title: Infinite loop on login redirect
body: <p>I have a login script which generally works for me, but occasionally goes into an infinite loop on redirecting after checking the cookie stored for login. The browser will report something like the following: "Firefox has detected that the server is redirecting the request for this address in a way that will never complete."  Others have reported this issue too.  Below are the key elements of the login process.  I wonder if someone can see what the issue is with this process/script.</p>
  
  <p>Thanks,</p>
  
  <p>Nick</p>
  
  <p>First at the <strong>top of each page</strong> that is protected:</p>
  
  <pre><code>&lt;?php
  session_start();
  
  $_SESSION['url'] = $_SERVER['REQUEST_URI'];
  
  require('login/config.php');
  require('login/functions.php'); 
  
  if (allow_access(Users) != "yes")
  { 
  include ('login/check_login.php'); 
  exit;
  }
  ?&gt;
  </code></pre>
  
  <p>Then in <strong>check_login.php</strong>:</p>
  
  <pre><code>&lt;?
  session_start();
  
  //check to see if the user already has an open session
  if (($_SESSION[user_name] != "") &amp;&amp; ($_SESSION[password] != ""))
  {
  
      header("Location:$_SESSION[redirect]");
      exit;
  }
  
  $lr_user = $_COOKIE['lr_user'];
  $lr_pass = $_COOKIE['lr_pass'];
  
  //check to see if cookies have been set previously
  if(($lr_user != "") &amp;&amp; ($lr_pass != ""))
  {
      header("Location:/login/redirect.php");
      exit;
  }
  
  //if neither is true, redirect to login
      header("Location:/login/login.php");
  
  ?&gt;
  </code></pre>
  
  <p>Then, in <strong>redirect.php:</strong></p>
  
  <pre><code>&lt;?
  session_start();
  
  //require the functions file
  require ("config.php");
  require ("functions.php");
  
  $lr_user = $_COOKIE['lr_user'];
  $lr_pass = $_COOKIE['lr_pass'];
  
  //check to see if cookies are already set, remember me
  if ((!$lr_user) || (!$lr_pass))
  {
  
  $username = $_POST[username];
  $password = $_POST[password];
  
  }else{
  
  $username = $lr_user;
  $password = $lr_pass;
  
  }
  
  //sets cookies to remember this computer if the user asks to
  if ($_POST[remember] == "Yes")
  {
  setcookie("lr_user", $username, $duration, "/", $domain);
  setcookie("lr_pass", $password, $duration, "/", $domain);
  }
  
  //sets session variables
  sess_vars($base_dir, $server, $dbusername, $dbpassword, $db_name, $table_name, $username, $password);
  
  if(isset($_SESSION['url']))
    $_SESSION[redirect] = $_SESSION['url']; // holds url for last page visited.
  else 
     $_SESSION[redirect] = "/index.php"; // default page for
  
  //redirects the user    
  header("Location:$_SESSION[redirect]");
  ?&gt;
  </code></pre>
  
  <p><strong>functions.php</strong></p>
  
  <pre><code>&lt;?php
  
  //function to get the date
  function last_login()
  {
      $date = gmdate("Y-m-d");
      return $date;
  }
  
  //function that sets the session variable
  function sess_vars($base_dir, $server, $dbusername, $dbpassword, $db_name, $table_name, $username, $password)
  {
  
      //make connection to dbase
      $connection = @mysql_connect($server, $dbusername, $dbpassword)
                  or die(mysql_error());
  
      $db = @mysql_select_db($db_name,$connection)
                  or die(mysql_error());
  
      $sql = "SELECT * FROM $table_name WHERE username = '$username' and password = password('$password')";
  
      $result = @mysql_query($sql, $connection) or die(mysql_error());
  
  
      //get the number of rows in the result set
      $num = mysql_num_rows($result);
  
      //set session variables if there is a match
      if ($num != 0) 
      {
          while ($sql = mysql_fetch_object($result)) 
          {
              $_SESSION[first_name]   = $sql -&gt; firstname;
              $_SESSION[last_name]    = $sql -&gt; lastname; 
              $_SESSION[user_name]    = $sql -&gt; username;       
              $_SESSION[password]     = $sql -&gt; password;
              $_SESSION[group1]       = $sql -&gt; group1;
              $_SESSION[group2]       = $sql -&gt; group2;
              $_SESSION[group3]       = $sql -&gt; group3;
              $_SESSION[pchange]      = $sql -&gt; pchange;  
              $_SESSION[email]        = $sql -&gt; email;
              $_SESSION[redirect]     = $sql -&gt; redirect;
              $_SESSION[verified]     = $sql -&gt; verified;
              $_SESSION[last_login]   = $sql -&gt; last_login;
          }
      }else{
          $_SESSION[redirect] = "$base_dir/errorlogin.php";
      }
  }
  
  
  //functions that will determine if access is allowed
  function allow_access($group)
  {
      if ($_SESSION[group1] == "$group" || $_SESSION[group2] == "$group" || $_SESSION[group3] == "$group" ||
          $_SESSION[group1] == "Administrators" || $_SESSION[group2] == "Administrators" || $_SESSION[group3] == "Administrators" ||
          $_SESSION[user_name] == "$group")
          {
              $allowed = "yes";
          }else{
              $allowed = "no";
          }
      return $allowed;
  }
  
  //function to check the length of the requested password
  function password_check($min_pass, $max_pass, $pass)
  {
  
      $valid = "yes";
      if ($min_pass &gt; strlen($pass) || $max_pass &lt; strlen($pass))
      {
          $valid = "no";
      }
  
      return $valid;
  }
  
  ?&gt;
  </code></pre>
  
  <p><strong>config.php</strong></p>
  
  <pre><code>&lt;?
  
  //set up the names of the database and table
  $db_name ="";
  $table_name ="authorize";
  
  //connect to the server and select the database
  $server = "localhost";
  $dbusername = "";
  $dbpassword = "*";
  
  //domain information
  $domain = "";
  
  //Change to "0" to turn off the login log
  $log_login = "1";
  
  //base_dir is the location of the files, ie http://www.yourdomain/login
  $base_dir = "";
  
  //length of time the cookie is good for - 7 is the days and 24 is the hours
  //if you would like the time to be short, say 1 hour, change to 60*60*1
  $duration = time()+60*60*24*365*10;
  
  //the site administrator\'s email address
  $adminemail = "";
  
  //sets the time to EST
  $zone=3600*00;
  
  //do you want the verify the new user through email if the user registers themselves?
  //yes = "0" :  no = "1"
  $verify = "0";
  
  //default redirect, this is the URL that all self-registered users will be redirected to
  $default_url = "";
  
  //minimum and maximum password lengths
  $min_pass = 8;
  $max_pass = 15;
  
  
  $num_groups = 0+2;
  $group_array = array("Users","Administrators");
  
  ?&gt;
  </code></pre>