title: Php session variables being lost after redirect
body: <p>Hello i have been looking for weeks to solve this. i have a login code that after entering you information to log in the form sends the information to a php page that runs a function from an include that checks that database and saves the information if it matches, then returns true. the php page then redirects to home page that runs a logged in check function but the sessions are not there.</p>
  
  <p>I have made sure that i have session_start(); at the top of all pages
  the header has a exit(); after it and the redirect is header('Location: ../home.php');
  i have checked the phpinfo();
  i tried session_write_close(); and session_regenerate_id(true);, session_regenerate_id();
  iv checked the Session save path /temp </p>
  
  <p>the sessions save all up till till the redirect iv echoed everywhere checked every help site and page</p>
  
  <p>this is the login</p>
  
  <pre><code>    if (login($email, $password, $mysqli) == true) {
      // Login success
      session_write_close();
      header('Location: ../home.php');
      exit();
  } else {
      // Login failed 
      header('Location: ../signIn.php?error=1');
      exit();
  }
  </code></pre>
  
  <p>i save the sessions in the login function and when i echo it here they are still there but after the redirect i echo in the loginCheck function and there is nothing.</p>
  
  <p>this is the session function im using</p>
  
  <pre><code>function sec_session_start() {
  $session_name = 'sec_session_id';
  $secure = 'SECURE';
  
  $httponly = true;
  
  if (ini_set('session.use_only_cookies', 1) === FALSE) {
      header("Location: ../error.php?err=Could not initiate a safe session (ini_set)");
      exit();
  }
  
  $cookieParams = session_get_cookie_params();
  session_set_cookie_params($cookieParams["lifetime"], $cookieParams["path"], $cookieParams["domain"], $secure, $httponly);
  
  session_name($session_name);
  session_start();
  session_regenerate_id();
  }
  </code></pre>
  
  <p>this is my loginCheck dosent make it passed the first if cuz of no sessions</p>
  
  <pre><code>function login_check($mysqli) {
  // Check if all session variables are set 
  echo $_SESSION['hello'];
  echo $_SESSION['username'];
  echo $_SESSION['user_id'];
  echo $_SESSION['login_string'];
  echo 'hello';
  
  if (isset($_SESSION['user_id'], $_SESSION['username'], $_SESSION['login_string'])) {
  //if ($_SESSION['Logging'] == "correct") {
      echo 'hello';
      $user_id = $_SESSION['user_id'];
      $login_string = $_SESSION['login_string'];
      $username = $_SESSION['username'];
  
      // Get the user-agent string of the user.
      $user_browser = $_SERVER['HTTP_USER_AGENT'];
  
  
      if ($stmt = $mysqli-&gt;prepare("SELECT password 
                                    FROM company_users 
                                    WHERE id = ? LIMIT 1")) {
          // Bind "$user_id" to parameter. 
          $stmt-&gt;bind_param('i', $user_id);
          $stmt-&gt;execute();   // Execute the prepared query.
          $stmt-&gt;store_result();
  
          if ($stmt-&gt;num_rows == 1) {
              // If the user exists get variables from result.
              $stmt-&gt;bind_result($password);
              $stmt-&gt;fetch();
              $login_check = hash('sha512', $password . $user_browser);
  
              if ($login_check == $login_string) {
                  // Logged In!!!! 
                  return true;
              } else {
                  // Not logged in 
                  return false;
              }
          } else {
              // Not logged in 
              return false;
          }
      } else {
          // Not logged in 
          return false;
      }
  } else {
      // Not logged in 
  
      return false;
    }
  }
  </code></pre>
  
  <p>this is the form</p>
  
  <pre><code>&lt;form class="form-horizontal" action="includes/signInValidation.php"  method="POST" name='login_form'&gt;
  
          &lt;div class="form-group"&gt;
              &lt;label class="col-lg-2 control-label "&gt;Email&lt;/label&gt;
              &lt;div class="col-lg-10"&gt;
                  &lt;input class="form-control textBox" id="email" name='email' placeholder="Email" type="email"&gt;
              &lt;/div&gt;
          &lt;/div&gt;
  
          &lt;div class="form-group"&gt;
              &lt;label class="col-lg-2 control-label "&gt;Password&lt;/label&gt;
              &lt;div class="col-lg-10"&gt;
                  &lt;input class="form-control textBox" id="password" nam='password' placeholder="Password" type="password"&gt;
              &lt;/div&gt;
          &lt;/div&gt;
  
          &lt;div class="form-group"&gt;
              &lt;label class="col-lg-2 control-label "&gt;&lt;/label&gt;
              &lt;div class="col-lg-10"&gt;
                  &lt;input class="btn btn-success"  type="button" value='Login' onclick='formhash(this.form, this.form.password);' &gt;
              &lt;/div&gt;
          &lt;/div&gt;
      &lt;/form&gt;
  </code></pre>
  
  <p>this is the login function</p>
  
  <pre><code>function login($email, $password, $mysqli) {
  // Using prepared statements means that SQL injection is not possible.
  if ($stmt = $mysqli-&gt;prepare("SELECT id, username, password, salt 
      FROM company_users
     WHERE email = ?
      LIMIT 1")) {
      $stmt-&gt;bind_param('s', $email);  // Bind "$email" to parameter.
      $stmt-&gt;execute();    // Execute the prepared query.
      $stmt-&gt;store_result();
  
  
      // get variables from result.
      $stmt-&gt;bind_result($user_id, $username, $db_password, $salt);
      $stmt-&gt;fetch();
  
      // hash the password with the unique salt.
      $password = hash('sha512', $password . $salt);
      if ($stmt-&gt;num_rows == 1) {
          // If the user exists we check if the account is locked
          // from too many login attempts 
  
          if (checkbrute($user_id, $mysqli) == true) {
              // Account is locked 
              // Send an email to user saying their account is locked
              return false;
          } else {
              // Check if the password in the database matches
              // the password the user submitted.
              if ($db_password == $password) {
  
                  // Password is correct!
                  // Get the user-agent string of the user.
                  $user_browser = $_SERVER['HTTP_USER_AGENT'];
                  // XSS protection as we might print this value
                  $user_id = preg_replace("/[^0-9]+/", "", $user_id);
                  $_SESSION['user_id'] = $user_id;
                  // XSS protection as we might print this value
                  $username = preg_replace("/[^a-zA-Z0-9_\-]+/", "", $username);
                  $_SESSION['username'] = $username;
                  $_SESSION['login_string'] = hash('sha512', $password . $user_browser);
  
                  return true;
  
  
  
  
                  //echo $_SESSION['username'];
                  //echo $_SESSION['user_id'];
                  //echo $_SESSION['login_string'];
                  // Login successful.
  
              } else {
                  // Password is not correct
                  // We record this attempt in the database
                  $now = time();
                  $mysqli-&gt;query("INSERT INTO login_attempts(user_id, time)
                                  VALUES ('$user_id', '$now')");
                  return false;
              }
          }
      } else {
          // No user exists.
          return false;
      }
  
      //$_SESSION['check'] = 'hello';
    }
  }
  </code></pre>
  
  <p>signInValidation</p>
  
  <pre><code>&lt;?php
  include_once 'db/dbConnect.php';
  include_once 'functions.php';
  sec_session_start();
  if (isset($_POST['email'], $_POST['p'])) {
      $email = $_POST['email'];
      $password = $_POST['p']; // The hashed password.
  if (login($email, $password, $mysqli) == true) {
      // Login success
      //$_SESSION['loggedIn'] = 'true';
      session_write_close();
      header('Location: ../profile.php');
      exit();
  } else {
      // Login failed 
      header('Location: ../signIn.php?error=1');
      exit();
  }
  } else {
      // The correct POST variables were not sent to this page. 
      echo 'Invalid Request';
  }
  </code></pre>