note 16663 rejected from function.session-register by jimw
| From: | jimw@php.net | Date: | Sat, 10 Nov 2001 23:27:45 +0000 |
| Subject: | note 16663 rejected from function.session-register by jimw | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-20686@lists.php.net to get a copy of this message | ||
Hi all,
I try to design a class SessionManager responsible for the managment of my user session. I have a
login function which enable a user to login after sending his username and his password. I tried
this code :
function login($username,$password) {
$requete = "SELECT password FROM administrateur WHERE user='$username'";
$exec = mysql_query($requete);
if ($result = mysql_fetch_object($exec)) {
if ($result->password == $password) {
session_register("username");
} else {
$this->destroy();
header("location: ../../listeDomaine.php");
}
} else {
$this->destroy();
header("location: ../../listeDomaine.php");
}
}
But the username is not registered to the session because I think it is a local variable ant it is
not post by the browser. So my question is how can I register a variable in a function ?
My second probleme is that is I use this function :
function session_ok() {
if (!session_is_registered("username")) {
$this->destroy();
header("location: ../../listeDomaine.php");
}
}
in order to determine if the user is well logged to the session. I can bypass the protection by
putting directly something like getLogin.php?username=toto into the url.
Is there a way to protect my application using the session functions ?
Thanks a lot