Session Varialbes and Values

Nick_Zaccardi

I use sessions on my site to authenticate and as well as show that the user is logged in and such. I use them in the standard way, when a use logges in I set a session variable called loggedin to a value of 1. Also I set an id varialbe that i refrence in other scripts.

I also use databases quite extensively, and a popular field is id. So when I get that value, I use something like this..

$sql = "SELECT id FROM table WHERE condition"
$result = mysql_query($sql);
$id = mysql_result($result , 0);

That last line of code is where things get messed up. What was happening was the session varialbe id keeps getting reset to the value of the mysql call. to test for this I created a really easy script...

echo "  Session 1:" . $_SESSION['id'];
$id = 123;
echo "  Echoed Id:" . $id;
echo "  Session 2:" .$_SESSION['id'];

RESULTING OUTPUT:

Session 1: 5028 
Echoed Id: 123 
Session 2: 123

Why does id get reset without an explicit call to $_SESSION['id']??

laserlight

It's been awhile, so I cannot remember the details on how does it work, but is register_globals on in php.ini, by any chance?

Nick_Zaccardi

Yes register_globals is on.

laserlight

Okay, turn it off in php.ini and restart the web server. The problem should be fixed (but then you may encounter other problems when running scripts that assume register_globals is on, but these should be rare in this day and age). I believe that register_globals is causing $id to act as an alias for $_SESSION['id'].

Nick_Zaccardi

Since it is hosted how would I go about restarting the server?

laserlight

Eh, I tested, and the variables should not be aliased, so register_globals is for the problem (though it still can be a problem, but in other ways). I suggest that you post the smallest and simplest runnable script that demonstrates the problem.

Since it is hosted how would I go about restarting the server?

As in you are on a shared host and thus do not have access to restart the web server?

Nick_Zaccardi

Yes I am on a shared host, and don't have access to either the ini file or the reset button

In regards to your snippet, is the first post what you are looking for, or are you looking for something else?

The website is www.xjetva.net

laserlight

In regards to your snippet, is the first post what you are looking for, or are you looking for something else?

I am looking for something that fellow users of this forum can just run to test and see what you are getting at. It should be as simple as possible.

Nick_Zaccardi

The first post is something that I run often on my server...

if i am not mistaken,

$_SESSION['id'] is not the same as $id...

right?

try running this code:

session_start();
$_SESSION[id'] = 5028;
echo $_SESSION['id'] . "\n";
$id = 123;
echo $_SESSION['id'];

That is something that is done often on diffrent pages. The reason is, I use $id as a varialbe from a GET, and the SESSION varaible is set when logged in....

This what you are looking for?

laserlight

The first post is something that I run often on my server...

Right. I tested with $GET and it did not work, but using $SESSION worked. I can duplicate your problem when register_globals is on, but not when it is off, which points directly at register_globals being on as the fault.

if i am not mistaken,

$_SESSION['id'] is not the same as $id...

right?

Apparently, with register_globals on, they are the same. $id is an alias for $_SESSION['id'].

Unfortunately, the register_globals setting cannot be changed at runtime, so you cannot solve your problem with ini_set(). The only way to properly solve your problem is to contact your host and convince them to change register_globals to off.

EDIT:
Slight correction in that you can set register_globals with .htaccess, and perhaps your host will allow this.