title: PDO Sessions (can't see session variable)
body: <p>I am trying to create a user login system. I know there are probably some security issues with my code...but I am just learning. I am trying to take the session data from the initial user sign up and display it on a page designated for showing the user information (a profile). My problem is the session data isn't being stored...neither is the data I am sending to the user database. I was using mysqli until I found some posts saying that PDO is more secure. I tried converting everything - but I am not sure if I am doing it right (apparently not if data isn't being stored). Everything was working before I changed to PDO. Here is my code:</p>
  
  <p>storeuser.php</p>
  
  <pre><code>&lt;?php
  session_start();
  
  $host="localhost"; // Host name
  $uname="XXXX"; // Mysql username
  $password="XXX"; // Mysql password
  $db_name="XXX"; // Database name
  $tbl_name="XXX"; // Table name
  
  // Connect to server and select database.
  $link = new PDO("mysql:host=$host;dbname=$db_name, $uname, $password");
  
  // Get values from form
  $username=$_POST['username'];
  $pw=$_POST['pw'];
  $email=$_POST['email'];
  
  //$stm = 'SELECT * FROM users WHERE username = ?';
  //$stm-&gt;bind_param(1,$username);
  //$stm-&gt;execute();
  //$result = $link-&gt;query($stm);
  
  
  $_SESSION["timeout"] = time();
  $_SESSION["username"] = $_POST['username'];
  $_SESSION["password"] = $_POST['pw'];
  $_SESSION["loggedIn"] = true;
  
  // Insert data into mysql
  $sql = "INSERT INTO $tbl_name(username, password, email)VALUES(?,?,?)";
  $stm = $link-&gt;prepare($sql);
  $sql-&gt;bindParam(1, $username);
  $sql-&gt;bindParam(2, $pw);
  $sql-&gt;bindParam(3, $email);
  $sql-&gt;execute();
  $result = $stm-&gt;fetch(PDO::FETCH_ASSOC);
  ?&gt;
  
  &lt;?php
  // close connection
  $link=null;
  ?&gt;
  </code></pre>
  
  <p>The commented out code is just the beginning of me trying to check if the username is already taken. I don't know why my database variables were replaced with "XXX" - but that is not the way it is in my code...</p>
  
  <p>Here is part of my index.php (I left out the html):</p>
  
  <pre><code>&lt;?php
      $handler = new MySessionHandler();
      session_set_save_handler($handler, true);
      session_start();
      // set time-out period (in seconds)
      $inactive = 600;
  
      // check to see if $_SESSION["timeout"] is set
      if (isset($_SESSION["timeout"])) {
          // calculate the session's "time to live"
          $sessionTTL = time() - $_SESSION["timeout"];
          if ($sessionTTL &gt; $inactive) {
              session_destroy();
              printf("session destroyed");
          }
      }
  ?&gt;
  </code></pre>
  
  <p>Then, eventually, I need to set up user login (not user registration) - here is my login script:</p>
  
  <pre><code>&lt;?php
      session_start();
      $_SESSION["timeout"] = time();
      $_SESSION["username"] = $_POST['usernamein'];
      $_SESSION["password"] = $_POST['pwin'];
      $_SESSION["loggedIn"] = true;
  ?&gt;
  </code></pre>
  
  <p><strong>UPDATE</strong></p>
  
  <p>application.js</p>
  
  <pre><code>$(document).ready(function() {
      $("#signupform").submit(function(e) {  
          e.preventDefault();
          $.post('storeuser.php', $(this).serialize(), function(){
              $("#showuser").load("templates/showuser.php");
              $("#signupform").remove();
          });
      });
  });
  </code></pre>