Setting $_SESSION with AJAX/jQuery | PHP Sessions Not Working?

Question

I am writing a login script for my website. I've written the login script, and I have the form tied to it via an AJAX call through jQuery.

Here is the php the form is calling:

<?PHP   
    # Make sure form data was passed to the script
    IF (isset($_POST) && isset($_POST['username']) && isset($_POST['password'])){
        # Connect to the database
        REQUIRE('../../../../my_db.php');

        # Define variables
        $given_username = $_POST['username'];
        $given_password = $_POST['password'];
        $hashed_password = md5($given_password);
        $matched_username = "";
        $matched_password = "";


        # See if there is matching info in the database
        $sql = 'SELECT username, pass FROM users WHERE username="'.$given_username.'" AND pass = "'.$hashed_password.'"';
        $result = mysql_query($sql);
        WHILE($row = mysql_fetch_assoc($result)){
            $matched_username = $row['username'];
            $matched_password = $row['pass'];
        };


        # If there was a match
        IF ($matched_username != "" && $matched_password != ""){

            # Double check the values match
            IF ($given_username == $matched_username && $hashed_password == $matched_password){

                # If there is only one result returned
                $session_sql = 'SELECT * FROM users WHERE username="'.$matched_username.'" AND pass = "'.$matched_password.'"';
                $session_result = mysql_query($session_sql);
                IF(count(mysql_fetch_assoc($session_result)) != 0  &&  count(mysql_fetch_assoc($session_result)) < 2){

                    # If they do, start a session
                    if(!isset($_SESSION)) {
                     session_start();
                     session_regenerate_id();
                    };

                    # Set our session values
                    WHILE($session_row = mysql_fetch_assoc($session_result)){
                        $_SESSION['id'] = $session_row['id'];
                        $_SESSION['last_login'] = $session_row['last_login'];
                        $_SESSION['username'] = $session_row['username'];
                        $_SESSION['signup_date'] = $session_row['signup_date']; 
                    };

                    # Set users last login date and time to this login
                    $update_sql = 'UPDATE users SET last_login = NOW WHERE username="'.$matched_username.'" AND pass = "'.$matched_password.'"';
                    $update = mysql_query($update_sql);

                    echo json_encode(array("success"=>"user logged in", "session"=>$_SESSION));
                }ELSE 
                    echo json_encode(array("error"=>"More than one user with the same information.  What did you do?!"));
            }ELSE
                echo json_encode(array("error"=>"invalid login provided"));
        }ELSE
            echo json_encode(array("error"=>"invalid login provided"));
    }ELSE
        echo json_encode(array("error"=>"you must supply a username and password"));
?>

But if I do console.log(result.session) I get [], which makes me think that either setting session variables through ajax isn't viable, or the session itself isn't working properly.

I get no errors from this code.

Can somebody point me in the right direction?

I don't think I have access to php.ini, but I remember from a long time ago that you had to set sessions to run in a file somewhere, but for the life of me I can't find an example.

Hi @StephenRios I have the same problem, how did you solved that? thanks in advance — Ebrahim, Nov 01 '15 at 19:53
@Ebrahim Check the answer I chose below. That's what solved my problem. — StephenRios, Nov 02 '15 at 18:21

score 5 · Accepted Answer · edited May 23 '17 at 12:18

5

Make sure you have session_start() at the beginning of your script. If any notices or anything is thrown before you get to session_start() then you'll get an error like this:

Warning: session_start(): Cannot send session cookie - headers already sent by (output started at...

Also, your script is open to SQL injection. Make sure you properly escape the username and password! Note: your best bet is to use prepared statements.

edited May 23 '17 at 12:18

Community

1
1

answered Dec 13 '11 at 21:45

Yes Barry

9,514
5
50
69

so I need session_start() at the beginning of my javascript? Wouldn't we only want to start a session if the user has successfully logged in? or do we just check against the session to see if they have logged in and just run it all the time? – StephenRios Dec 13 '11 at 21:57
No not at the beginning of your _javascript_, at the beginning of your _PHP_ script. And no, you only want to _store the data_ in the session if the user logs in, you still need to start it at the beginning to avoid errors. – Yes Barry Dec 13 '11 at 22:00
Moved session_start() to the beginning, added ini_set to try and set some of the session settings. No luck on either front. Thanks for the info about session and SQL injection though. – StephenRios Dec 13 '11 at 22:12

score 1 · Answer 2 · edited May 23 '17 at 12:26

Dear @StephenRios especially thanks for your answers, I did apply the mentioned settings in the code, But actually the problem was about CORS Cross-Origin Resource Sharing, I was stuck with this issue and asked a question Dear @StephenRios especially thanks for your answers, I did apply the mentioned settings in the code, But actually the problem was about CORS Cross-Origin Resource Sharing, I was stuck with this issue and asked a question in stackoverflow and speaking my friend Milano Fili could solve the problem,

I used a setting in angularJS:

$httpProvider.defaults.withCredentials = true;

and also a setting in my web server (here apache)

Header add Access-Control-Allow-Credentials "true"

very appreciated for your replies, I just shared my case here because I was googling this more than 3 days, I hope, it could help.

hornetbzz · Answer 3 · 2011-12-14T02:12:42.683

Some hints for your php script :

Make sure you started a session as the first code line after the php tag,

session_start();
// other code comes here

Note: you can also check that your session is started using session_id()

First test separately the php script called by Ajax (put some valid $_POST data as code entry) and make sure you do not echo anything before your return json strings and you do not get warnings (that will be considered like screen outputs),
you might also declare the right headers as they look missing here :

header('Content-type: application/json');
Do not forget the javascript callback to read the request answer :-)

score 0 · Answer 4 · answered Dec 13 '11 at 21:51

I've been away from PHP for a while, so I might be talking from my fundament, but I think you need to be using session_start() and session_write_close().

You should call session_start() before you do anything to the $_SESSION array. Once you have finished modifying $_SESSION you should call session_write_close()

For more details, see http://www.php.net/manual/en/book.session.php

You may also need to modify php.ini, if your hosting provider hasn't done it already. See http://www.php.net/manual/en/session.configuration.php

Hope this helps.

Guess I'm going to have to get in touch with my hosting provider. I tried setting that stuff with ini_set, but even that didn't work. — StephenRios, Dec 13 '11 at 22:12

Setting $_SESSION with AJAX/jQuery | PHP Sessions Not Working?

4 Answers4