TalkPHP
 
 
Account Login
Latest Articles
» The basic usage of PHPTAL, a XML/XHTML template library for PHP
» Vulnerable methods and the areas they are commonly trusted in.
» Simple way to protect a form from bot
» The Basics On: How Session Stealing Works
» How to keep your forms from double posting data
IRC Channel
IRC Speech Bubble Join the friendly bunch on IRC...
(#TalkPHP on Freenode)

...Also available via a web interface.

See this thread for information on the TalkPHP Free Hugs Initiative™. Subject to availability.
Associates
Associates
CSS Tutorials
Reply
 
LinkBack Thread Tools Search this Thread Display Modes
Old 02-29-2008, 11:35 PM   #1 (permalink)
The Contributor
Newcomer 
 
Join Date: Jan 2008
Posts: 27
Thanks: 1
lesP is on a distinguished road
Default Form destroys my session

Hi. When I use the form, I am getting redirected to login.php:

<?
session_start();
include("connect.php");
$id = $_GET[id];


if(!isset($_SESSION['id'])){
header("location:login.php");
}else{
$query = "SELECT * FROM users WHERE id = '".$_SESSION['id']."'";

$result = mysql_query($query)or die("MySQL fejl: " . mysql_error());
$log = mysql_fetch_array($result);
$user = $log["user"];
echo"$user";
$query2 = "SELECT * FROM messages WHERE modtager = '$user' && laest = 'n'";
$result2 = mysql_query($query2)or die("MySQL fejl: " . mysql_error());
$log2 = mysql_fetch_array($result2);
if(isset($_POST[text])){

$query3 = "SELECT * FROM topics WHERE id_parent = '$id'";
$result3 = mysql_query($query3)or die("MySQL fejl: " . mysql_error());
$log3 = mysql_fetch_array($result3);

$sql = "INSERT INTO topics (titel,text,date,author,id_parent)
VALUES ('%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s')";
$sql = sprintf($sql,
mysql_real_escape_string($log3['titel']),
mysql_real_escape_string($_POST['text']),
mysql_real_escape_string(now()),
mysql_real_escape_string($user),
mysql_real_escape_string($log3['id_parent'])
);

$res = mysql_query($sql) or die(mysql_error());

}


$foresp = mysql_query("SELECT * FROM topics where id_parent = '$id'") or die(mysql_error());

while ($row = mysql_fetch_array($foresp)) {
echo"<br><br>Titel: $row[titel]<br>Text: $row[text]<br>";

echo"<form method='post' action='$PHP_SELF'>
<textarea name='text'>Skriv en meddelelse</textarea>
<input type='submit'></form>";
}
}
?>
lesP is offline  
Reply With Quote
Old 02-29-2008, 11:46 PM   #2 (permalink)
Alan @ CIT
Member of the Month
The Frequenter
Member of the Month Top Contributor 
 
Alan @ CIT's Avatar
 
Join Date: Apr 2005
Location: South UK
Posts: 483
Thanks: 51
Alan @ CIT is on a distinguished road
Default

I've re-formatted your code to make it easier for others to read using the [php][/php] tags

PHP Code:
<?php
session_start
();
include(
"connect.php");
$id $_GET[id];

if(!isset(
$_SESSION['id']))
{
    
header("location:login.php"); 
}
else
{
    
$query "SELECT * FROM users WHERE id = '".$_SESSION['id']."'";

    
$result mysql_query($query)or die("MySQL fejl: " mysql_error());
    
$log mysql_fetch_array($result);
    
$user $log["user"];
    echo
"$user";
    
$query2 "SELECT * FROM messages WHERE modtager = '$user' && laest = 'n'";
    
$result2 mysql_query($query2)or die("MySQL fejl: " mysql_error());
    
$log2 mysql_fetch_array($result2);
    if(isset(
$_POST[text]))
    {
        
$query3 "SELECT * FROM topics WHERE id_parent = '$id'";
        
$result3 mysql_query($query3)or die("MySQL fejl: " mysql_error());
        
$log3 mysql_fetch_array($result3);

        
$sql "INSERT INTO topics (titel,text,date,author,id_parent)
                VALUES ('%s', '%s', '%s', '%s', '%s', '%s', '%s', '%s')"
;
        
$sql sprintf($sql,
            
mysql_real_escape_string($log3['titel']),
            
mysql_real_escape_string($_POST['text']),
            
mysql_real_escape_string(now()),
            
mysql_real_escape_string($user),
            
mysql_real_escape_string($log3['id_parent'])
        );

        
$res mysql_query($sql) or die(mysql_error());

    }


    
$foresp mysql_query("SELECT * FROM topics where id_parent = '$id'") or die(mysql_error());

    while (
$row mysql_fetch_array($foresp))
    {
        echo
"<br><br>Titel: $row[titel]<br>Text: $row[text]<br>";

        echo
"<form method='post' action='$PHP_SELF'>
        <textarea name='text'>Skriv en meddelelse</textarea>
        <input type='submit'></form>"
;
    }

}
If you are being re-directed to login.php then I can only assume that login.php isn't setting $_SESSION['id'] correctly (or whatever script sets it).

Can you post that script as the rest of this script isn't being run by PHP if it is hitting the header(redirect) bit.

Alan
Send a message via MSN to Alan @ CIT
Alan @ CIT is offline  
Reply With Quote
Old 02-29-2008, 11:51 PM   #3 (permalink)
The Contributor
Newcomer 
 
Join Date: Jan 2008
Posts: 27
Thanks: 1
lesP is on a distinguished road
Default

Quote:
Can you post that script as the rest of this script isn't being run by PHP if it is hitting the header(redirect) bit.
What do you mean?

Im sure $_SESSION['id'] is set. echo"$user" shows the username.
lesP is offline  
Reply With Quote
Old 03-01-2008, 12:06 AM   #4 (permalink)
Alan @ CIT
Member of the Month
The Frequenter
Member of the Month Top Contributor 
 
Alan @ CIT's Avatar
 
Join Date: Apr 2005
Location: South UK
Posts: 483
Thanks: 51
Alan @ CIT is on a distinguished road
Default

What happens if you echo $_SESSION['id'] though? Your if() check looks to see if $_SESSION['id'] is set. If it isn't, it redirects you to login.php. Since you are getting redirected there is a good chance that $_SESSION['id'] isn't set

Alan
Send a message via MSN to Alan @ CIT
Alan @ CIT is offline  
Reply With Quote
Old 03-01-2008, 11:51 AM   #5 (permalink)
The Contributor
Newcomer 
 
Join Date: Jan 2008
Posts: 27
Thanks: 1
lesP is on a distinguished road
Default

Quote:
Originally Posted by Alan @ CIT View Post
What happens if you echo $_SESSION['id'] though? Your if() check looks to see if $_SESSION['id'] is set. If it isn't, it redirects you to login.php. Since you are getting redirected there is a good chance that $_SESSION['id'] isn't set

Alan
Okay. But I can run the script when I am "logged in", but as soon as I run the form when I am logged in, i am getting redirected.
lesP is offline  
Reply With Quote
Old 03-01-2008, 04:47 PM   #6 (permalink)
The Acquainted
 
Join Date: Nov 2007
Posts: 154
Thanks: 31
SOCK is on a distinguished road
Default

lesP> If you really want some help solving this, post your login script code, at least the bit that pertains to setting any session data.

A good method to troubleshoot has already been suggested by Alan@CIT. At the top of each script you're accessing the session, do this
PHP Code:
<?php
session_start
();
print_r($_SESSION);
...
This will leave no doubt as to what session data is set. You may want to just create a separate test script to do nothing but check session data, as I've done many times.

The best advice I can give you, start in small increments while developing an application. Don't just throw a bunch of code together and hope the session or POST data gets through. Create your interface, then build the code to process it. Start with a script that does nothing but receive the data and let you view what's coming through. Once you're confident that the data is there, the next step is to validate, filter, check, escape etc ad nauseum. After all this is done, create the SQL and eventually finish with fine tuning the script logic.

HTH
__________________
I reject your reality, and substitute my own.
SOCK is offline  
Reply With Quote
Old 03-01-2008, 06:03 PM   #7 (permalink)
The Contributor
Newcomer 
 
Join Date: Jan 2008
Posts: 27
Thanks: 1
lesP is on a distinguished road
Default

I changed $id to $refid and then it solved it. But now it does not pick out the topics I need. It only shows the topics where id_parent = 1 no matter if id=1 or id=2 in the browserline.
lesP is offline  
Reply With Quote
Reply



Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)
 
Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

vB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT. The time now is 08:55 AM.

 
     

Powered by vBulletin® Version 3.6.8
Copyright ©2000 - 2013, Jelsoft Enterprises Ltd.
Search Engine Optimization by vBSEO 3.1.0
Inactive Reminders By Icora Web Design