Session not working without any error

Question

I have login system in which session's applied when user has successfully logged in. This is something you know for a long time, right? The login works like a charm but no session can be applied afterwards. I've tried to var_dump it, print_r it, and echoing it without any success but without any error. Could someone help a brother out?

Code

<?php 

require_once $_SERVER["DOCUMENT_ROOT"] . '/project-school/config/init.php';
session_start();

error_reporting(E_ALL); 
ini_set('display_errors', 'On'); 


if (isset($_POST['submit-admin-login']))
{
$username=db_escape($koneksi, $_POST['username']);
$password=db_escape($koneksi, md5($_POST['password']));

 if(empty($username) || empty($password)) 
    {
        $_SESSION['pesan'] = 'Username dan Password Wajib Diisi Dengan Benar';
        $_SESSION['alert'] = 'danger';
        header('location:../login.php');
    }
    else
    {
        $sqladmin= "SELECT * FROM admin WHERE username='$username' AND password='$password'";
        $queryadmin= mysqli_query($koneksi, $sqladmin) or die(mysqli_error($koneksi));          
        $resultadmin= mysqli_num_rows($queryadmin);

        $sqlpengajar= "SELECT * FROM pengajar WHERE username_login='$username' AND password_login='$password'";
        $querypengajar= mysqli_query($koneksi, $sqlpengajar) or die(mysqli_error($koneksi));
        $resultpengajar= mysqli_num_rows($querypengajar);

        if($resultadmin > 0)
        {
            while ($row = mysqli_fetch_array($queryadmin)) {
                $_SESSION['username_admin'] = $row['username'];
                $_SESSION['level']          = $row['level'];    
            }
            echo $_SESSION['username_admin'];
            header('Location: ../view/admin-dashboard.php');
        }
        elseif($resultpengajar > 0)
        {
            while ($row = mysqli_fetch_array($querypengajar)) {
            $_SESSION['nip']                = $row['nip'];
            $_SESSION['nama_lengkap']       = $row['nama_lengkap'];
            $_SESSION['level']              = $row['level'];
            $_SESSION['username_pengajar']  = $row['username_login'];
            $_SESSION['alamat']             = $row['alamat'];
            $_SESSION['tempat_lahir']       = $row['tempat_lahir'];
            $_SESSION['tgl_lahir']          = $row['tgl_lahir'];
            $_SESSION['jenis_kelamin']      = $row['jenis_kelamin'];
            $_SESSION['agama']              = $row['agama'];
            $_SESSION['foto']               = $row['foto'];
            }
            echo $_SESSION['username_pengajar'];
            header('Location: ../view/pengajar-dashboard.php');
        }
        else
        {
            $_SESSION['pesan'] = 'Username atau Password Anda Salah';
            $_SESSION['alert'] = 'danger';
            header('Location: ../login.php');
        }
    }       
}

The session starts after the num_rows

Put `error_reporting(E_ALL); ini_set('display_errors', 'On'); ` at the start to see if `session_start` is throwing any errors. — Script47, Sep 11 '17 at 10:26
@rndus2r: yea, of course and session checking is included too — , Sep 11 '17 at 10:30
@Shan: What do you mean? It's already on the very top of the page — , Sep 11 '17 at 10:31
@Script47: It's already on top of the page and nothing shows — , Sep 11 '17 at 10:31
[Little Bobby](http://bobby-tables.com/) says ***[your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php)***. Even [escaping the string](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) is not safe! — Jay Blanchard, Feb 08 '18 at 17:06
**Never store plain text passwords!** Please use ***PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html)*** to handle password security. If you're using a PHP version less than 5.5 you can use the `password_hash()` [compatibility pack](https://github.com/ircmaxell/password_compat). ***It is not necessary to [escape passwords](http://stackoverflow.com/q/36628418/1011527)*** or use any other cleansing mechanism on them before hashing. Doing so *changes* the password and causes unnecessary additional coding. — Jay Blanchard, Feb 08 '18 at 17:06

score 1 · Answer 1 · answered Sep 11 '17 at 10:27

Try starting your session before the required statement. Like

<?php 
session_start();
require_once $_SERVER["DOCUMENT_ROOT"] . '/project-school/config/init.php';

Always start the session at the first whenever you are going to use sessions, otherwise php doesn't reads it.

You are on a high risk of sql injections. Learn about prepared statements to keep it safe from sql injections

Session not working without any error

1 Answers1