title: retrieve data from database using session
body: <p>Hi I had read topics here and tried doing it in different ways but my problem still not solved. I tried storing session and use it to retrieve data again from the database. I used the session idmember and set it to a variable then used it to a query to echo his/her first and last name. I can get to the main page but the user's name doesn't echo it. 
  To summarize here how it works. index > authenticate(validate) > student/index.php</p>
  
  <p>functions.php</p>
  
  <pre><code>&lt;?php 
  
  function sec_session_start() {
          $session_name = 'sec_session_id'; // Set a custom session name
          $secure = true; // Set to true if using https.
          $httponly = true; // This stops javascript being able to access the session id. 
  
          ini_set('session.use_only_cookies', 1); // Forces sessions to only use cookies. 
          $cookieParams = session_get_cookie_params(); // Gets current cookies params.
          session_set_cookie_params($cookieParams["lifetime"], $cookieParams["path"], $cookieParams["domain"], $secure, $httponly); 
          session_name($session_name); // Sets the session name to the one set above.
          session_start(); // Start the php session
          session_regenerate_id(); // regenerated the session, delete the old one.     
  }
  
  
  
  ?&gt;
  </code></pre>
  
  <p>index.php (Main Page)</p>
  
  <pre><code>&lt;?php 
  include ('include/functions.php');
  sec_session_start();
  include ('header.php');
  ?&gt;
  &lt;title&gt;Students Portal&lt;/title&gt;
  &lt;div id="upper_row"&gt;&lt;b&gt;Announcement:&lt;/b&gt;&lt;/div&gt;
      &lt;div id="l_column"&gt;&lt;/div&gt;
  
        &lt;div id="r_column"&gt;
        &lt;form action="authenticate.php" method="POST" name="loginform"&gt;
    &lt;table width="100%"&gt;
        &lt;tr&gt;
          &lt;th colspan="3" align="left"&gt;USER LOGIN&lt;br /&gt;&lt;hr /&gt;&lt;/th&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
          &lt;td width="72"&gt;Username:&lt;/td&gt;
          &lt;td width="212"&gt;
               &lt;script type="text/javascript"&gt;
              function blank(a) { if(a.value == a.defaultValue) a.value = ""; }
              function unblank(a) { if(a.value == "") a.value = a.defaultValue; }
              &lt;/script&gt; 
          &lt;input type="text" value="Enter your School ID here" onfocus="blank(this)" onblur="unblank(this)" name="id" /&gt;
          &lt;/td&gt;
  
        &lt;/tr&gt;
        &lt;tr&gt;
           &lt;td&gt;Password:&lt;/td&gt;
           &lt;td&gt;&lt;script type="text/javascript"&gt;
          function blank(a) { if(a.value == a.defaultValue) a.value = ""; }
          function unblank(a) { if(a.value == "") a.value = a.defaultValue; }
          &lt;/script&gt; 
          &lt;input type="password" value="Password" onfocus="blank(this)" onblur="unblank(this)" name="password" /&gt;&lt;/td&gt;
        &lt;/tr&gt;
        &lt;tr&gt;
          &lt;td&gt;&lt;/td&gt;
        &lt;td rowspan="3" align="center"&gt;&lt;input type="submit" name="login" value="Login" /&gt;&lt;/td&gt;
        &lt;/tr&gt;
    &lt;/table&gt;
  
        &lt;/form&gt;
        &lt;/div&gt;
  
  
    &lt;?php 
  include "footer.php";
  ?&gt;
  </code></pre>
  
  <p>authenticate.php</p>
  
  <pre><code>&lt;?php
  include ('include/conn.php');
  include ('include/functions.php');
  sec_session_start();
  // username and password sent from form
  if(isset($_POST['login'])) {    
          $user=$_POST['id'];
          $pass=$_POST['password'];
  
          // To protect MySQL injection (more detail about MySQL injection)
          $user = stripslashes($user);
          $pass = stripslashes($pass);
          $user = mysql_real_escape_string($user);
          $pass = mysql_real_escape_string($pass);
          $crypt_pass=md5($pass);
          //query from database
          $result=mysql_query("SELECT username,user_pass,user_id FROM tbl_user WHERE username ='$user' and user_pass='$crypt_pass'");
          $result2=mysql_fetch_row($result);
          // Mysql_num_row is counting table row
          $count=mysql_num_rows($result);
  
          //First Step of Validation
          //get the ip address of the user then the attempts
          $iptocheck = $_SERVER['REMOTE_ADDR'];
          $iptocheck = mysql_real_escape_string($iptocheck);
          $resultip = mysql_query("SELECT ip_address,login_attempts,username FROM tbl_sec_login WHERE ip_address = '$iptocheck' AND username='$user'");
          $ipcount = mysql_num_rows($resultip);
          $rowx = mysql_fetch_row($resultip);
  
          if(mysql_num_rows($resultip) &gt; 1) {
              //Already has some IP address records in the database
              //Get the total failed login attempts associated with this IP address
              if ($rowx['1'] &gt; 3) {
                  header("Location: index.php");
              }
          }
          //If none then insert it to the table
          else if ($ipcount == 0) {
              $loginattempts = 0;
  
              mysql_query("INSERT INTO tbl_sec_login (ip_address,login_attempts,username) VALUES ('$iptocheck','$loginattempts','$user')");
          }
          //Second step of validation
          //if count is equal to 1 then proceed to next condition
          if($count==1){
                  //Third Step of Validation
                  // If result matched $user and $crypt_pass, table row must be 1 row
  
                  if ($user==$result2[0] AND $crypt_pass==$result2[1]){
                      $_SESSION['idmember'] = $_POST['id'];
  
                      $loginattempts = 0;
                      mysql_query("DELETE FROM tbl_sec_login WHERE ip_address = '$iptocheck' AND username='$user'");
  
  
                      if($result2[2]==3) {
                      header("Location: student/index.php?id=$user");
                      }elseif ($result2[2]==2) {
                      header("Location: epersonnel/index.php");
                      }elseif ($result2[2]==1) {
                      header("Location: admin/index.php");
                      }
  
                  }else{
                      $loginattempts = $rowx['1'] + 1;
  
                      mysql_query("UPDATE tbl_sec_login SET login_attempts = '$loginattempts' WHERE ip_address = '$iptocheck' AND username='$user'");
                      header("Location: login.php");
                  }
  
              } 
              else {
                  $loginattempts = $rowx['1'] + 1;
  
                  mysql_query("UPDATE tbl_sec_login SET login_attempts = '$loginattempts' WHERE ip_address = '$iptocheck' AND username='$user'");
                  header("Location: login.php");
              }
          }
  
          else {
              header("Location: index.php");
              }
  
  
  ?&gt;
  </code></pre>
  
  <hr>
  
  <p>student/index.php</p>
  
  <pre><code>&lt;?php
  session_start(); 
  
  if(!empty($_SESSION['idmember'])){
      header("Location: login.php");
  }
  require 'include/conn.php';
  $id = $_SESSION['idmember'];
  $query="SELECT first_name,last_name FROM tbl_studentmasterlist WHERE sid ='$id'";
  $result=mysql_query($query);
  $row = mysql_fetch_array($result);
  
  include "header.php";
  ?&gt;
  &lt;div id="s_l_column"&gt;
      &lt;div id="i_location"&gt;
      Welcome, &lt;br /&gt;
      &lt;center&gt;&lt;img name="" src="" width="185" height="135" alt=""&gt; &lt;br /&gt;
      &amp;raquo; &lt;?php echo $row['first_name']." ".$row['last_name'];?&gt; &lt;/center&gt;
      &lt;hr /&gt;
      &lt;/div&gt;
  
      &lt;div id="side_menubar"&gt;
      &lt;/div&gt;
  &lt;/div&gt;
  
  &lt;div id="s_r_column"&gt;
  
      &lt;div class="menubar"&gt;
          &lt;ul&gt;
              &lt;li&gt;&lt;a href="#" class="leftEdge clearBorder"&gt;Home&lt;/a&gt;&lt;/li&gt;
              &lt;li&gt;&lt;a href="#"&gt;Account Setting&lt;/a&gt;&lt;/li&gt;
              &lt;li&gt;&lt;a href="#"&gt;Enrollment Guide&lt;/a&gt;&lt;/li&gt;
              &lt;li&gt;&lt;a href="#"&gt;Enroll&lt;/a&gt;&lt;/li&gt;
              &lt;li&gt;&lt;a href="#" class="rightEdge"&gt;Logout&lt;/a&gt;&lt;/li&gt;
          &lt;/ul&gt;                
      &lt;/div&gt;
  
      &lt;div id="b_contianer"&gt;
  
      &lt;/div&gt;
  
  &lt;/div&gt;
  
  
  &lt;?php 
  include "footer.php";
  ?&gt;
  </code></pre>