php - session protection

I am creating a webpage bit by bit, testing parts of the webpage ideas. I want to learn how to session protect a page. I have already password protected a page seccsesfully, but anybody can access the page by typing in the url. i want to session protect my page so no one can do that. i have three pages: index.html, which has the form which sends the the password.php, the password.php, which makes sure that the password and username are correct using "if statments"(here is the "if statment")

    if ($username == 'mgmb99'){
    if ($password == 'mgmb91mas'){
    header('Location: youhere.php');
    } else {
    echo 'your username or password is wrong.<a href="http://www.passwordtest.comze.com"> go back to login page </a>';
    }} else {
    echo 'your username or password is wrong.<a href="http://www.passwordtest.comze.com"> go back to login page </a>';
    };

, and the youhere.php which is the page once you logged in.

988

Answer

Solution:

$_SESSION['connect']=0;

Sets the connect value in session to be 0.

Currently this check:

  if((!$_SESSION['connect']))

Will always return true because if$_SESSION['connect'] is unset then!$_SESSION['connect'] will be true. Likewiseif(!0) will be true.

Try setting$_SESSION['connect'] to true or 1 or the like or, alternatively, change the check to be:

if(!array_key_exists('connect',$_SESSION))

227

Answer

Solution:

( ! $_SESSION['connect'] ) will is true when the session variable isn't set but also when it is set to 0. So if you want to protect youhere.php, you need to assign another value and check for it.

Alsosession_destroy() will delete all session variables, so you login, you go to youhere.php but if you refresh the site, you will instantly be logged out

632

Answer

Solution:

There is a plethora of information on Sessions on the PHP website. http://www.php.net/manual/en/intro.session.php

Here's an example with storing and killing session variables. http://www.php.net/manual/en/session.examples.basic.php

To set a Session var:

<?php
session_start();
if (!isset($_SESSION['count'])) {
  $_SESSION['count'] = 0;
} else {
  $_SESSION['count']++;
}
?>

To kill the session var:

<?php
  session_start();
  unset($_SESSION['count']);
?>

People are also looking for solutions to the problem: php - Getting the image file into the file field while updating record

Source

Didn't find the answer?

Our community is visited by hundreds of web development professionals every day. Ask your question and get a quick answer for free.

Ask a Question