I have two problems

Anon

I have two problems. I'm writing for my friend couple nice scripts but now some problems that I haven't been able to manage.

First, the mail() function is not working correctly. I'm trying to send to an list of addresses from a database emails but it doesn't send them to all of them. It leaves allways the same addresses away. I can't understand why.
How should I send emails if I don't want to use mail() function?

Second problem, I login in members area. I activate an session. I copy+paste the address with session to my friend and he can go to members area with my session many hours later and modify my member info. How can I avoid this? Is there a away to kill sessions automatically? Should I login or the actions in a database and delete the session id from there after some time of not using it?

Thanx for the help
-- Kim

P.S. sry for the bad english, flu, tired and not english person is not a good combination =)

rrijnders

Hi Kim,

With your first problem you don't mention how you know that some of the emails are being skipped. You need to give more information before I can help. How are you selecting the addresses from the DB? What DB are you using? How are you using the mail() function?

About the 2nd problem: Sessions don't really time out. If you want a session to time out, you will have to handle that in code. If you have sessions configured to pass the session id through the url, then the cutting and pasting will certainly work to hijack a session; they are not designed to keep people from passing the id's around. If you are woried about that, set the <i>session.referer_check</i> variable to "1".

-- Rich

Anon

Hi Richard,

Well I'm using mysql. I was testing it like sending email to my account and to my friends account. My friend got the email but the email didn't come to me.
But I found today nice help with smtp and I changed it to use that. Now it works nicely and it's not jumping over any emails.

Well the session.referer_check is in php.ini and I can't get my hands on that. Using an webhost service. Is there anyway I could do that? override the parameters placed there?
Or should I just use database with sessions and kill session ids after 1 hour inactivity?

-- Kim

rrijnders

Personally, I always place time-outs on sessions. I just check a timestamp in a seesion variable every time they access a member's only page. If not too much time has passed, I reset the timestamp, otherwise I make them log in again.

-- Rich