Sessions & Functions

Rendair · 01-13-2008, 07:04 PM

Hey all i have a question.

I aint all that strong on using sessions.

I am trying to set a session using a function on a login page. When the user clicks login it it will trigger a PHP function and that function will set the session.

PHP Code:


			
function loginUser($username,$password){
    
    $username = mysql_real_escape_string($username);
    $password = mysql_real_escape_string($password);
    
        $query = "SELECT * FROM example WHERE username='".$username."' AND password=PASSWORD('$password')";
        $query = mysql_query($query);
        $number = mysql_num_rows($query);
        
        if($number < 1){
            echo "Incorrect Login Information";
        }
        else{
            
            $_SESSION["logged"] = $username;
            
            echo "You are now logged in <a href=index.php> Click Here </a>";
            
        }
    
}

I have placed the session_start() on the login page, the function itself is in a function file am i missing something?

Alan @ CIT · 01-13-2008, 07:58 PM

Looks fine to me. session_start() is all you need to get a session going. Then just put your variables in the $_SESSION superglobal as you have done.

Alan.

ReSpawN · 01-13-2008, 09:38 PM

Thats the first thing you should have on your page. Next to the error reporting and some ini_set functions. I cannot press enough that you should be careful to not push any valuable and harmful information into the sessions since 'it can be used against you'. There's a cliché for ya.

If you have any other questions, you can always ask here and on MSN. Of course, Alan has no absence here so he'll be the first to reply!

Good luck Dale!

Alan @ CIT · 01-13-2008, 09:43 PM

Quote:

Originally Posted by ReSpawN

Of course, Alan has no absence here

That's worryingly true :(

Btw, TalkPHP - Understanding the Life of a Session is a good read for anyone who uses sessions

Alan

ReSpawN · 01-13-2008, 10:27 PM

Haven't read that one. I guess *clicks it to be sure* you made it? *yep, you did*.

Nice article *booked*.

Alan @ CIT · 01-13-2008, 10:37 PM

It's one of Wildhoney's articles :)

Haris · 01-14-2008, 02:27 AM

PHP Code:


			
function loginUser($username,$password) {
    $username = mysql_real_escape_string($username);
    $password = mysql_real_escape_string($password);
    
        $query = "SELECT * FROM example WHERE username='".$username."' AND password=PASSWORD('$password')";
        $query = mysql_query($query);
        $number = mysql_num_rows($query);
        
        if($number < 1) {
            echo "Incorrect Login Information";
        }
        else {
            session_regenerate_id();
            $_SESSION["logged"] = $username;
            
            echo "You are now logged in <a href=index.php> Click Here </a>";
        }
}

PHP: session_regenerate_id - Manual

It will regenerate the session ID every time the user logins thus, preventing session hijacking.

Rendair · 01-14-2008, 07:36 AM

Thank you all

EyeDentify · 01-14-2008, 10:57 AM

@Haris

I wouldn´t go as far to say "preventing" hijacking but it will make it more difficult to hijack. :D

Thats my opinion anyway.

/EyeDentify