Learn VBA & Macros in 1 Week!

PHP - Session To Prevent Access

Full Excel VBA Course - Beginner to Expert

Session To Prevent Access	View Content

I was asked to make new thread for this, so how do I use a session or something to restrict access to a page.....like if accounttype=Admin, stay here, all others go away......do you need to see code, or can you just give me an example.......

Full Excel VBA Course - Beginner to Expert

How To Prevent Session Spoofing And Session Hijacking?

Similar Tutorials

View Content

I'm making a simple login system with MySQL and PHP (very simple, I'm just starting with PHP). The MySQL portion is done, but I need to ensure only people who are logged in can see certain content.

To check if people are logged in, my website checks that they have the $_SESSION['user'] variable set. If it is set, then it lets them continue through the website, if not, it tells them to login. Is that enough security, or can people simply inject a session cookie into their browser to spoof that they are logged in?

My idea was to generate a session key cookie when they login (just a random string of letters and numbers) and store that in the database, then on every page, check to make sure their session key is the same thing that's in the database. Is this necessary? It seems expensive.

Prevent Direct File Access

Similar Tutorials

View Content

A shipping vendor (like Stamps.Com) provides me a Printable Shipping Label to display on my website for Visitors to print.

When Visitors come to my page, my PHP code:
1.) connects to Shipping Vendor via an API,
2.) downloads and converts the base64 data to image
3.) names the image to Customer Order Number.png
4.) saves image in directory
5.) then displays image to Visitor.

$Shipping_Label_Data = $LabelVendor->data[0]->contents; // vendor's API
file_put_contents('Label-Directory/'.$Order_Number.'.png',base64_decode($Shipping_Label_Data));

echo '<img src="/Label-Directory/'.$Order_Number.'.png" />';

Later I realized the security flaw: any snooper can fish for other Visitor's labels in my Label directory.

What is the best way to prevent the display of other people's labels?

Thank you!!

Debug_backtrace In Php To Prevent Direct Access To Page/resource

Similar Tutorials

View Content

I am using the debug_backtrace() php function to prevent direct access to admin files. i simply place the code below at the top of a page eg config.php and direct access via the browser is prevented. Is it a safe practice or is there a better way of doing it?

<?php

debug_backtrace() || die ("Direct access to this resource is  forbidden");

?>

Thanks

How To Prevent Direct Access To The File Called Via Ajax?

Similar Tutorials

View Content

I use jQuery when adding messages. However, the file can be called directly. For example: includes/add_comment.php?id=2

So, I can make a form and call this file directly to add a message. ID is user id and form can be submited with HTML form wherever are located.

How to prevent direct access to the file when called through a Ajax?

How To Prevent Session Hijacking?

Similar Tutorials

View Content

I have my script protected against all types of sql injection, XSS injection, cookies and bots.
But now i want to know whats the best way of preventing session hijacking?
I know nothing can be 100% secured but i want to know how to prevent it
And u know it:
prevention is better than cure!

Prevent Session Fixation

Similar Tutorials

View Content

Hello everyone,

I am trying to use only cookies so that session fixation is not possible. Unfortunately I can still log in when I disable cookies in Internet Explorer.

Am I doing something wrong? Or do I misunderstand the concept?

This is my code:

Code: [Select]
<?php

class Session{

private $username;

public function createSession($username){
$this->username = $username;

ini_set("session.use_only_cookies", 1);

session_start();
$_SESSION['username'] = $this->username;
return $this->username;
}

}

?>

Store & Access Data In A Session?

Similar Tutorials

View Content

Hello

I have included a simple login system into my website. When a user logs in, a session is started and he stays connected throughout the whole website until logging out again. The user logs in via his e-mailaddress and a password, which are stored in a mysql database.

Now I want to add a page on which a user that is logged in, can see and edit his own information (password, cellphone number, e-mail, etc.). Or easier: instead of showing "Welcome!" showing "Welcome, John!".

I thought about storing the e-mailaddress into the session, and then trying to access it to select the correct record (to edit afterwards). But so far, I haven't booked any success. I have to say that this is the first time I'm working with sessions as well, so this is very new to me.

Thank you in advance for any help!

Migrated From Mysql 4 To 5 (now Session Access Doesn't Work)

Similar Tutorials

View Content

I have a site with a members area that uses sessions. I migrated my DB from MySQL 4 to 5. Now my login page does not work. Please help.

Member Login Page:
Code: [Select]
<?php
session_name ('name');
ini_set ('session.use_cookies', 0);
session_start();
?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title></title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<link href="css/style.css" rel="stylesheet" type="text/css" />
<script type="text/javascript" src="js/swfobject/swfobject.js"></script>
<script type="text/javascript">
var flashvars = {};
flashvars.xml = "config.xml";
flashvars.font = "font.swf";
var attributes = {};
attributes.wmode = "transparent";
attributes.id = "slider";
swfobject.embedSWF("cu3er.swf", "cu3er-container", "960", "400", "9", "expressInstall.swf", flashvars, attributes);
</script>
<link href="css/menu.css" rel="stylesheet" type="text/css" />
<style type="text/css">
#apDiv1 {
position:absolute;
left:592px;
top:75px;
width:552px;
height:53px;
z-index:1;
}
a:visited {
color: #5D4580;
}
a:hover {
color: #FFF;
}
a:active {
color: #5D4580;
}
</style>
</head>
<body>
<div class="main">
<div class="blok_header">
<div class="header">
<div class="rss"><strong>P</strong></div>
<div class="clr"></div>
<div class="logo"><a href="index.html"><img src="images/logo.jpg" width="211" height="88" border="0" alt="" class="one" /></a></div>
<div class="menu">
<ul id="css3menu">
<li class="topfirst"><a href="index.html" title="Home">Home</a></li>
<li><a href="#" title=""><span>Omega Psi Phi</span></a>
<ul>
<li><a href="founders.html" title="Fraternity Founders">Fraternity Founders</a></li>
<li><a href="omegahistory.html" title="Fraternity History">Fraternity History</a></li>
<li><a href="programs.html" title="Mandated Programs">Mandated Programs</a></li>
<li><a href="links.html" title="Links">Links</a></li>
</ul>
</li>
<li><a href="#" title="Phi Gamma Chapter"><span>Phi Gamma Chapter</span></a>
<ul>
<li><a href="history.html" title="Phi Gamma History">Phi Gamma History</a></li>
<li><a href="lineage.html" title="Phi Gamma Lineage">Phi Gamma Lineage</a></li>
<li><a href="dedication.html" title="Dedication">Dedication</a></li>
<li><a href="calendar.html" title="Calendar">Calendar</a></li>
<li><a href="photogallery.html" title="Photo Gallery">Photo Gallery</a></li>
<li><a href="members/login.php" title="Member Login">Member Login</a></li>
<li><a href="roster.html" title="Chapter Roster">Chapter Roster</a></li>
</ul>
</li>
<li><a href="members/login.php" title="Member Login">Member Login</a></li>
<li class="toplast"><a href="contact.html" title="Contact Info.">Contact Info.</a></li>
</ul>
</div>

</div>
<div class="clr"></div>
<div class="body">
<div class="body_bg">
<h2>Member's Only </h2>
<?php
if ($_SESSION['membername'] != null) {
// print "<META HTTP-EQUIV='Refresh' content='0;URL=updatemember.php'>";
echo "You are already logged in. Please wait to be redirected to the members page, or <a href=\"members.php\">click here</a> if you are not automatically redirected. User name for the session is ".$_SESSION['username'].", the member name is ".$_SESSION['membername'];
print "<META HTTP-EQUIV='Refresh' content='5;URL=members.php'>";
//header("Location: members.php");
//exit;

} else {
?>
<form name="admin" method="post" action="userlogon.php">
<table width="891" border="0" cellspacing="5" cellpadding="5">
<tr>
<td height="80" colspan="2" align="left"><p>Please enter you username and password. Don't remember your password, <u><strong><a href="password.php">click here</a></strong></u><strong><a href="password.php"></a></strong>.</td>
<td width="360" rowspan="5" align="center" valign="middle"><img src="images/login_image.jpg" width="239" height="314" /></td>
</tr>
<tr>
<td width="257" height="38" align="right"><p><strong>Username:</strong></td>
<td width="224" align="left"><input type="text" name="username"></td>
</tr>
<tr>
<td height="38" align="right"><p><strong>Password:</strong></td>
<td align="left"><input type="password" name="password"></td>
</tr>
<tr>
<td height="34"> </td>
<td align="left"><input type="submit" class="yellowbutton" name="submit" value="Sign In"></td>
</tr>
<tr>
<td colspan="2"><p>To register for a username and password with Phi Gamma, please <u><strong><a href="register.php">click here</a></strong></u><strong><a href="password.php"></a></strong>.</td>
</tr>
</table>
</form>

<?php
}
?>
<p> </p>
<div class="clr"></div>
</div>
<div class="clr"></div>
</div>
</div>
<div class="footer">
<div class="footer_resize">
<p class="center"> <a href="index.html">Home</a> | <a href="contact.html">Contact</a> </p>
<div class="clr"></div>
</div>
<div class="clr"></div>
</div>
</body>
</html>

After the credentials are entered the user is returned back to the login page and NOT the member's page.

This is the userlogon.php page:

Code: [Select]
<?php
$link = mysql_connect('localhost:/tmp/mysql5.sock', 'dbuser', 'dbpw');
if (!$link) {
   die('Could not connect: ' . mysql_error());
}

//mysql_close($link);

if (!mysql_select_db('db_name', $link)) {
   echo 'Could not select database';
   exit;
}

$username =  $HTTP_POST_VARS["username"];
$password =  $HTTP_POST_VARS["password"];
$member_id = '';
$role = '';
$firstname = '';

// Formulate Query
// This is the best way to perform a SQL query
// For more examples, see mysql_real_escape_string()

$query = sprintf("SELECT users.member_id, users.username, users.password, users.role, FROM users join members on users.member_id = members.member_id WHERE users.username ='%s' AND users.password='%s'",
   mysql_real_escape_string($username),
   mysql_real_escape_string($password));

// Perform Query
$result = mysql_query($query);

// Check result
// This shows the actual query sent to MySQL, and the error. Useful for debugging.
if (!$result) {
   $message  = 'Invalid query: ' . mysql_error() . "\n";
   $message .= 'Whole query: ' . $query;
   die($message);
}

// Use result
// Attempting to print $result won't allow access to information in the resource
// One of the mysql result functions must be used
// See also mysql_result(), mysql_fetch_array(), mysql_fetch_row(), etc.
while ($row = mysql_fetch_assoc($result)) {

   $member_id = $row['member_id'];
   $username = $row['username'];

    $role = $row['role'];

}

if ($member_id != ''){
session_start();

$_SESSION['membername'] = $username;
$_SESSION['username'] = $username;

$_SESSION['memberid'] = $member_id;
$_SESSION['role'] = $role;

print "<META HTTP-EQUIV='Refresh' content='0;URL=members.php'>";
} else {
print "<META HTTP-EQUIV='Refresh' content='0;URL=memberlogin.php'>";
}

// Free the resources associated with the result set
// This is done automatically at the end of the script
mysql_free_result($result);
?>
It worked fine before the migration??? Anyone know where the problem is?

Warning: Session_start() [function.session-start]: Cannot Send Session Cache

Similar Tutorials

View Content

I am having trouble resolving an error.

Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/s519970/public_html/header.php:27) in /home/s519970/public_html/admin/login.php on line 2

What I can gather is I can't use "header (Location: 'admin.php')" after i've used session_start(). I have tried to replace the header (Location: 'admin.php') with this:

echo "<script>document.location.href='admin.php'</script>";
      echo "<script>'Content-type: application/octet-stream'</script>";

I've been trying to read up on solutions but haven't been able to get it sorted. If anyone can offer some advice that would be greatly appreciated as im new to php.

Code: [Select]
<?php
  session_start();
  if(isset($_SESSION['user']))

                echo "<script>document.location.href='admin.php'</script>";
echo "<script>'Content-type: application/octet-stream'</script>";
?>

<div id="loginform">

<form action="dologin.php" method="post">
<table>
<tr>
<td><span>Username:</span></td>
<td><input type="text" name="username" /></td>
</tr>
<tr>
<td><span>Password:</span></td>
<td><input type="password" name="password" /></td>
</tr>
<tr>
<td colspan="2" align="right"><input type="submit" name="login" value="Login" /></td>
</tr>
</table>
</form>

</div>
I have tried using require_once('yourpage.php'); before my <head></head> tags in the header document where I've specified the html information but this doesn't seem to work. I've been advised to use ob_start("ob_gzhandler"); but I am not sure how to implement this.

Any advice is greatly appreciated!

Session_start() [function.session-start]: Cannot Send Session Cookie - Headers A

Similar Tutorials

View Content

I am trying to create an index page which contains registration and login field
the problem that i get is on successful login a warning is displayed
session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at C:\xampp\htdocs\Eventz.com\index.php:116) in C:\xampp\htdocs\Eventz.com\index.php on line 235

This is the login part of my index.php
this tag is inside an html table below the login form
I also have a registration form and its php code above the login form

Code: [Select]
<?php
if (isset($_REQUEST['pass']))
{
    $id=$_POST['id'];
    $pass=$_POST['pass'];

    $conn =mysql_connect("localhost","root","");
    if (!$conn)
    {
   die('Could not connect: ' . mysql_error());
    }
/*
checking connection....success!
*/
    $e=mysql_select_db('test', $conn);
    if(!$e)
    {
   die(''.mysql_error());
    }
    else
    {
   echo 'database selected successfully';
    }

    if (isset($_REQUEST['id'])  || (isset($_REQUEST['pass'])))
    {
        if($_REQUEST['id'] == "" || $_REQUEST['pass']=="")
        {
       echo "login fields cannot be empty";
        }
        else
        {
            $sql=mysql_query("Select email,password from login where email='$id' AND password='$pass'");
            $count=mysql_num_rows($sql);
            if($count==1)

    /* $count checks if username and password are in same row */
            {
                session_start();
                $_SESSION['id']=$id;
                echo "</br>Login Successful</br>";
            }
            else
            {
           echo "</br>invalid</br>";
           echo "please try to login again</br>";

            }

        }
    }
}
?>

Any help or suggestion would be appreciated

Warning: Session_start() [function.session-start]: Cannot Send Session Cache Lim

Similar Tutorials

View Content

in this page
http://maximaart.com/newscp/
i have this problem
Code: [Select]
Warning: session_start() [function.session-start]: Cannot send session cache limiter - headers already sent (output started at /home/maximasy/public_html/newscp/index.php:1) in /home/maximasy/public_html/newscp/index.php on line 2

my source code is

<?php
session_start();
include_once("config.php");
include_once("functions.php");
$errorMessage = '';
if (isset($_POST['txtUserId']) && isset($_POST['txtPassword'])) {
if ($_POST['txtUserId'] === "$user" && $_POST['txtPassword'] === "$pass") {
// the user id and password match,
$_SESSION['basic_is_logged_in'] = true;
require("main.php");
exit;?>

Create Session And Pass Session To Iframe

Similar Tutorials

View Content

hi everyone.

i'm wondering what the best way is to create a session variable and pass it to an iframe.
i need to do something along these lines, but it doesn't seem to pass the ID. Any hints on how i should accomplish this?

Code: [Select]
session_start();
$_SESSION['ID']=$_GET['ID']; // id from previous page
$ID=session_id();

<iframe src="iframepage.php?ID=<?php echo $ID; ?>" style="width:680px; height:200px;" noresize="noresize" frameborder="0" border="0" scrolling="Yes" allowtransparency="true" /> </iframe>

Mysql Query Vs. Session / Get Vs Session?

Similar Tutorials

View Content

Just curious how other people feel about this. I am working on an application where a lot of info is pulled from MySQL and needed on multiple pages. Would it make more sense to... 1. Pull all data ONCE and store it in SESSION variables to use on other pages 2. Pull the data from the database on each new page that needs it I assume the preferred method is #1, but maybe there is some downside to using SESSION variables "too much"? Side question that's kind of related: As far as URLs, is it preferable to have data stored in them (i.e. domain.com/somepage.php?somedata=something&otherdata=thisdata) or use SESSION variables to store that data so the URLs can stay general/clean (i.e. domain.com/somepage.php)? Both are probably loaded questions but any possible insight would be appreciated. Thanks! Greg
Edited by galvin, 04 November 2014 - 10:30 AM.

Checking If 1 Session Is Active If Not, The Other Session.

Similar Tutorials

View Content

Evening!

I've been iffing and ahhing over this and well im not too sure, hence the post.

Code: [Select]
// Redirects if there is no session id selected and echos the error on the previous page
if(!isset($_GET['get']) || ($_GET['getget'])){
header("Location: #.php?error");
}
So it should simply check if get is set if it isnt then see if getget is set?

If not redirect and show the error.

Now ive tried it and even when get/getget is set it still redirects, probably something silly. Care to share anyone?

Harry.

How To Prevent

Similar Tutorials

View Content

Hello Guys,

Iam making a new ad serving script. In that site every publisher can register & they will get a url to serve ads. When a user click on that url the publisher will get earnings.
But my problem is someone using something like this <iframe src="http://my-site.com/adserve.php" width = "100" height = "100"></iframe> & it will helps to get earnings without clicking on that url.
I want to prevent this type of cheating & how it can be possible ??

I hope a expert will replay for me.

Will This Prevent A Sql Injection?

Similar Tutorials

View Content

Will this prevent a SQL injection? I am guessing the answer is no because it is too simple.

// retrieve form data ==========================================

$ama = $_POST['ama'];

// Check for alphanumeric characters =====================================

$string = "$ama";

$new_string = preg_replace("/[^a-zA-Z0-9\s]/", "", $string);

// echo $new_string;

// Send query ===========================================================

$query = "SELECT * FROM members WHERE ama='$new_string'";
if (!mysql_query($query)){
die('Error :' .mysql_error());
}

Prevent Something From Reload

Similar Tutorials

View Content

Hi
is there any way we can prevent suppose <textarea></textarea> when page reload it refresh and set default text
i wanted to know is there any way to prevent certain things not to get refreshed is there any method in php which prevent to reload this !

<?php
echo "<textarea > Enter your favorite quote!</textarea> \n" ;
Code: [Select]
if (isset($_GET['edit']) && $_GET['edit'] == 'textupdate'){
}
<a href= \"{$_SERVER['PHP_SELF']}?page=1&edit=textupdate \" >Click</a>?>

Prevent Default

Similar Tutorials

View Content

I am loading a link with ajax. When the link pops on the screen and I click it, I get redirected to my 404 page and my lightbox doesn't load.

If the link pops in and I refresh my browser, then I click the link my lightbox will show up.

How can I do a prevent default on the <a href> in pure JS? No frameworks please.

Coding Help: Prevent...

Similar Tutorials

View Content

Is this a correct approach to prevent email injection?

$to: me@mydomain.com, myPartner@mydomain.com, $emailer;
//then the rest of the stuff.

$emailCheck = $_POST["emailer"];
if (eregi("(\r|\n)", $emailCheck)) {
die("Why ?? ");
}
mail($to, $subject, "", $headers);

Does This Prevent Sql Injection In Anyway?

Similar Tutorials

View Content

Based on the comments on my previous question, took some tutorials on how to avoid injections on query. Does the code below prevents against it in any way.? Secondly, can you recommend a good article that writes well in how to secure input data by users. Please be kind with your comments.😉😉. Thankks in advance.

The code works fine.

<?php 

include 'db.php';

error_reporting(E_ALL | E_WARNING | E_NOTICE);

ini_set('display_errors', TRUE);

 if(isset($_POST['submit']))

 {
    
 $username = $_POST['username']; 
$password =  ($_POST['password']); 

$sql = "SELECT * FROM customer WHERE username = ?";
$stmt = $connection->prepare($sql); 
$stmt->bind_param('s', $username);
$stmt->execute();
$result = $stmt->get_result();
$count =  $result->num_rows;
   if($count == 1) 
                         {
while ($row = $result->fetch_assoc())
 {
    if ($row['status'] == 'blocked')

 {

 echo'your account is suspended'


   session_destroy();

   exit();

  }

 else if($row['status'] == 'active')
{

if($username !== $row['username']) 

 { 
echo '<script>swal.fire("ERROR!!", " Username is not correct. Check Again", "error");</script>';
} 
if($password !== $row['password']) 
{
  echo'<script>swal.fire("ERROR!!!", "Your Password is Incorrect. Check Again.", "error");</script>';       
}
if($username == $row['username'] && $password == $row['password']) 
{ 
header('Location:cpanel/');
else
{
}
}//if count
}//while loop
}//submit
?>