login.php checks for validity of $HTTP_POST_VARS['user'] && $HTTP_POST_VARS['pass'] and if the combination is OK sets variable $LoginSuccess which is then registered using:

session_register(LoginSuccess);

Conntrol is then transferred to next.php using the following code:

header("Location: http://$db_host/next.php"); 

The value of $db_host at this stage is "localhost".

When next.php starts executing it checks whether LoginSuccess is set like this:

session_start();
if(empty($LoginSuccess)) 
  ...... # Force new login

The problem is that the very first time the sequence above is executed, LoginSuccess evaluates to empty even though is has been set.

After a second login attemt, it usually evaluates to Set.

The problem may or may not be identical to Bug ID# 6121.

I found that the code works correctly if I use relative URL instead:

header("Location: http:next.php"); 

But really, that should'nt make a difference, should it?

I am using default configuration for session mgmt., everything is executed locally on my PC.