Re: [PHP4BETA] session_register / form

Addressed to: Chris Shenton <cshenton@uucom.com> 4php <php4beta@lists.php.net> ** Reply to note from Chris Shenton <cshenton@uucom.com> 20 Mar 2000 10:29:24 -0500 > > On Sun, 19 Mar 2000 15:29:54 +0200, Ben-Nes Michael > <miki@canaan.co.il> said: > > Ben-Nes> when session var is registered and value is passed by a form, > Ben-Nes> the form var is not overriding the registered var. > > You actually want it this way. You can, for example, authenticate a > user and set a $userid as a session variable, and then it cannot be > overridden by rogue form or URL variables. > > > Ben-Nes> Will it change in the near future ? any way to go around > Ben-Nes> this problem ? > > If you really want to set a session var to something based on a form > (or URL variable) then set the name of the form/URL var to something > different, then assign it to the session var, e.g., > > $sess_var = $form_var; > Or name them the same and: $sess_var = $HTTP_POST_VARS[ 'sess_var' ]; or $sess_var = $HTTP_GET_VARS[ 'sess_var' ];