I’m encountering an issue with file conflicts between different pages on my website. Specifically, when a user logs in and is redirected to their dashboard, the content from the login page, including CSS and HTML elements, is appearing on the dashboard page.
I’ve implemented PHP sessions to handle user authentication and have created separate files for session management (session_handler.php) and authentication (tauth.php) “for teacher login”. However, it seems like the session data or file inclusion mechanisms are causing the issue.
Note:
I have to include these files in each page to authenticate user data as he uses the website in this way:
<?php
require_once 'session_handler.php';
require_once 'tauth.php';
$conn = getDatabaseConnection();
?>
I use “require_once” for not to repeat including files in the page many times.
Possible causes I’m considering:
- Connection with Database must be closed after successful login.
- Issues with storing session data.
- Invalid PHP functions may cause conflicts between pages files.
login.php:
<?php
ini_set('session.cookie_httponly', 1);
ini_set('session.cookie_secure', 1);
ini_set('session.use_strict_mode', 1);
require 'session_handler.php';
$errors = [];
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
if (!isset($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
if (!isset($_POST['csrf_token']) || $_POST['csrf_token'] !== $_SESSION['csrf_token']) {
$errors[] = 'Ivalid CSRF token.';
} else {
$username = htmlspecialchars(trim(mysqli_real_escape_string($conn, $_POST['username'])));
$password = htmlspecialchars($_POST['password']);
$account_type = htmlspecialchars($_POST['account_type']);
if (!in_array($account_type, ['teacher', 'student'])) {
$errors[] = 'Incorrect Account Type.';
}
if (empty($username)) {
$errors[] = 'Please Enter Username.';
}
if (empty($password)) {
$errors[] = 'Please Enter Password.';
}
if (empty($errors)) {
$table = ($account_type === 'teacher') ? 'teacher' : 'student';
$query = "SELECT * FROM $table WHERE username = ?";
if ($stmt = $conn->prepare($query)) {
$stmt->bind_param("s", $username);
$stmt->execute();
$result = $stmt->get_result();
if ($result->num_rows === 1) {
$row = $result->fetch_assoc();
if (password_verify($password, $row['password'])) {
session_regenerate_id(true);
$_SESSION['user_id'] = $row['id'];
$_SESSION['account_type'] = $account_type;
$_SESSION['username'] = $row['username'];
$_SESSION['first_name'] = $row['first_name'];
$_SESSION['last_name'] = $row['last_name'];
$_SESSION['email'] = $row['email'];
$_SESSION['phone_number'] = $row['phone_number'];
if ($account_type === 'teacher') {
$_SESSION['title'] = $row['title'];
} else {
$_SESSION['guardian_phone'] = $row['guardian_phone'];
$_SESSION['gender'] = $row['gender'];
$_SESSION['level'] = $row['level'];
}
$token = bin2hex(random_bytes(32));
setcookie('user_token', $token, time() + 86400 * 30, "/", "", true, true);
$_SESSION['user_token'] = $token;
if ($account_type === 'teacher') {
sleep(1);
header("Location: teacher-dashboard.php");
} else {
sleep(1);
header("Location: student-dashboard.php");
}
exit();
} else {
$errors[] = 'Username or Password May be Incorrect';
}
} else {
$errors[] = 'This Account Is Not Exist';
}
$stmt->close();
}
}
}
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
} else {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
?>
session_handler.php:
<?php
require_once 'db_connect.php';
$conn = getDatabaseConnection();
session_set_save_handler(
'openSession',
'closeSession',
'readSession',
'writeSession',
'destroySession',
'gcSession'
);
function openSession() {
return true;
}
function closeSession() {
return true;
}
function readSession($id) {
global $conn;
$stmt = $conn->prepare("SELECT data FROM sessions WHERE id = ? AND last_accessed > DATE_SUB(NOW(), INTERVAL 30 DAY)");
$stmt->bind_param("s", $id);
$stmt->execute();
$result = $stmt->get_result();
if ($row = $result->fetch_assoc()) {
return $row['data'];
}
return '';
}
function writeSession($id, $data) {
global $conn;
$stmt = $conn->prepare("REPLACE INTO sessions (id, data, last_accessed) VALUES (?, ?, NOW())");
$stmt->bind_param("ss", $id, $data);
return $stmt->execute();
}
function destroySession($id) {
global $conn;
$stmt = $conn->prepare("DELETE FROM sessions WHERE id = ?");
$stmt->bind_param("s", $id);
return $stmt->execute();
}
function gcSession($maxlifetime) {
global $conn;
$stmt = $conn->prepare("DELETE FROM sessions WHERE last_accessed < DATE_SUB(NOW(), INTERVAL ? SECOND)");
$stmt->bind_param("i", $maxlifetime);
return $stmt->execute();
}
session_start();
?>
tauth.php:
<?php
if (session_status() === PHP_SESSION_NONE) {
session_start();
}
if (empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(32));
}
require_once 'session_handler.php';
require_once 'db_connect.php';
try {
$conn = getDatabaseConnection();
if (!isset($_SESSION['user_id']) || $_SESSION['account_type'] !== 'teacher') {
header("Location: login.php");
exit();
}
$user_id = $_SESSION['user_id'];
$sql = "SELECT * FROM teacher WHERE id = ?";
$stmt = $conn->prepare($sql);
$stmt->bind_param("i", $user_id);
$stmt->execute();
$result = $stmt->get_result();
if ($result->num_rows > 0) {
$user = $result->fetch_assoc();
$_SESSION['first_name'] = htmlspecialchars($user['first_name'], ENT_QUOTES, 'UTF-8');
$_SESSION['last_name'] = htmlspecialchars($user['last_name'], ENT_QUOTES, 'UTF-8');
$_SESSION['username'] = htmlspecialchars($user['username'], ENT_QUOTES, 'UTF-8');
$_SESSION['email'] = htmlspecialchars($user['email'], ENT_QUOTES, 'UTF-8');
$_SESSION['phone_number'] = htmlspecialchars($user['phone_number'], ENT_QUOTES, 'UTF-8');
$_SESSION['title'] = htmlspecialchars($user['title'], ENT_QUOTES, 'UTF-8');
session_regenerate_id(true);
} else {
header("Location: login.php");
exit();
}
$stmt->close();
} catch (Exception $e) {
error_log("Error fetching teacher data: {$e->getMessage()}");
header("Location: error_page.php");
exit();
}
I have tried to close connection using $conn->close(); but the page goes in failures.
