note 13297 deleted from function.session-register by jimw
| From: | jimw@php.net | Date: | Tue, 18 Dec 2001 22:27:08 +0000 |
| Subject: | note 13297 deleted from function.session-register by jimw | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-23266@lists.php.net to get a copy of this message | ||
I had the same question about that, but on phpbuilder.com someone posted some code, and I expanded
on it, thought i'd share it here.
I had a login script that stored the currently logged in user as $user. but as you said, it could
be easily overwritten with a modified form using POST or even a ?user=james kinda thing. so I made
a variable puser and set it as a session variable. when the user logs in, it does
$puser = $user;
session_register("puser");
At the beginning of my scripts, i do this:
$puser = $HTTP_SESSION_VARS[puser];
that will override any POST or GET query to ?puser=james.