Problem with login script - Could use help

I am having an issue where I am getting logged out of my session even though I am actively using the site. It is currently set to 30 minutes of inactivity before logging a user out, but it is not working correctly.

Here is the function:




So, as far as how I expected this to work, if the user is logged in and does nothing for 30 minutes (I.e., doesn't change pages) he/she will be logged out after 30 min. (session destroyed)

However, if they go to another page that calls logincheck(), which each page does, it should check last activity time and if less than 1800 seconds, reset the last activity time to current, thereby keeping the session active. But like I said, I can be on the site for 30 minutes, changing pages, performing actions, and it still logs me out. I can't find any error in this script. Can you?

Thanks all.

Hi,

are you sure you actually start the session on each page? Because for some reason, there is no session_start() in your function.

Apart from that, I don't see any error, nor could I reproduce the problem you described. If the above doesn't work, start debugging your code:

• Turn on all error messages with error_reporting(-1)
• Does the session actually get destroyed by the function? Check that by outputting something in the corresponding if statement.
• If it does get destroyed by the function, check the concrete value of LAST_ACTIVITY

You should also fix several style issues in your code:

• Remove the semicolon at the end of the function block. It has no use and generates an empty statement.
• Fix the code indentation.
• else if should be elseif.
• Unless your PHP is out of date, consider using the DateTime class instead of the low-level time function

Thanks for the reply, and yes, the code is a bit sloppy

As far as session_start(), yes, that is at the top of the page -- this code is included in functions.inc.php ... Every page does indeed have session_start() as the first command.

I will try putting an echo in after the session_destroy and see what it says. I see no reason why it should be doing this.

I have tried to echo the session_destroy() but I am getting nothing. I can be working on the site for 30 minutes, and without fail, the next time I refresh a page or go to another, I am logged out.

This is going to be very problematic as logged in users are working with time consuming data entry, and if they get logged out before it gets saved, I just lost a user.

I have tried using the site in both firefox and chrome and get the same situation.

I have gone over the code again, and still cannot find any reason why it wouldn't be working. Anyone smarter than me able to find a problem?

Thanks again...

What is the expiration date on the session cookie that PHP is sending?

Remove all of the code from your logincheck() method except the first if block; does the problem still happen?

What does phpinfo say are your settings for the session configuration?

So far I have not found any error, you need to debug the code at each level and see what is happening. Check the variables name if they are being used correctly, i mean the spelling and all that. Also you need to check with your configuration settings. Hope this will helps you.