title: Session-based login not working as expected
body: <p>I have been developing a PHP and mysqli based social network as a side project. All has been going well up till this point. Everyone can register and I am using the crypt function to store passwords. </p>
  
  <p>I am using an <code>if</code> and <code>else</code> statement with the <code>password_verify</code> function where I set <code>$_SESSION</code> variables and cookies in order to login. Again this works and once logged in the system redirects me to my user profile as it should.</p>
  
  <p>However my site-top.php file does not work as it should; what should happen is that the dynamic login link buttons should change from the login and register buttons to the logout, profile and notification buttons.</p>
  
  <p>Also the add as friend button and block button are disabled on my profile (as it should as I don't want to block or friend myself) but they are also disabled when I visit another's profile which it should not.</p>
  
  <p>Here is the code for my site top for the time being. I have also got a check-login-status file should you wish me to post the code for that or any others:</p>
  
  <pre><code>&lt;?php
  // It is important for any file that includes this file, to have
  // check_login_status.php included at its very top.
  $envelope = '&lt;img src="assets/note_dead.png" width="33" height="33" alt="Notes" title="This envelope is for logged in members"&gt;';
  $loginLink = '&lt;li&gt;&lt;a class="tooltip-bottom" data-tooltip="Register an Account" href="signup.php"&gt;Register&lt;/a&gt;&lt;/li&gt;
                &lt;li&gt;&lt;a class="tooltip-bottom" data-tooltip="Login" href="login.php"&gt;Login&lt;/a&gt;&lt;/li&gt;';
  if($user_ok == true) {
      $sql = "SELECT notescheck FROM users WHERE username='$log_username' LIMIT 1";
      $query = mysqli_query($db_conx, $sql);
      $row = mysqli_fetch_row($query);
      $notescheck = $row[0];
      $sql = "SELECT id FROM notifications WHERE username='$log_username' AND date_time &gt; '$notescheck' LIMIT 1";
      $query = mysqli_query($db_conx, $sql);
      $numrows = mysqli_num_rows($query);
      if ($numrows == 0) {
          $envelope = '&lt;a href="#" title="Your Notifications &amp; Friend Requests"&gt;&lt;img src="assets/note_still.png" width="33" height="33" alt="Notes"&gt;&lt;/a&gt;';
      } else {
          $envelope = '&lt;a href="#" title="You have new Notifications"&gt;&lt;img src="assets/note_flash.gif" width="33" height="33" alt="Notes"&gt;&lt;/a&gt;';
      }
      $loginLink = '&lt;li&gt;&lt;a class="tooltip-bottom" data-tooltip="Logout" href="logout.php"&gt;Logout&lt;/a&gt;&lt;/li&gt;&lt;li&gt;&lt;a href="user.php?u='.$log_username.'"&gt;'.$log_username.'&lt;/a&gt;&lt;/li&gt;';
  }
  ?&gt;
  </code></pre>
  
  <p>OK this is my check-login-status.php script for all that wanted it...</p>
  
  <pre><code>&lt;?php
  session_start();
  include_once("db_conx.php");
  // Files that inculde this file at the very top would NOT require 
  // connection to database or session_start(), be careful.
  // Initialize some vars
  $user_ok = false;
  $log_id = "";
  $log_username = "";
  $log_password = "";
  // User Verify function
  function evalLoggedUser($conx,$id,$u,$p){
      $sql = "SELECT ip FROM users WHERE id='$id' AND username='$u' AND password='$p' AND activated='1' LIMIT 1";
      $query = mysqli_query($conx, $sql);
      $numrows = mysqli_num_rows($query);
      if($numrows &gt; 0){
          return true;
      }
  }
  if(isset($_SESSION["userid"]) &amp;&amp; isset($_SESSION["username"]) &amp;&amp; isset($_SESSION["password"])) {
      $log_id = preg_replace('#[^0-9]#', '', $_SESSION['userid']);
      $log_username = preg_replace('#[^a-z0-9]#i', '', $_SESSION['username']);
      $log_password = preg_replace('#[^a-z0-9]#i', '', $_SESSION['password']);
      // Verify the user
      $user_ok = evalLoggedUser($db_conx,$log_id,$log_username,$log_password);
      } else if(isset($_COOKIE["id"]) &amp;&amp; isset($_COOKIE["user"]) &amp;&amp; isset($_COOKIE["pass"])){
          $_SESSION['userid'] = preg_replace('#[^0-9]#', '', $_COOKIE['id']);
          $_SESSION['username'] = preg_replace('#[^a-z0-9]#i', '', $_COOKIE['user']);
          $_SESSION['password'] = preg_replace('#[^a-z0-9]#i', '', $_COOKIE['pass']);
          $log_id = $_SESSION['userid'];
          $log_username = $_SESSION['username'];
          $log_password = $_SESSION['password'];
          // Verify the user
          $user_ok = evalLoggedUser($db_conx,$log_id,$log_username,$log_password);
          if($user_ok == true){
          // Update their lastlogin datetime field
              $sql = "UPDATE users SET lastlogin=now() WHERE id='$log_id' LIMIT 1";
              $query = mysqli_query($db_conx, $sql);
          }
      }
  ?&gt;
  </code></pre>