Jump to content


Photo

Functions and $_SESSION


  • Please log in to reply
2 replies to this topic

#1 mewhocorrupts

mewhocorrupts
  • Members
  • PipPipPip
  • Advanced Member
  • 36 posts
  • LocationParker, CO

Posted 07 August 2006 - 12:04 AM

I'm creating a site that utilizes the $_SESSION global heavily.  I understand, in general, what it takes to make proper use sessions, insomuch as initialization, registering variables, and then assigning them.  My question lies in whether or not it is possible, and if so, safe from a security point of view, to call a function from an included file that uses values stored in the user's session.

For example:

<?php
session_start();

// Here we have some DB work, but the final product is the index of the user's record in MySQL...

$ret = setLoginDBVars($index);
?>

And in the included file:

<?php
function setLoginDBVars($uid)
{
    $db = new mysqli($GLOBALS['DB_SERVER'],$GLOBALS['DB_USER'],$GLOBALS['DB_PASS'],$GLOBALS['TBL_USERS']);
    $dbq = "SELECT ";   // I'll have to get this from the DB structure.
    $res = $db->query($dbq);
    $row = mysqli_fetch_array($res, MYSQLI_ASSOC);
    
    foreach($row as $key => $val)
	{
		session_register($key);	// Register $key (col name) with the session.
		$_SESSION[$key][$val];	// Dump all values into session global.
	}
	
	return true;
}
?>

I don't have the database set up yet on my host, so the SELECT statement in the above code is obviously invalid.  This is also the reason that I haven't live-tested yet to see the errors.  In any case, will this be a valid function?
-mewhocorrupts

#2 trq

trq
  • Staff Alumni
  • Advanced Member
  • 31,041 posts

Posted 07 August 2006 - 01:26 AM

Yes. It is perfectly exceptable code and in fact even good practice to break your code into functions. Are you aware however the session_register has long been deprictaed and unless your running a pretty old version of php is no longer required?

#3 mewhocorrupts

mewhocorrupts
  • Members
  • PipPipPip
  • Advanced Member
  • 36 posts
  • LocationParker, CO

Posted 07 August 2006 - 03:32 PM

Yes. It is perfectly exceptable code and in fact even good practice to break your code into functions. Are you aware however the session_register has long been deprictaed and unless your running a pretty old version of php is no longer required?


I was actually not aware of that.  Thanks for the info, I'll drop it from my code.

Much appreciated.
-mewhocorrupts




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users