Member Avatar for mexabet

I'm struggling to create a two-paged form using $_SESSION. What I want to achieve is the first page (page1.php) requires the user to enter his/her email address. And the second page (page2.php) requires the user to enter his/her password.

When the user submits page1.php, it takes you to page2.php, where the email address submitted will be printed. But unfortunately, the email address is not printed, as intended.

Please, note I've tried to adopt related resolved threads, but I'm still missing something.

The following is my code:
page1.php

<?php
session_start();
?>
<?php error_reporting (E_ALL ^ E_NOTICE); ?>
<!doctype html>
<html><head>
<meta charset="utf-8">
<title>2 Step Login - Page 1</title>
<link href="page1.css" rel="stylesheet">
</head>

<body>

<div id="formwrap">
<div id="form_inner">
    <div id="logo">
      <img src="" alt="logo">
    </div>
    <div id="email">

    </div>
  <div id="pwd">
      Sign in
  </div>
  <div id="form">
    <form action="page2.php" method="post" enctype="multipart/form-data" name="form">

<?php

    //On page 1
    $_SESSION['username'] = $var_value;
?>
      <input id="username" name="username" type="text" placeholder="Email" autofocus required>

    <div id="forgot">No Yet A Member, Register Here</a></div>
    <input type="hidden" name="username" value="var_value">
    <input id="send" name="submit" type="submit" value="Next">
    </form>
  </div>
  </div>
</div>
</body>
</html>

page2.php

<?php
session_start();
?>
<?php error_reporting (E_ALL ^ E_NOTICE); ?>
<!doctype html>
<html>
<head>
<meta charset="utf-8">
<title>2 Step Login - Page 2</title>
<link href="page2.css" rel="stylesheet">
</head>

<body>

<div id="formwrap">
<div id="form_inner">
    <div id="logo">
      <img src="" alt="logo">
    </div>
    <div id="email">
<?php
    //On age 2
    $var_value = $_SESSION['username'];
    echo $_SESSION['username'];
?>
    </div>
  <div id="pwd">
      Enter password
  </div>
  <div id="form">
    <form action="login.php" method="post" enctype="multipart/form-data" name="form">
      <input id="password" name="password" type="password" placeholder="Password" autofocus>
      <div id="chkbx">
<div id="inptch">
  <input id="keep_signed_in" name="keep_signed_in" type="checkbox" value="">
</div>
Keep me signed in</div>

    <div id="forgot">I Forgot My Password</div>
    <div id="different_account">Not A Member, Register Here</div>
    <input type="hidden" name="username" value="var_value">
    <input type="hidden" name="password" value="var_value">
    <input id="send" name="submit" type="submit" value="Sign in">
    </form>
  </div>
</div>
</div>
</body>
</html>

Your help will be much appreciated. Thanks in advanced.

  • 2 Contributors
  • 2 Replies
  • 186 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by mexabet

Dani AI

Generated

Brief diagnosis: the session slot never got a real email because the code assigns the session to an undefined placeholder and also submits a literal placeholder via a hidden field. The usual, reliable flow is: page1 collects the email and POSTs it; page2 calls session_start(), reads and sanitizes the POSTed email, saves that into the session, and then displays or re-uses the session value. session_start() must run before any HTML output.

Minimal, safe pattern (page1: simple form; page2: capture → save → show):

<form action="page2.php" method="post">
  <input name="username" type="email" required placeholder="Email">
  <input type="submit" value="Next">
</form>
<?php
session_start();
$email = filter_input(INPUT_POST, 'username', FILTER_SANITIZE_EMAIL);
if ($email) {
    $_SESSION['username'] = $email;
}
if (empty($_SESSION['username'])) {
    header('Location: page1.php');
    exit;
}
$show = htmlspecialchars($_SESSION['username'], ENT_QUOTES, 'UTF-8');
?>
<div id="email"><?php echo $show; ?></div>

Practical notes and troubleshooting:

  • Remove the hidden inputs that used the literal placeholder; duplicate inputs with the same name cause ambiguous/incorrect values.
  • Avoid enctype="multipart/form-data" unless uploading files.
  • Always escape output (htmlspecialchars) and validate input (FILTER_VALIDATE_EMAIL or FILTER_SANITIZE_EMAIL).
  • Do not store plaintext passwords in session. After final sign-in, regenerate the session id for security.

Debug tips linked to earlier advice: as recommended, use var_dump($_SESSION) (or var_export) on page2 to confirm what's stored. If the session remains empty, check that cookies are enabled and that session_start() is called before output and that PHP session storage (session.save_path) is writable. This explains the issue reported by and provides a robust, secure pattern for a two-step login flow.

Recommended Answers

All 2 Replies

Member Avatar for AndreRet

I tend to use var_dump($_SESSION['username']); to show me any returned values. You can add a input text to also see teh return, the code looks fine -

<div id="email">
    <input type="text" value="
        <?php
    //On age 2
        $var_value = $_SESSION['username'];
        echo $_SESSION['username'];
        ?>
    />
?>
    </div>
Member Avatar for mexabet

, Thanks, I've managed to fix the issue.

commented: Awesome, please share your answer with us if possible and mark this as solved, thanks. +14
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.