html - Incorrectly redirecting user back to a PHP page after submitting a form -

all,

this question has simple answer - i'm overlooking. maybe can tell me look...

i have php page ("index.php") simple login form (e.g., username , password).

when user clicks "submit" button, form posts values php page ("login.php"). page supposed confirm user's credentials, following:

• if user's credentials not correct, redirect user error.php, along error message
• if user's credentials correct, create session , set $_session['authenticated'] = true, redirect him "loggedin.php"

[update]

then, on loggedin.php, check see isset($_session['authenticated']) returns true. if does, proceed. if not, redirect user index.php.

however, here's happens. first time fill out form (with valid creds) , submit it, can see briefly in url bar user sent login.php, loggedin.php, back index.php.

but, if re-enter same credentials , submit info second time, works should.

so, in short, looks either login.php not setting $_session variable first time through, or is, reason, it's not set when check first time on loggedin.php

is there delay between setting variable on login.php, , having isset() return true on loggedin.php?

or, there else i'm doing wrong?

here relevant (i think) snippets of code:

in login.php:

session_start(); $_session['authenticated'] = true; header('location: http://www.mydomain.com/loggedin.php'); 

in loggedin.php:

session_start(); $authenticated = $_session['authenticated']; if (!isset($authenticated)) {     header('location: http://www.footballpoolz.com/mobile/index.php');     die(); } 

many in advance advice or insights!

cheers, matt stuehler

i think may know cause of error. session has linked browser , ip address (this way more 1 person can logged in @ time). means session has not stored server-side, client has have link session know logged in when request data. session id shared part of header during http requests.

when you're redirecting user, though, aren't giving them chance send new headers, you? you're sending them new page. new page never saw header them, doesn't know session variable (php has hundreds or thousands of session variables) belongs them. when log in second time, sending header, , you're sending session id , php knows session variable yours.

there 2 solutions. first find way redirect them forces them send new header. believe using header("location: www.mysite.com/newpage.php"); this. may mistaken.

the alternative temporarily pass session id when redirect them loggedin.php know logged in first page load. after initial page load, no longer need take step since done every time request page. pass session id append ?sid=... redirect.

http://www.php.net/manual/en/session.idpassing.php