Reg. Session varibles NOT HOLDING - Help Please

Fritz

I have worked hard to write a session based user system and am near completion... all seemed good until today.

I started Writting some 'management' pages and calls to the users table is CHANGING the register'd session values...

I am using print_r($_SESSION) at the top of pages to keep an eye on things...

Here's the deal.

a management person (with 'authority' via a userlevel field) log's in... to view a list of basic users for editing updating...

page checks for proper authority...
I do a sql select to grab a list of users... a while clause to grab some fields to work with -
at that point the registered session varibles are CHANGED right after the select from the users list to the info of the LAST user in the users table.

IF I change the name of the fields to different names in the While clause I am good...
ex. $xfname = $row['fname']; AND it doesn't CHANGE the registered session varible for that field.

It makes no sense to me ... I DIDN'T think that a register'd session value would change...WHILE it was registered.

When I register a session value should I give it a unique name? I HAVE BEEN doing this...

session_register('fname'); $_SESSION['fname'] = $fname;

any season'd pro help would be very much appreciated.

sijis

i'm not really sure what you are saying, but i'm going to guess.
what i believe you are saying is that in a while loop you are putting the values in a session, probably something like this:

while($row=mysql_fetch_array($sqlStatement)){
   $_SESSION['db_field']=$row['db_field'];
}

but then you notice that the session db_field only has the last entry of that loops. if so, the reason is because everytime the loop executes it overrides the previous value of that session variable. Maybe giving each session a different 'name' could solve your problem.
if you are trying to validate a user just match their data to taht of the database with your sql query (if this is what you are tyring to accomplish) like

$sql = "SELECT * FROM table WHERE username='".$POST['username']."' AND password='".$POST['password']."'
then if it matches true, put those values in a session.
Since i'm not sure what you are trying accomplish, maybe some code would be helpful. but if you are trying to put a ton of values into sessions, then you should think about doing things differently, it (maybe) would be a waste of resources.

Fritz

I register fname like this...

 session_register('fname'); $_SESSION['fname'] = $fname;

I am using print_r($_SESSION) at the top of pages to keep an eye on things...

and after I log in I can see that fname is registered...

PROBLEM: If I am selecting a list of users to modify (from the same users table),
The select statement is pretty strait forward...

 $sql = "SELECT * FROM users "; 
$result = @mysql_query($sql) or die("Couldn't execute query."); 
while ($row = mysql_fetch_array($result)) 
{$fname = $row['fname'];

Problem is ... the simple select above is changing MY (or the person logged in) session value for fname to the last result of the select statment...

I can't see why a select is changing a registered session value...

IF I change the name of the fields to different names in the While clause (in the select statement I am good...
ex. $xfname = $row['fname']; AND it doesn't CHANGE the registered session varible for that field.

It makes no sense to me ... I DIDN'T think that a register'd session value would change...WHILE it was registered.

When I register a session value should I give it a unique name? I HAVE BEEN doing this...

I hope this is clearer...

Originally posted by sijis
i'm not really sure what you are saying, but i'm going to guess.
what i believe you are saying is that in a while loop you are putting the values in a session, probably something like this:
while($row=mysql_fetch_array($sqlStatement)){
   $_SESSION['db_field']=$row['db_field'];
}
but then you notice that the session db_field only has the last entry of that loops. if so, the reason is because everytime the loop executes it overrides the previous value of that session variable. Maybe giving each session a different 'name' could solve your problem.
if you are trying to validate a user just match their data to taht of the database with your sql query (if this is what you are tyring to accomplish) like

$sql = "SELECT * FROM table WHERE username='".$POST['username']."' AND password='".$POST['password']."'
then if it matches true, put those values in a session.
Since i'm not sure what you are trying accomplish, maybe some code would be helpful. but if you are trying to put a ton of values into sessions, then you should think about doing things differently, it (maybe) would be a waste of resources. [/B]

dalecosp

Perhaps removing the session_register call will help. When you set

$_SESSION['fname']=$fname;

the session var will be set --- there's no need to call it twice by placing the session_register() directive first. If you are coding with register globals on, then this might just be the cause of your problem. It's just a hunch, and I can't explain why, but give it a try.

FWIW, in my scripts I generally give an "admin" type user the session var $SESSION['authed-user'] or some such, while the average joe just gets $SESSION['firstname']....

HTH,

sijis

ahh, now i see what you mean!

dalecosp touched on this a bit. if you have registered globals on
once you create a session ($SESSION['fname']) you can use it like this:
$fname or $SESSION['fname']
since you are also creating a regular variable with the same name ($fname = $row[field]) then php is getting confused.
it will hold the last value places on that variable, in your case in the while loop.

personally, i just give them an extra session called $SESSION['admin'] and all users have the same username session $SESSION['username']. dalescops has a great scheme too!

Fritz

Originally posted by sijis
ahh, now i see what you mean!

dalecosp touched on this a bit. if you have registered globals on
once you create a session ($SESSION['fname']) you can use it like this:
$fname or $SESSION['fname']
since you are also creating a regular variable with the same name ($fname = $row[field]) then php is getting confused.
it will hold the last value places on that variable, in your case in the while loop.

personally, i just give them an extra session called $SESSION['admin'] and all users have the same username session $SESSION['username']. dalescops has a great scheme too!

So I guess the zen question of late seems to be Register Globals ON or OFF... perhaps I should/will toss that up as a question ...

I think I will simply make the session varibles UNIQUE and hack around with that... I will NOT go live with our new user system until I can fully understand and make sure this is smart and secure..