PHP - Clearing Out Session

I have a Credit Card Payment Form.

A few things...

1.) For non-financial fields, I'm using a "sticky form".

Code: [Select]
<label for="firstName">First Name:</label>
<input id="firstName" name="firstName" class="text" type="text"
maxlength="20" value="<?php echo $firstName; ?>" />

After the user successfully submits the form, how can I erase these values out?

Right now, if you hit the "Back" button, the form data is still there, which isn't very secure?!


2.)  I read somewhere, that HTML secretly cache form values, and there is something you add to your HTML to prevent these - especially on the Credit Card # field.

Any idea what I'm talking about?

BTW, I'm not using Cookies, Sessions, or a DB to store any form data.

Thanks,



Debbie

How do you clear GET variables after performing the action in the same page?
I have tried to unset() them, but every time I refresh, the script reruns all over again and in the end, I have duplicate entries.

I am currently building a website which uses postbacks.
How can I clear the postback so that it can only be posted once because at the minute when i refresh the page it keeps adding the same entry.
Any help would be appreciated

I'm making a simple login system with MySQL and PHP (very simple, I'm just starting with PHP). The MySQL portion is done, but I need to ensure only people who are logged in can see certain content.

To check if people are logged in, my website checks that they have the $_SESSION['user'] variable set. If it is set, then it lets them continue through the website, if not, it tells them to login. Is that enough security, or can people simply inject a session cookie into their browser to spoof that they are logged in?

My idea was to generate a session key cookie when they login (just a random string of letters and numbers) and store that in the database, then on every page, check to make sure their session key is the same thing that's in the database. Is this necessary? It seems expensive.

hi everyone.

i'm wondering what the best way is to create a session variable and pass it to an iframe.
i need to do something along these lines, but it doesn't seem to pass the ID. Any hints on how i should accomplish this?

Code: [Select]
session_start();
  $_SESSION['ID']=$_GET['ID']; // id from previous page
$ID=session_id();

 <iframe src="iframepage.php?ID=<?php echo $ID; ?>" style="width:680px; height:200px;" noresize="noresize" frameborder="0" border="0" scrolling="Yes" allowtransparency="true" /> </iframe>

For some reason if the user has the user has 5 failed attempts at logging in and then they have to wait 10 minutes to try again well if they are able to login successfully its supposed to clear the locked out user and for some reason its not. Anyone see why it isn't?


Code: [Select]
<?php
// User is registered and verified
                    $query = "SELECT * FROM users_logins_attempts WHERE users_id = '".$users_id."'";
                    $result = mysqli_query($dbc,$query);
                    $row = mysqli_fetch_array($result);
                    
                    $lock_date = $row['lock_date'];

                    // Find out if user is locked out of their account
                    if (($lock_date != "0000-00-00 00:00:00") && strtotime($lock_date) >= time()) {
                        $locked = "yes";

                            // Account locked error
                            $errors = true;
                            $message = "Account is locked! Please try again later!";
                            
                            $output = array('errorsExist' => $errors, 'message' => $message);
                            
} else {
                            $locked = "no";
                            // Clear the lock
                            $query = "UPDATE users_logins_attempts SET lockDate = NULL, ip_address = NULL, failed_logins = 0 WHERE users_id = '".$users_id."'";
                            $result = mysqli_query($dbc,$query);
                            
                            // Account locked error
                            $errors = true;
                            $message = "Account is unlocked. You may now try to log in again!";
                            
                            $output = array('errorsExist' => $errors, 'message' => $message);

}
                            
                    if($locked == "yes"){
/*hack around messy nested if statments*/    
                    } else {
                        
                        if ($lock_date != "0000-00-00 00:00:00") {
                            $locked = "yes";
    
                            // Clear the lock
                            $query = "UPDATE users_logins_attempts SET lockDate = NULL, ip_address = NULL, failed_logins = 0 WHERE users_id = '".$users_id."'";
                            $result = mysqli_query($dbc,$query);   
                                
     } 
?>

I downloaded a script for a poll/voting kinda thing for all my site visitors a while ago and then I tweaked it a bit. It is linked to a database. It grabs the question and possible answers from one database. It also stores user votes, ip addresses, and the date they voted in a database.    I went to change the question and possible answers in my poll by simply changing the options in the Database. This worked fine, but I found a big problem! If you have already voted in the poll, then it displays the results to you every time you visit the site . I assumed this was based off your IP since it is recorded in the database. So logically I thought if you cleared all the IP's in the DB, then the new question would display for every user, but to my alarm it is based off cookies. This is problem because even though I changed the question and options, if people have not cleared their cookies from the last time then the poll still displays the results even though they have not voted on the new question yet. Is there someway to clear everyone cookies or make the poll start fresh for everyone without drastically changing the code and how the entire thing works?
Edited by ryanmetzler3, 24 May 2014 - 09:33 PM.

This topic has been moved to Third Party PHP Scripts.

http://www.phpfreaks.com/forums/index.php?topic=359149.0

Morning All,

Should be a quick one for the seasoned veterans! I'm learning the in's and out's of sanitizing my variables for input into my database (mysql).

The following is my code;

Code: [Select]
$Username = mysql_real_escape_string($_POST['username']);
$PWord = mysql_real_escape_string($_POST['pword']);
$Email = mysql_real_escape_string($_POST['email']);
$Fullname = mysql_real_escape_string($_POST['fullname']);
$Address_1 = mysql_real_escape_string($_POST['address_1']);
$Address_2 = mysql_real_escape_string($_POST['address_2']);
$City = mysql_real_escape_string($_POST['city']);
$Zip = mysql_real_escape_string($_POST['zip']);
$Country = mysql_real_escape_string($_POST['country']);

The following is my output;

Error executing INSERT statement - INSERT INTO tblUser(User_Name, Full_Name, Email, Address_1, Address_2, City, Zip, Country, PWord)VALUES ('','','','','','','','','')

Any ideas?

Also; is mysql_real_escape_string valid for use on all types of input from the input box?

Hi, I'm quite a newbie to PHP and am doing a website. Have got a login working and the registration half way there, but am now in process of putting validation in Registration form. Have got the errors appearing if domething isn't filled in or if the username is taken however, it clears all the fields and i would like it to keep the values in them if possible. Is there an easy way round this?

I can give my code if needed

Cozzy

 
I'm calling a function that resets a couple arrays:


public function resetStuff() {
$this->someArray = array();
$this->someOtherArray = array();
}

However, someOtherArray is not resetting!! How could that be?

I can add debug statements to echo the size of the arrays before and after the function calls. It shows that:
someArray went from n to 0
someOtherArray went from n to n

How is that possible??

I'm trying to use this php to clear out the session variables and return to the index page.  However it's not clearing them out. Any ideas?

logout.php
Code: [Select]
<?php 
session_start();
        unset($_SESSION['user_id']);
        unset($_SESSION['username']);
session_destroy();
header("Location: http://aaronhaas.com/pitchshark6/index.php?vid_id=1"); 
?>

then in my navigation I'm using this code to either display their username and a logout link to logout.php or if they are not logged in display a sign in link.

Code: [Select]
<?php
         // if logged in
if (isset($_SESSION['user_id'])) 
{
// display 
echo "<a href='#'>".$_SESSION['username']."</a>&nbsp; &nbsp;";
echo "<a href='scripts/logout.php'>Log Out</a>&nbsp; &nbsp;";
}
        // if not logged in
else
{      // display login link
echo "<a href='login.php'>Sign In</a>";
}
?>


here is my super simple login script
Code: [Select]
$username = $_POST['username'];
$password = $_POST['password'];

//Check if the username or password boxes were not filled in
if(!$username || !$password){
//if not display an error message
echo "<center>You need to fill in a <b>Username</b> and a <b>Password</b>!</center>";
}else{
// find user by username and password - working
$userQuery = 'SELECT * FROM users WHERE user_name ='.'"'. $username.'" AND password='.'"'. $password.'"' ;
$users = mysql_query($userQuery);

$user = mysql_fetch_array($users);
$_SESSION['user_id'] = $user['user_id'];
$_SESSION['username'] = $user['username'];
header("Location: http://aaronhaas.com/pitchshark6/index.php?vid_id=1");

}

Code: [Select]
$genre = $_POST['listMovies'];
$result = mysql_query("SELECT * FROM  movieTable SORT BY title");
$column = 1; define("COLUMNS", 2);
$movieCounter = 0;
echo "<h1>by " .$genre ."</h1><table>";
while ($info = mysql_fetch_array($result)) {
$genre1 = $info['genre1'];
$genre2 = $info['genre2'];
$genre3 = $info['genre3'];
$title =  $info['title'];
        $link = $info['imdbLink'];

       
if ($genre == $genre1 || $genre == $genre2 || $genre == $genre3) {
$movieCounter++;

                if ($column == 1) {echo "<tr>";}
echo "<td><a href='" .$link ."'>".$title ."</a></td>";
$column++;
if ($column > COLUMNS) {
echo "</tr>";
$column = 1;
}             
}
}

echo "<table><tr><td>" .$movieCounter ." movies found.</td></tr></table>";
if ($column > 1 && $column <= COLUMNS) {
while ($column++ <= COLUMNS) echo "<td></td>";
echo "</tr>";
}
echo "</table>";
$genre = "";
now that you have the code, i have 2 questions about this.  first one is this.  whenever i first load this code everything is empty as it should be.  then i select from a form a movie genre and everything work lovely.  the problem is that the movies that are loaded are still there when i come back to the page.  i need a way to clearing this out everytime the code is run, while still displaying the movies.

also .. this is just a php noob question here.  why is that when i run a query like this


Code: [Select]
$result = mysql_query("SELECT * FROM  movieTable SORT BY title");
i cannot use mysql_fetch_array or mysql_fetch_row? 

but it works when i do it like this

Code: [Select]
$result = mysql_query("SELECT * FROM  movieTable");
like i said that's just a noob question that i cannot for the life of me figure out. 

thanks for the help, this forum has been the biggest help to me learning php.

Evening!

I've been iffing and ahhing over this and well im not too sure, hence the post.

Code: [Select]
// Redirects if there is no session id selected and echos the error on the previous page
if(!isset($_GET['get']) || ($_GET['getget'])){
header("Location: #.php?error");
}
So it should simply check if get is set if it isnt then see if getget is set?

If not redirect and show the error.

Now ive tried it and even when get/getget is set it still redirects, probably something silly. Care to share anyone?

Harry.

Just curious how other people feel about this.  I am working on an application where a lot of info is pulled from MySQL and needed on multiple pages.     Would it make more sense to...   1.  Pull all data ONCE and store it in SESSION variables to use on other pages    2.  Pull the data from the database on each new page that needs it   I assume the preferred method is #1, but maybe there is some downside to using SESSION variables "too much"?   Side question that's kind of related:  As far as URLs, is it preferable to have data stored in them (i.e. domain.com/somepage.php?somedata=something&otherdata=thisdata) or use SESSION variables to store that data so the URLs can stay general/clean (i.e. domain.com/somepage.php)?   Both are probably loaded questions but any possible insight would be appreciated.   Thanks! Greg
Edited by galvin, 04 November 2014 - 10:30 AM.