Session.. Logging users in as other users

Litninfingers63

Hey,

I recently learned how to use sessions, and I'm curious to something:

if I link someone to http://myurl.com/index.php?id=login?sid=b1336a899fdd60ec5937f509f3e52a75

it logs the users in as me. Is there any way to prevent this? I have the user name in the sessions table, so I can call that information through out the site.

I'm really confused as to how I can prevent users from doing this?

Litninfingers63

Also, do you know how I can delete users from a users online list if their last hit (which is stored in a database) is more than 15 minutes ago?

I cant seem to get it. I keep deleting the session from the user viewing.

Litninfingers63

No suggestions at all?

Could someone move this to the general php forum, so maybe people can help in there?

celibate54

i've been asking the same questions if u look a couple posts down -- there are also some answers in that thread

Litninfingers63

Originally posted by celibate54
i've been asking the same questions if u look a couple posts down -- there are also some answers in that thread

Well, that works for users, and I have that working. But if a user closes their browser, their session information is stored in the database. When a DIFFERENT user views the "whos online" that I wrote, it still shows them logged in.

I need it to check to see if there are ANY sessions that have a last click greater than 15 minutes ago, then delete them from the session. know what I mean?

onion2k

Rather than mess about trying to delete sessions and stuff, why not store the time of the last time the user did something in the database?

On each page you'd call a sql query that updated a field in the user record that stores when they hit the page:

update user set last_hit = NOW();

Then, when you generate the list of users active you just need to pull out all the users whose last_hit is within the last 15 minutes:

select * from user where last_hit < DATE_SUB(NOW(), INTERVAL 15 MINUTE);

marky2coats

Hey,

Doesnt setting session.use_cookies to 1 stop the session ID be passed via the URL?. Then people would not beable to log in just by clicking the URL.

Mark.