Protecting a member page by registering a session id

adrianuk29

Since my webhosts have turned register globals off I have hit a brick wall.

When a user first signs in a username session is registered and this is kept throughout the whole control panel, which is cool and works well.

However when the user decided to say update there personal profile example

www.mydomain.co.uk?profilepage.php?id=12332

I want to be able to register the id number as a session when they enter their control panel, so even if they decided to change the number in the url they would still only see there record and no one elses.

When register globals where on I got this working a treat. The number could be changed in the url but the record still remained the same becuase the id number was registered as a session. When they went back to the main page then the session id would be killed so they could pick other profiles to change.

If somone could give me some advice or coding help it would be greatly appreciated.

Many Thanks
Ade

drew010

well if they just disabled register globals all you should have to do is find $id and switch it to $POST['id'] and switch session_register calls to $SESSION['var'] = "value"

adrianuk29

mmm I tried that but the problem that I got was when you changed the number in the url then that id number would be registered as the session this is where the problems lies.

See what I had in my code was the following:-

$_SESSION['id'] = "$id"

I even tried the following

if($SESSION['id']){ }else{ $SESSION['id'] = '$id' }

drew010

depending on where their user id is stored you should just set $SESSION['id'] = "idnumber"; from the start so if it comes from a database register it immediately, then you want to make sure $GET['id'] isnt ever inserted into $_SESSION['id']

drew010

i was just thinking, if you are running php > 4.2.3 you can do ini_set("register_globals", "1"); at the top of all the scripts that used to work and it will turn register globals on.

adrianuk29

Please dont laugh at the code its a mess but it works

<?
session_start (); // start the session

extract($_SESSION);

if($_SESSION['username']){

if($SESSION['id']){ }else{ $GET['id']; $_SESSION['id'] = $id; }
?>

I can now enter anything I like in the url and member page still stays the same.

This is also because I replaced $id in the mysql query with $_SESSION['id']

The other problem I had is that I was extracting $_GET to early on in the code.