PHP - Session Virus Or Worm?

hi everyone.

i'm wondering what the best way is to create a session variable and pass it to an iframe.
i need to do something along these lines, but it doesn't seem to pass the ID. Any hints on how i should accomplish this?

Code: [Select]
session_start();
  $_SESSION['ID']=$_GET['ID']; // id from previous page
$ID=session_id();

 <iframe src="iframepage.php?ID=<?php echo $ID; ?>" style="width:680px; height:200px;" noresize="noresize" frameborder="0" border="0" scrolling="Yes" allowtransparency="true" /> </iframe>

I'm making a simple login system with MySQL and PHP (very simple, I'm just starting with PHP). The MySQL portion is done, but I need to ensure only people who are logged in can see certain content.

To check if people are logged in, my website checks that they have the $_SESSION['user'] variable set. If it is set, then it lets them continue through the website, if not, it tells them to login. Is that enough security, or can people simply inject a session cookie into their browser to spoof that they are logged in?

My idea was to generate a session key cookie when they login (just a random string of letters and numbers) and store that in the database, then on every page, check to make sure their session key is the same thing that's in the database. Is this necessary? It seems expensive.

Just curious how other people feel about this.  I am working on an application where a lot of info is pulled from MySQL and needed on multiple pages.     Would it make more sense to...   1.  Pull all data ONCE and store it in SESSION variables to use on other pages    2.  Pull the data from the database on each new page that needs it   I assume the preferred method is #1, but maybe there is some downside to using SESSION variables "too much"?   Side question that's kind of related:  As far as URLs, is it preferable to have data stored in them (i.e. domain.com/somepage.php?somedata=something&otherdata=thisdata) or use SESSION variables to store that data so the URLs can stay general/clean (i.e. domain.com/somepage.php)?   Both are probably loaded questions but any possible insight would be appreciated.   Thanks! Greg
Edited by galvin, 04 November 2014 - 10:30 AM.

Evening!

I've been iffing and ahhing over this and well im not too sure, hence the post.

Code: [Select]
// Redirects if there is no session id selected and echos the error on the previous page
if(!isset($_GET['get']) || ($_GET['getget'])){
header("Location: #.php?error");
}
So it should simply check if get is set if it isnt then see if getget is set?

If not redirect and show the error.

Now ive tried it and even when get/getget is set it still redirects, probably something silly. Care to share anyone?

Harry.

what is the problem here?


$sql="INSERT INTO comment (linkid, text, anvid)
VALUES
('$_POST[link]','$_POST[comment]','$_SESSION['user'];')";

Why is my SESSION not getting set in the code below?!

Code: [Select]
<?php
// Initialize a session.
session_start();

// Initialize Logged-In Status.
$_SESSION['loggedIn'] = FALSE;

// Display Logged-In Status.
echo '<p>$_SESSION[\'loggedIn\'] = ' . $_SESSION['loggedIn'] . '</p>';

exit();

When I run this I get...

$_SESSION['loggedIn'] =


Debbie

Hi
I am looking for help with a working script to input multiple lines of data , but i am looking for each line of data to have the $_SESSION[userid] entered into each line, ie into the table $_SESSION[userid], name, surname, age

Many Thanks


<?

include "include/session.php";

include "include/z_db.php";

// check the login details of the user and stop execution if not logged in
require "check.php";

// If member  has logged in then below script will be execuated. 
// let us collect all data of the member 
$row=mysql_fetch_object(mysql_query("select * from plus_signup where userid='$_SESSION[userid]'"));



if(isset($_POST['submit']))
{    foreach($_POST['person'] as $person)  
 
{        
        $name= mysql_real_escape_string($person['name']);    
         $surname= mysql_real_escape_string($person['surname']);       
     $age= mysql_real_escape_string($person['age']);                
      $values[] = "('$name', '$surname', '$age')";    }       
      $query = "INSERT INTO plus_signup (name,surname,age) VALUES "    . implode(', ', $values); 
  $result = mysql_query($query) or die("Error!<br />Query: $query<br />Error: " . mysql_error()); 
  
  
  }
  


?>    


<form method="POST" action='multi.php' name="">
<table>
<tr>

<td>Name<input type="text" name="person[0][name]"></td>
<td>surname<input type="text" name="person[0][surname]"></td>
<td>age<input type="text" name="person[0][age]"></td>
</tr>
<tr>
<td>name<input type="text" name="person[1][name]"></td>
<td>surname<input type="text" name="person[1][surname]"></td>
<td>age<input type="text" name="person[1][age]"></td>
</tr>
<tr>
<td>name<input type="text" name="person[2][name]"></td>
<td>surname<input type="text" name="person[2][surname]"></td>
<td>age<input type="text" name="person[2][age]"></td>
</tr>
</table>

<td><p>
  <input type="submit" name="submit" value="add">
</p>
  
  <p>&nbsp;</p>| &nbsp; <a href=update-profile.php>back</a>|
</form>



<?

require "bottom.php";


?>
<center><br>| &nbsp; <a href=update-profile.php>back</a>|<br></center> 

</body>

</html>

I am producing a php script which will include some AJAX in the resultant web page, which will send some data to another php script for processing.

If I create a php session in my original script, will the same session be accessed by the second script being run by the AJAX or will it create a new session?

If i use session in my php code then for how much time the session will be valid...

And how can i change the length of the session...

Hi People, I am on a deadline and finding that my code does not work in php5 and I have to change it to work. Just wonder if anyone can spot the obvious within my code. This all worked in php4 but now I have to rewrite it. Basically its a little order system.



<?
include("inc/connect.php");

// Continue start session.
// We need to first check to see if an item with the SID and cat and product_code exists in the database, 
// if it does then we need to update that item, if not then we need to add the item

// clean out any malicious data
 foreach ($_REQUEST as $k => $v) {
 $_REQUEST[$k] = (get_magic_quotes_gpc() ? strip_tags($v) : strip_tags(addslashes($v)));
 }

session_start();
{

$sql = "SELECT * FROM orders WHERE sid = '$PHPSESSID' AND product_id = '$product_id' "; 
$sql_result = mysql_query($sql); 

if (mysql_num_rows($sql_result) ==0)
{
        # setup SQL statement
        $SQL = " INSERT INTO orders (sid,product_id,product_title,qty,standard_price,deluxe_price) VALUES ('$PHPSESSID','$product_id','$product_title','$qty','$standard_price','$deluxe_price')";

        #execute SQL statement
        $result = mysql_db_query( azflowers,"$SQL",$connection );

        # check for error
        if (!$result) { echo("ERROR: " . mysql_error() . "\n$SQL\n");    }
}
else
{
      # setup SQL statement
        $SQL = " UPDATE orders SET qty = qty +1 WHERE sid = '$PHPSESSID' AND product_id = '$product_id' ";

        #execute SQL statement
        $result = mysql_db_query( azflowers,"$SQL",$connection );

        # check for error
        if (!$result) { echo("ERROR: " . mysql_error() . "\n$SQL\n");    }
}

header("Location: http://www.site.com/site/cart.php?sid=$PHPSESSID");
exit;
}
?>

I am trying to get sessions to work right
Here are my settings:
session.gc_maxlifetime = 60
session.gc_probability = 1
session.gc_divisor = 1
session.cookie_lifetime = 0  (when browser closes)

So say I have two php files:
php1.php

session_start();
$_SESSION['var1'] = 'var1';


php2.php

session_start();
echo $_SESSION['var1']. '<br>';


So if I go to php1 it will set the variable and then I can go to php2 and it will echo the variable.  This works.  But if I don't do anything and then go back to php2 after 60 seconds the variable should no longer exist.  This part is not working.  What do I need to change to get it to work?

Code: [Select]
<?php

session_start();
if(!session_is_registered(myusername)){
header("location:./default.php");
}

?>

My session works fine but I am just wondering how I can echo the current sessions username?

Thanks

Pls tell me what is wrong?

<?PHP
include("dba.php");

function hvataj ($trazi, $id)
{
$upit = mysql_query ('select * from administrator where member_id = '.$id.'');

return ( $row = mysql_fetch_assoc ($upit)  ) ? $row[$trazi] : mysql_error ();
}
?> 

I have parse error here on this line when I want to echo it:

<?PHP echo "<img src='images/korisnik_slike/".hvataj('slika',$_SESSION['member_id']."' />"; ?>

How to add more data into $_SESSION? I have following code:
Code: [Select]
if(isset($_GET['poredi']) && $_GET['poredi'] == "upo"){
$idp = intval($_POST['idp']);
$sql = "SELECT * FROM product
WHERE product_id={$idp}";
$query=mysql_query($sql);
if(mysql_num_rows($query)!=0){
$row=mysql_fetch_array($query);
$_SESSION['poredi'] = $row['product_id'];

}
}

On click it need to store more product_id, and after that i have to be able to do query with data (find all data with product_id)?

I'm trying to make my own shopping cart for the first time and having a problem getting products to add to it. All I get is "No product in cart.".
Its nothing special now, I'm just trying to reach the first stepping stone of adding something successfully to the session.

index.html
Code: [Select]
<?php session_start(); ?>
<?php
$cart = $_SESSION['cart'];
if (!$cart) {
echo "No product in cart.";
}
if ($cart) {
foreach ($id) {
echo $id;
}
}
?>
<A href="index.html?action=add&id=1">Add to cart</A>
What have I done wrong and what am I suppose to do?