title: Logged In user switching to another user in PHP session
body: <p>My problem is that when I login as user 1, I can see users 1 info for about 1-2 pages but when I go to another page or refresh the page I'm logged in as another user (user 2). But if I log in as user 2 everything is okay. How can I fix this problem?</p>
  <p>Here is my login script.</p>
  <pre><code>&lt;?php
  // This is the login page for the site.
  require_once ('../includes/config.inc.php'); 
  // Set the page title and include the HTML header.
  $page_title = 'Page Title';
  include ('../includes/header.php');
  
  $mysqli = mysqli_connect(&quot;localhost&quot;, &quot;some&quot;, &quot;some&quot;, &quot;some&quot;);
  
  if(isset($_SESSION['user_id'])) {
  
      $url = BASE_URL . 'index.php'; // Define the URL.
      header(&quot;Location: $url&quot;);
      exit(); // Quit the script. 
  }
  
  //HTML Purifier  
  require '../htmlpurifier/library/HTMLPurifier.auto.php';
  //End HTML Purifier
  
  if (isset($_POST['submitted'])) { // start of submit conditional.
      require_once (MYSQL);
      
      // Validate the username or email address:
      if (!empty($_POST['login']) &amp;&amp; strlen($_POST['login']) &lt;= 255) {
          $e = mysqli_real_escape_string($dbc, $purifier-&gt;purify(strip_tags($_POST['login'])));
      } else if(!empty($_POST['login']) &amp;&amp; strlen($_POST['login']) &gt;= 256) {
          $e = FALSE;
          echo 'Error';
      } else {    
          $e = FALSE;
          echo 'Error';
      }
      
      // Validate the password:
      if (!empty($_POST['pass']) &amp;&amp; strlen($_POST['pass']) &lt;= 255) {
          $p = mysqli_real_escape_string($dbc, $_POST['pass']);
      } else if(!empty($_POST['pass']) &amp;&amp; strlen($_POST['pass']) &gt;= 256) {
          $p = FALSE;
          echo 'Error';
      } else {
          $p = FALSE;
          echo 'Error';
      }
      
      if(($e != FALSE) &amp;&amp; ($p != FALSE)) { // check pass
          $pass_salt = &quot;SELECT users.password, users.salt FROM users JOIN contact_info ON contact_info.user_id = users.user_id WHERE (contact_info.email = '&quot; . $e . &quot;' OR users.username = '&quot; . $e . &quot;') AND users.active IS NULL&quot;;
          $ph = mysqli_query($dbc, $pass_salt) or trigger_error(&quot;Query: $pass_salt\n&lt;br /&gt;MySQL Error: &quot; . mysqli_error($dbc));
  
          while($row = mysqli_fetch_array($ph)){ 
              $password = $row['password'];
              $salt = $row['salt'];
          }
  
          if(!empty($salt)) {
              $sha512 = hash('sha512', $p . $salt);
          }
  
          if(!empty($password) == !empty($sha512)){
              $user_pass = TRUE;
          } else {
              $user_pass = FALSE;
          }
      }
      
      if(isset($user_pass) &amp;&amp; ($user_pass == TRUE) &amp;&amp; !empty($salt)) { // If everything's OK.
          $q = &quot;SELECT users.user_id, users.first_name, users.user_level FROM users JOIN contact_info ON contact_info.user_id = users.user_id WHERE (contact_info.email = '&quot; . $e . &quot;' OR users.username = '&quot; . $e . &quot;') AND users.password = '&quot; . $sha512 . &quot;' AND users.active IS NULL&quot;;        
          $r = mysqli_query ($dbc, $q) or trigger_error(&quot;Query: $q\n&lt;br /&gt;MySQL Error: &quot; . mysqli_error($dbc));
      
          if (@mysqli_num_rows($r) == 1) {
  
              // Register the values &amp; redirect:
              $_SESSION = mysqli_fetch_array ($r, MYSQLI_ASSOC); 
              // check if user is logged in then update the old login date
              $u = &quot;UPDATE users JOIN contact_info ON contact_info.user_id = users.user_id SET users.last_login = NOW(), users.deletion = 0, users.deletion_date = NULL WHERE (contact_info.email = '&quot; . $e . &quot;' OR users.username = '&quot; . $e . &quot;') AND users.password = '&quot; . $sha512 . &quot;' AND users.active IS NULL&quot;; 
              // save the info to the database
              $r = mysqli_query ($dbc, $u);
              mysqli_free_result($r);
              mysqli_close($dbc);
                              
              $url = BASE_URL . 'home/'; // Define the URL:
              header(&quot;Location: $url&quot;);
              exit(); // Quit the script.
                  
          } else { // No match was made.
              echo 'Error';
          }
          
      } else { // If everything wasn't OK.
          echo 'Error';
      }
      mysqli_close($dbc);
  }
  ?&gt;
  </code></pre>
  <p>Here is my logout script.</p>
  <pre><code>&lt;?php
  ob_start(); // Start output buffering. // This is the logout page for the site.
  session_start(); // Initialize a session.
  
  require_once ('../includes/config.inc.php'); 
  $page_title = 'Title';
  
  // If no user_id session variable exists, redirect the user:
  if (!isset($_SESSION['user_id'])) {
  
      $url = BASE_URL . 'index.php'; // Define the URL.
      ob_end_clean(); // Delete the buffer.
      header(&quot;Location: $url&quot;);
      exit(); // Quit the script.
      
  } else { // Log out the user.
  
      $_SESSION = array(); // Destroy the variables.
      session_destroy(); // Destroy the session itself.
      setcookie(session_name(), '', time() - 2592000, '/'); // Destroy the cookie.
  
  }
  
  $url = BASE_URL;
  ob_end_clean();
  header(&quot;Refresh: 3; $url&quot;);
  include ('../includes/header.php');
  
  $mysqli = mysqli_connect(&quot;localhost&quot;, &quot;some&quot;, &quot;some&quot;, &quot;some&quot;);
  
  include ('../includes/footer.php');
  exit(); // Quit the script.
  ?&gt;  
  </code></pre>
  <p>And here is what I have in header.</p>
  <pre><code>ob_start();// Start output buffering.
  session_start();// Initialize a session.
  </code></pre>
  <p>Here is the very top part of the home page.</p>
  <pre><code>// Set the page title and include the HTML header.
  $page_title = 'Title';
  include ('../includes/header.php');
  
  // Include the configuration file for error management and such.
  require_once ('../includes/config.inc.php'); 
  require_once ('../mysqli_connect.php'); // Connect to the db.
  
  $mysqli = mysqli_connect(&quot;localhost&quot;, &quot;some&quot;, &quot;some&quot;, &quot;some&quot;);
  
  // If no user_id session variable exists, redirect the user:
  if (!isset($_SESSION['user_id'])) {
  
      $url = BASE_URL . 'index.php'; // Define the URL.
      ob_end_clean(); // Delete the buffer.
      header(&quot;Location: $url&quot;);
      exit(); // Quit the script. 
  }
  </code></pre>