Session Data Changes When Its Not Supposed To

ROSEBLOOD

I have hanving a problem with this learning log system I am coding for my Web Publishing Class. The problem is when a user views another classmates' learning log it changes their session data to that of student they just viewed....

Example:

user1:
id = 1
f_name = bobby
l_name = joe
period = 2
username = user1

user2:
id = 2
f_name = billy
l_name = bob
period = 2
username = user2

When user1 views the learning log of user2, user2's session data gets changed to user1's session data. As you can see this is a huge security risk.

The strange thing is that in the scripts it doesnt change any of the session data. So I dont know where to fix it.

Here are a few of scripts:

show_log.inc:
http://rafb.net/paste/results/yRPqwf63.html

user_menu.inc:
http://rafb.net/paste/results/eqdnuI84.html

user1 log:
<?
#####log.inc#####
session_start();
?>
<? include 'head.inc'; ?>
<? include 'log_w.inc'; ?>
<? include 'foot.inc'; ?>

user2 log:
<?
#####log.inc#####
session_start();
?>
<? include 'head.inc'; ?>
<? include 'log_w.inc'; ?>
<? include 'foot.inc'; ?>

head.inc:

<h1><? echo "$_SESSION[v_fname] $_SESSION[v_lname]'s Learning Log"; ?></h1><br>
<table cellpadding="5" cellspacing="3" border="2">

foot.inc:

</table>

check_login:
http://rafb.net/paste/results/gKBJz079.html

~ROSEBLOOD

rehfeld

well your problem seems to be here

http://rafb.net/paste/results/gKBJz079.html

why are you setting the session username and other stuff to the values returned by the database? that has nothing to do with whos logged in. stop doing that, or if you need to store that data in a session, use different session variables.

ROSEBLOOD

SWEET Thanks a ton for the help. I didnt think naming the session data the same as the DB name would do anything. Thanks for the help rehfeld.

~ROSEBLOOD

TomatoLover

Hi,

You seemed to understand how to fix the problem already.
However, I am having the exact same problem with you, and I understand now that I am not supposed to use the data from database for the Session.

I guess, I can use session _id to pass session value to see who logged in the system.

Now, my question is how I am supposed to get data from database, using this Session_id? I used to pass the primary key value to the next page as Session value, so that I can simply throw it into the database to retrieve his data. But, now I don't have that.

Can you tell me how you fixed the problem? I really appreciate it.