PDA

Click to See Complete Forum and Search --> : Completely fustrated with sessions

Perfidus
11-05-2003, 01:42 PM
I'm generating a session variable for a password access.
1- User logins in html form.
2- Password and user are sent to php and php checks in database. If ok allowes to go somewher else if not comes back to form.
3- If you log correctly then you are in new page, but as soon as you seen the adress you can come back as much as you want cause it is not protected!!
How can I make a number of pages protected with just one password imput?
pyro
11-05-2003, 01:54 PM
Start the session once they log in, and if the session is not set on the following pages, do not allow access to those pages.
Perfidus
11-05-2003, 02:02 PM
But can this be done without cookies?
pyro
11-05-2003, 02:08 PM
Yes it can. Just look into passing the session (http://us4.php.net/session#session.idpassing) through the URL.
Perfidus
11-05-2003, 02:19 PM
If I pass the session trough url ...
What I have done is the following:
1- I check pass in database.
2- If password is ok I open session and I stored session_id in database and I also send it to page 3.
3 - If password is wrong back to form.
4 - If they access to 3erd page, I get the session from url and I check with session stored in DB.

I REALLY BELIEVE THERE'S SOMETHING EASIER THAN THIS!

<?
session_register('usuario');
?>
<?
$conn = mysql_connect("bla","bla","bla");
mysql_select_db("bla",$conn);
$ssql = "SELECT * FROM Clientes WHERE Inmo='$Inmo' and Password='$Password'";
$rs = mysql_query($ssql,$conn);
if (mysql_num_rows($rs)!=0){
session_start();
session_register("autentificado");
$autentificado = "SI";
$Sesion=session_id();
$Sesioname=session_name();
$Bothsesiones=$Sesioname."=".$Sesion;
$Fecha = date("Y-d-m h:i:s");
$sql = "INSERT INTO Sesiones ( Fecha, Sesion, Inmo)" .
"VALUES ('$Fecha', '$Sesion', '$Inmo')";
$result = mysql_query($sql) or die(mysql_error().'<p>'.$sql.'</p>');
header ("Location: uploader.html?$Bothsesiones");
}else {
header("Location: acceso2.html?errorusuario=si");
}
mysql_free_result($rs);
mysql_close($conn);

?>
pyro
11-05-2003, 02:45 PM
Yeah, just check if the session exists on the following pages:

<?PHP
if (isset($_SESSION['sessionname'])) {
# they are logged in
}
else {
# they are not logged in
}
?>
Perfidus
11-05-2003, 07:24 PM
Can anybody tell me where's the fu%#@~~ error?
Whenever I execute it get lost, it does not find validador5.php!!!
3 pages:
1- Form (acceso5.html):

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>Documento sin título</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>
<div align="center">
<p> </p>
<p> </p>
<p> </p>
<p>
<FORM action="validador5.php" method="POST">
Usuario
<input name="Inmo" type="text" id="Inmo">
<br>
Password
<input name="Password" type="password" id="Password">
<br>
<input type="submit" name="Submit" value="Enviar">
</FORM>
</p>
</div>
</body>
</html>


2 - Asking some datas and opening a Session in php (validador5.php):

<?
session_register('usuario');
?>
<?
//conecto con la base de datos
$conn = mysql_connect("mysql.gestionar.info","aa1126","huissen");
//selecciono la BBDD
mysql_select_db("aa3968",$conn);
//Sentencia SQL para buscar un usuario con esos datos
$ssql = "SELECT * FROM Clientes WHERE Inmo='$Inmo' and Password='$Password'";

//Ejecuto la sentencia
$rs = mysql_query($ssql,$conn);

//vemos si el usuario y contraseña es váildo
//si la ejecución de la sentencia SQL nos da algún resultado
//es que si que existe esa conbinación usuario/contraseña
if (mysql_num_rows($rs)!=0){
//usuario y contraseña válidos
//defino una sesion y guardo datos
session_start();
session_register("autentificado");
$autentificado = "SI";
$Sesion=session_id();
$Sesioname=session_name();
$Bothsesiones=$Sesioname."=".$Sesion;
$Fecha = date("Y-d-m h:i:s");
$sql = "INSERT INTO Sesiones ( Fecha, Sesion, Inmo)" .
"VALUES ('$Fecha', '$Sesion', '$Inmo')";
$result = mysql_query($sql) or die(mysql_error().'<p>'.$sql.'</p>');
header ("Location: uploader5.html?$Bothsesiones");
}else {
//si no existe le mando otra vez a la portada
header("Location: acceso5.html?errorusuario=si");
}
mysql_free_result($rs);
mysql_close($conn);
?>

3- The last document (where we suposely wanted to arrived ask if session is seted (uploader5.html):

<?PHP
if (isset($_SESSION['sessionname'])) {
echo "Usuario reconocido";
}
else {
header ("Location: acceso5.php");
}
?>
pyro
11-05-2003, 09:02 PM
What errors are you getting? If it isn't finding validador5.php, aparently it does not exist. You might want to double check that.
YoN
11-06-2003, 08:51 AM
if i'm not wrong, when you use session_register(), it calls automatically session_start(). then, you dont have to re-call session_start() on 'validador5.php'. Also as the manual (http://us4.php.net/manual/en/function.session-register.php) says Use of session_register() is deprecated.
Use of $_SESSION is preferred, as of PHP 4.1.0.
if you are on PHP 4.1.0 or newer then use $_SESSION global array else use $HTTP_SESSION_VARS.
I have used $_SESSION to register entries to the sessions and haven't got any problems.
;)
AdamBrill
11-06-2003, 10:47 AM
Here is a simple example of setting a session variable:

<?PHP
session_start();
$_SESSION['varname'] = "true";
?>

Then to read it on the next page:

<?PHP
session_start();
echo $_SESSION['varname'];
?>

And if you don't want it relying on cookies, your links would all have this at the end:

?PHPSESS=<?PHP echo session_id(); ?>

So your links would look like this:

<a href="wherever.php?PHPSESS=<?PHP echo session_id(); ?>">Go Wherever!</a>

NOTE: You have to start the session before you can get the session id...

So, on your pages that are meant to be protected, you would put this:

<?PHP
session_start();
if($_SESSION['varname'] != "true"){
header("Location:error.php");
}else{
?>
<!-- Page Source -->
<?PHP
}
?>

I hope that helps to show you how it's done. :)

BTW, in the source code that you posted, you didn't take your username and password out of it. ;) You might want to edit your post and do that... :)