php session variable randomly changes -

-

i have website has membership system. when users log in, validate username/password database , start session, $_session['userid'] contains id (i have not implemented using cookies yet)

i have problem, system works fine of times, users have reported find logged in other random users account. means $_session['userid'] changes without reason else , i'm pretty sure i'm not doing change it.

any ideas why happening ?

edit : summary of doing

this method start session

function startsession($id){ $_session['logged_in'] = 1; $_session['userid'] = $id; }

this method checks login

function isloggedin(){      return isset($_session['logged_in']) && isset($_session['userid']) && $_session['userid']!=" " && $_session['logged_in']==1; }

this logout method

function logout(){     $_session['logged_in'] = 0;     $_session['userid'] = 0;     unset($_session['logged_in']);     unset($_session['userid']);     session_destroy();     if (!isloggedin()){ return "s3"; }     else { return "e3"; } }

and how check if user logged in places

if (isloggedin()){ $profileid = $_session['userid']; }

this login function, call startsession

function login($username, $password){     $pdo = newpdo();     $username = sanitize_string($username);     $password = sha1(sanitize_string($password));     $query = $pdo->prepare("select id ".table_profile." nick=:nick , pass=:pass limit 1");     $query->execute(array(':nick'=>$username, ':pass'=>$password));     $result = $query->fetch(pdo::fetch_assoc);     if (count($result['id']) == 1){          startsession($result['id']);         loginexecution();         return "s1";     }     else{ return "e1"; } }

the problem in login function

your script not checking username , password data, , if username , password empty or incorrect, client gets firs available id database.

function login($username, $password){     $pdo = newpdo();     $username = sanitize_string($username);     $password = sanitize_string($password);      // check data existing     if (empty($username)) throw new exeption('empty username');     if (empty($password)) throw new exeption('empty password');      $password = sha1($password);      $query = $pdo->prepare("select id ".table_profile." nick=:nick , pass=:pass limit 1");     $query->execute(array(':nick'=>$username, ':pass'=>$password));     $result = $query->fetch(pdo::fetch_assoc);     if (count($result['id']) == 1){          startsession($result['id']);         loginexecution();         return "s1";     }     else{ return "e1"; } }

p.s. check incoming data, before sql queries


Comments

Post a Comment

Popular posts from this blog

Change the color of an oval at click in Java AWT -

-
i have draw ovals in java, , @ click change color. beginning tried change color after 20 ms, doesn't work. my code is: public class mycomponentnew extends frame { public graphics2d g2d; public mycomponentnew(string title) { super(title); setsize(400, 550); } @override public void paint(graphics g) { this.g2d = (graphics2d) g; this.g2d.setcolor(color.red); this.g2d.filloval(10, 55, 50, 100); } public void changecolor () { this.g2d.setcolor(color.blue); this.g2d.filloval(10, 55, 50, 100); } } and in class main method have: mycomponentnew m; m = new mycomponentnew("fereastra cu baloane"); m.setvisible(true); m.addwindowlistener(new windowadapter() { @override public void windowclosing(windowevent we) { system.exit(0); } }); try { thread.sleep(20); } catch(interruptedexception e) {} m.changecolor(); the color of oval remains red. ...
Read more

c# - Unity IoC Lifetime per HttpRequest for UserStore -

-
i'm trying clean default implementation of accountcontroller.cs comes out of box in new mvc5/owin security implementation. have modified constructor this: private usermanager<applicationuser> usermanager; public accountcontroller(usermanager<applicationuser> usermanager) { this.usermanager = usermanager; } also, have created lifetime manager unity looks this: public class httpcontextlifetimemanager<t> : lifetimemanager, idisposable { private httpcontextbase _context = null; public httpcontextlifetimemanager() { _context = new httpcontextwrapper(httpcontext.current); } public httpcontextlifetimemanager(httpcontextbase context) { if (context == null) throw new argumentnullexception("context"); _context = context; } public void dispose() { this.removevalue(); } public override object get...
Read more

I am trying to solve the error message 'incompatible ranks 0 and 1 in assignment' in a fortran 95 program. -

-
i writing program in fortran find velocity of parachuting person in relation time. keep getting error can't fix. new programming , appreciated. the error is v(i+1)=v(i)+[32-((c*v(i)*v(i))/m)]*(h) 1 error: incompatible ranks 0 , 1 in assignment @ (1) and program is program para integer :: real :: v(11) !velocity real :: q !initial velocity real :: h !time step real :: c !drag coefficient real :: m !mass ! gravity equal 32 ft/s^2 write (*,*)'enter time step' read(*,*)h write(*,*)'enter initial velocity' read(*,*)q write(*,*)'enter drag coefficient' read(*,*)c write(*,*)'enter mass' read(*,*)m i=1,10 ! 1 10, 1 being interval. end v(i+1)=v(i)+[32-((c*v(i)*v(i))/m)]*(h) q=v(1) end program you cannot use [] normal parenthesis in expressions. array constructor, [ items ] means array items elements. end do should after line.
Read more