title: PHP session variables not carrying over to my logged in page, but session ID is
body: <p>I'm using <strong>PHP 4.3.9, Apache/2.0.52</strong></p>
  
  <p>I'm trying to get a login system working that registers DB values in a session where they're available once logged in. <strong>I'm losing the session variables once I'm redirected</strong>.</p>
  
  <p>I'm using the following code to print the session ID/values on my login form page and the redirected page:</p>
  
  <pre><code>echo '&lt;font color="red"&gt;session id:&lt;/font&gt; ' . session_id() . '&lt;br&gt;';
  echo '&lt;font color="red"&gt;session first name:&lt;/font&gt; ' . $_SESSION['first_name'] . '&lt;br&gt;';
  echo '&lt;font color="red"&gt;session user id:&lt;/font&gt; ' . $_SESSION['user_id'] . '&lt;br&gt;';
  echo '&lt;font color="red"&gt;session user level:&lt;/font&gt; ' . $_SESSION['user_level'] . '&lt;br&gt;&lt;br&gt;';
  </code></pre>
  
  <p>This is what's printed in my browser from my login page (I just comment out the header redirect to the logged in page). <strong>This is the correct info coming from my DB as well, so all is fine at this point</strong>.</p>
  
  <pre><code>session id: 1ce7ca8e7102b6fa4cf5b61722aecfbc
  session first name: elvis
  session user id: 2
  session user level: 1
  </code></pre>
  
  <p>This is what's printed on my redirected/logged in page (when I uncomment the header/redirect). <strong>Session ID is the same</strong>, but I get no values for the individual session variables.</p>
  
  <pre><code>session id: 1ce7ca8e7102b6fa4cf5b61722aecfbc
  session first name:
  session user id:
  session user level:
  </code></pre>
  
  <p>I get the following errors:</p>
  
  <p><strong>Undefined index: first_name<br>
  Undefined index: user_id<br>
  Undefined index: user_level</strong></p>
  
  <p>I have a global <strong>header.php</strong> file which my loggedIN.php does NOT call, though loggedOUT.php does - to toast the session):</p>
  
  <p><strong>header.php</strong>  </p>
  
  <pre><code>&lt;?php
  ob_start();
  session_start();
  
  //if NOT on loggedout.php, check for cookie. if exists, they haven't explicity logged out so take user to loggedin.php
  if (!strpos($_SERVER['PHP_SELF'], 'loggedout.php')) {
      /*if (isset($_COOKIE['access'])) {
          header('Location: www.mydomain.com/loggedin.php');
      }*/
  } else {
      //if on loggedout.php delete cookie
      //setcookie('access', '', time()-3600);
  
      //destroy session
      $_SESSION = array();
      session_destroy();
      setcookie(session_name(), '', time()-3600);
  }
  
  //defines constants and sets up custom error handler
  require_once('config.php');
  
  ?&gt;&lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"&gt;
  
  some page layout stuff
  
  Login portion is eventually called via include
  
  footer stuff
  </code></pre>
  
  <p>My <strong>loggedIN.php</strong> does nothing but start the session</p>
  
  <pre><code>&lt;?php
  session_start();
  ?&gt;&lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"&gt;
  </code></pre>
  
  <p>The <strong>logic of my login script</strong>, the key part being I'm fetching the DB results right into $_SESSION (about half way down):</p>
  
  <pre><code>if (isset($_POST['login'])) {
          //access db
          require_once(MYSQL);
  
          //initialize an errors array for non-filled out form fields
          $errors = array();
  
          //setup $_POST aliases, clean for db and trim any whitespace
          $email  = mysql_real_escape_string(trim($_POST['email']), $dbc);
          $pass   = mysql_real_escape_string(trim($_POST['pass']), $dbc);
  
          if (empty($email)) {
              $errors[] = 'Please enter your e-mail address.';
          }
  
          if (empty($pass)) {
              $errors[] = 'Please enter your password.';
          }
  
          //if all fields filled out and everything is OK
          if (empty($errors)) {
              //check db for a match
              $query = "SELECT user_id, first_name, user_level 
                      FROM the rest of my sql here, blah blah blah";
  
              $result = @mysql_query($query, $dbc) 
                  OR trigger_error("Query: $query\n&lt;br /&gt;MySQL Error: " . mysql_error($dbc));
  
              if (@mysql_num_rows($result) == 1) { //a match was made, OK to login
  
                  //register the retrieved values into $_SESSION
                  $_SESSION = mysql_fetch_array($result);
                  mysql_free_result($result);
                  mysql_close($dbc);
                  /*              
                  setcookie('access'); //if "remember me" not checked, session cookie, expires when browser closes
                                       //in FF you must close the tab before quitting/relaunching, otherwise cookie persists
  
                  //"remember me" checked?
                  if(isset($_POST['remember'])){ //expire in 1 hour (3600 = 60 seconds * 60 minutes)
                      setcookie('access', md5(uniqid(rand())), time()+60); //EXPIRES IN ONE MINUTE FOR TESTING
                  }
                  */
  
  echo '&lt;font color="red"&gt;cookie:&lt;/font&gt; ' . print_r($_COOKIE) . '&lt;br&gt;&lt;br&gt;';
  echo '&lt;font color="red"&gt;session id:&lt;/font&gt; ' . session_id() . '&lt;br&gt;';
  echo '&lt;font color="red"&gt;session first name:&lt;/font&gt; ' . $_SESSION['first_name'] . '&lt;br&gt;';
  echo '&lt;font color="red"&gt;session user id:&lt;/font&gt; ' . $_SESSION['user_id'] . '&lt;br&gt;';
  echo '&lt;font color="red"&gt;session user level:&lt;/font&gt; ' . $_SESSION['user_level'] . '&lt;br&gt;&lt;br&gt;';
  
                  ob_end_clean();
                  session_write_close();
  
                  $url = BASE_URL . 'loggedin_test2.php';
                  header("Location: $url");
                  exit();
              } else {
              //wrong username/password combo
              echo '&lt;div id="errors"&gt;&lt;span&gt;Either the e-mail address or password entered is incorrect or you have not activated your account. Please try again.&lt;/span&gt;&lt;/div&gt;';
              }
  
              //clear $_POST so the form isn't sticky
              $_POST = array();
          } else { 
          //report the errors
          echo '&lt;div id="errors"&gt;&lt;span&gt;The following error(s) occurred:&lt;/span&gt;';
  
              echo '&lt;ul&gt;';
              foreach($errors as $error) {
                  echo "&lt;li&gt;$error&lt;/li&gt;";
              }
              echo '&lt;/ul&gt;&lt;/div&gt;';
          }
  
      } // end isset($_POST['login'])
  </code></pre>
  
  <p><strong>if I comment out the header redirect on the login page, I can echo out the $_SESSION variables with the right info from the DB. Once redirected to the login page, however, they're gone/unset.</strong></p>
  
  <p>Anyone have any ideas?  I've spent nearly all day on this and can't say I'm any closer to figuring it out.</p>
  
  <p>BTW, I recently made 2 simple test pages, one started a session, set some variables on it, had a form submit which redirected to a second page which did nothing but read/output the session vars.  It all seems to work fine, I'm just having issues with something I'm doing in my main app.</p>