PHP when refresh page ,browser remove a session

Viewed 13

I don't know exactly how to explain ... When I log in, on a browser page, enter the correct user, but if I open another page, still in the browser in use, and I refresh it automatically chooses one of the two users, deleting the other

I don't know if I have explained myself well, I don't know how to explain myself well. excuse me

This is a private page code (page after log in)

session_start();


function authenticate()
{
    return array_key_exists('email', $_SESSION);
};

if (authenticate() !== true) {
  header("location: /private/login/log-in.php");
} 

$user_id = $_SESSION['id'];

$email = $_SESSION['email'];
$password = $_SESSION['password'];

$check_id = "SELECT * FROM usertable WHERE email = '$email'";
$result = mysqli_query($conn, $check_id);
if (mysqli_num_rows($result) > 0) {
  $fetch_info = mysqli_fetch_assoc($result);
  $user_id = $fetch_info['id'];
};


   This is a login code

session_start();

$user_id = $_SESSION['id'];

$email = $_SESSION['email'];
$password = $_SESSION['password'];

$check_id = "SELECT * FROM usertable WHERE email = '$email'";
$result = mysqli_query($conn, $check_id);
if (mysqli_num_rows($result) > 0) {
  $fetch_info = mysqli_fetch_assoc($result);
};

if (isset($_POST['login'])) {
  $email = filter_var($_POST['email'], FILTER_VALIDATE_EMAIL);
  $password = md5($_POST['password'], FILTER_SANITIZE_FULL_SPECIAL_CHARS);
  date_default_timezone_set("Europe/Rome");
  $date = date('Y-m-d H:i:s');
  $sql_insert_date = mysqli_query($conn, "UPDATE usertable SET activeLogInDate = '$date'");
  $check_email = "SELECT * FROM usertable WHERE email = '$email' ";
  $res = mysqli_query($conn, $check_email);
  if (mysqli_num_rows($res) > 0) {
    $fetch = mysqli_fetch_assoc($res);
    $_SESSION['id'] = $fetch['id'];
    $uniqueID = $fetch['uniqueID'];
    $username = $fetch['username'];
    $name = $fetch['name'];
    $fetch_pass = $fetch['password'];
    if (password_verify($password, $fetch_pass)) {
      $activeStatus = "Online";
      $sql2 = mysqli_query($conn, "UPDATE usertable SET activeStatus = '$activeStatus'");
      $_SESSION['email'] = $email;
      $status = $fetch['status'];
      if ($status == 'verified') {
        $_SESSION['email'] = $email;
        $_SESSION['password'] = $password;
        header("location: /private/private_page/private.php?us=$uniqueID?nm=$username");
      } else {
        $info = "Non è stata verificata la tua identità,controlla il messaggio inviato all' email $email";
        $_SESSION['info'] = $info;
        header('location: /private/otp/otp-code.php');
      }
    } else {
      $errors['email'] = "Inserimento password o email non corretto!";
    }
  } else {
    $errors['email'] = "Sembra che tu non sia ancora un membro! Clicca sul pulsante registrati per iscriverti.";
  }
};
1 Answers

The line -

$password = md5($_POST['password'], FILTER_SANITIZE_FULL_SPECIAL_CHARS);

is incorrect. md5()'s second parameter is meant to be a bool; you've got a likely copy/paste/edit error from the previous line, filter_var();

Take out the second parameter.

BTW you shouldn't really rely on md5 these days. There's a password_hash() function that's what you should be using now.

Related