-open a session with a call to
session_start(); before you start working with $_SESSION variables.

There was no session_start() in your code examples. It might have been
snipped, of course, but that is the first thing that comes to mind.

JP

--
Sorry, <devnull@cauce.org> is een "spam trap".
E-mail adres is <jpk"at"akamail.com>, waarbij "at" = @.