Re: [PHP4BETA] session_register / form

On 20 Mar 2000 10:29:24 -0500 Chris Shenton <cshenton@uucom.com> wrote: >On Sun, 19 Mar 2000 15:29:54 +0200, Ben-Nes Michael <miki@canaan.co.il> said: > >Ben-Nes> when session var is registered and value is passed by a form, >Ben-Nes> the form var is not overriding the registered var. > >You actually want it this way. You can, for example, authenticate a >user and set a $userid as a session variable, and then it cannot be >overridden by rogue form or URL variables. > > >Ben-Nes> Will it change in the near future ? any way to go around >Ben-Nes> this problem ? > >If you really want to set a session var to something based on a form >(or URL variable) then set the name of the form/URL var to something >different, then assign it to the session var, e.g., Actually, I use this very code in a situation.. <? session_register("players"); echo $players; ?> <A HREF="<?=$PHP_SELF;?>?players=one">One</A> yes, when you click on that link, it sets the session variable players from the GET parameters, this is scary, dangerious, and alot of people probably dont realize that can happen, if anyone wants a copy of the EXACT code I used, just ask :> Derek Young President GS Data Design bleach@gsdata.com Get Your FREE E-mail Account at http://mail.chek.com