1

I am storing session information in an array called 'Auth'. That array contains 2 session information: id and password. My problem is when I am using the id info for quering, it is not working. I am pretty sure it is due to the fact that the id info in my table is an int, and the one from the session array isn't. So my question is to know how to convert that session id variable into an int. Here below the function in which I am using $_SESSION(['Auth']['id']). Thank you in advance for your replies. Cheers. Marc

The PHP code where I am using the session info:

<?php
session_start();
header('Content-Type: text/html; charset=utf-8');
require("connect.inc.php");

function isLogged(){
        if(isset($_SESSION['Auth']) && isset($_SESSION['Auth']['id']) && isset($_SESSION['Auth']['pass'])){

            extract($_SESSION['Auth']);
            $result = mysql_query("SELECT * FROM usr_users WHERE usr_id = '$id' AND usr_pass = '$pass'");

            if(mysql_num_rows($result)==1){
                return true;
            }
            else{
                return false;
            }
        }
}
?>

Here the PHP code where I set the session info:

<?php
session_start();
header('Content-Type: text/html; charset=utf-8');
require("connect.inc.php");


$identifiant = mysql_real_escape_string($_POST['identifiant']);
$pass = sha1($_POST['pass']);

$result = mysql_query("SELECT * FROM users WHERE usr_pseudo = '$identifiant' AND usr_pass = '$pass'");
if(mysql_num_rows($result)==1){
    $data=mysql_fetch_assoc($result);   
    $_SESSION['Auth']=array(
        'id'=>$data['usr_id'],
        'pass'=>$pass
    );
}

echo mysql_num_rows($result);

?>
4
  • MySQL implicitly converts numeric values if quoted as strings. Something else is going on, such as $_SESSION['Auth']['Id'] not containing what you think it does. Feb 2, 2012 at 19:34
  • "at array contains 2 session information: id and password." Why are you storing the password in a session? Feb 2, 2012 at 19:36
  • Michael, ty trying to help me. Check above the code through which I am creating the session info. It might give you more indication to try help me. Thank you
    – Marc
    Feb 2, 2012 at 19:39
  • Problem solved- It was a syntax error:( Thanks to everyone that has taken time to help me.
    – Marc
    Feb 2, 2012 at 20:50

5 Answers 5

1

extract() is a horribly ugly function, and you should wipe its existence out of your mind.

There's no need for it, since it's purely a holdover from PHP's early "lazy" days, when it tried to do everything for you, causing in part the miserable security reputation PHP has.

You can directly embed session variables wherever you want, even when it's an arbitrarily "deep" array reference like your session is:

$sql = "SELECT ... WHERE id={$_SESSION['Auth']['id']} ...";

or even

$id = $_SESSION['Auth']['id']'
$sql = "SELECT ... WHERE id=$id";

will both work the same way, and not litter your variable namespace with useless junk.

1
  • Hello Marc. Thank you very much for the info. I will stop using extract(). Unfortunately it is not solving the problem I am facing.
    – Marc
    Feb 2, 2012 at 19:43
0

You can cast any variable into any type by using the cast methods.

$usr_id = (int)$data['usr_id']

This would return a type of integer. If the id includes anything else but integers, 0 is returned.

http://php.net/manual/en/language.types.type-juggling.php

1
  • Hello Richard. I tried that already. It isn't helping unfortunately.
    – Marc
    Feb 2, 2012 at 19:45
0

You should not query DB each time you'd like to check if the user is logged in. And you don't need to store password in the seesion. You have to query db only once when you login user (your second part of the code).

And it would be better if you create a simple wrapper for your auth logic. Something like this simple class with static functions:

<?php
class Auth
{
  public static function login($identifiant, $password)
  {
    // query db then
    // $_SESSION['Auth']['id'] = value from db
    return self::id();
  }

  public static function isLogged()
  {
    return (bool)self::id()
  }

  public static function id()
  {
    return (isset($_SESSION['Auth']['id'])) ? $_SESSION['Auth']['id'] : false)
  }

  public static function logout()
  {
    $_SESSION['Auth'] = array();
  }
}


// usage
Auth::login($_POST['identifiant'], $_POST['password']);
if (Auth::isLogged()) {
  $sql = "select * from posts where user = " . Auth::id() . "";
}
Auth::logout();
2
  • Hello, i am not checking to know if the user is logged In. I am checking that a real user is loged in. For security reason it seems to me not enough to have sessions set. Those sessions have to be accurate and be related to real user accounts. That's why I use the password as session info also.
    – Marc
    Feb 2, 2012 at 20:33
  • You won't get any benefit in security if you will store password in session. It is enough to store id in the session. Also, if you like to check if this is a real user you may add a correspondent query into the Auth::id() method. I just show you an example of much cleaner code.
    – StGeneral
    Feb 3, 2012 at 10:44
0

If you are "pretty sure it is due to the fact that the id info in (your) table is an int, and the one from the session array isn't".

Then here's a simple way to convert your session id from array into a variable (cast it).

$id = (int)$_SESSION['id'];

Hope it helps.

-2

you should not enclose integers in single quotes in the SQL

try this

$result = mysql_query("SELECT * FROM usr_users WHERE usr_id = $id AND usr_pass = '$pass'");
3
  • Hello David. Thank you for helping. Unfortunately your idea is not working.
    – Marc
    Feb 2, 2012 at 19:34
  • 1
    Numeric values can be enclosed in quotes. Feb 2, 2012 at 19:35
  • ahk! only on SO does my intolerance for MySQLs looseness bite me so hard!
    – David Chan
    Jul 23, 2012 at 22:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.