echo whats in a session variable

deansaddigh · November 21, 2009

is this the correct way to echo whats in my session .

i basically want to greet the user with there name

echo $_SESSION['username'];

cags · November 21, 2009

Why not just test it? But yes it is.

waynewex · November 21, 2009

Yes. But make sure that you use htmlentities in order to sanitise your output. You don't want the user entering HTML or JavaScript as their username, only to see it being executed everytime your script outputs the username.

echo htmlentities($_SESSION['username'],ENT_QUOTES,"utf-8");

You should also make sure that the session variable actually exists:

<?php
if(isset($_SESSION['username'])){
     //print it out
}
?>

cags · November 21, 2009

Since you should be controlling what goes into the $_SESSION array (sanitizing it before hand) that should never be an issue.

deansaddigh · November 21, 2009

i did test it and it didnt work, i should of said my bad

:-[

heres my session start

<?
session_start();
if(!$_SESSION['username'] ){
header("location:login.php");
}

here is where the sessions get created

// Register $myusername, $mypassword and redirect to file "login_success.php"
			$_SESSION['username']; 
			$_SESSION['password']; 
			header("location:add_product_form.php");

any ideas?

waynewex · November 21, 2009

Since you should be controlling what goes into the $_SESSION array (sanitizing it before hand) that should never be an issue.

I'm guessing that the OP is only new to PHP and therefore doesn't know much about common security risks such as XSS.

cags · November 21, 2009

$_SESSION['username'];
$_SESSION['password'];

Doesn't do a great deal you should be doing something along the lines of...

$_SESSION['username'] = 'Bob';

etc.

waynewex · November 21, 2009

To assign a variable to a $_SESSION variable, you need to do something like this:

<?php
//assuming $username has been gotten from the DB
$_SESSION['username'] = htmlentities($username,ENT_QUOTES,"utf-8");
?>

In your code, you're not assigning anything to your session variables.

deansaddigh · November 21, 2009

ok i am new so bare with me, i changed the session to hold the variables.

//Provent sql injections
			$username = stripslashes($username);
			$password = stripslashes($password);
			$username = mysql_real_escape_string($username);
			$password = mysql_real_escape_string($password);

			//Sql
			$query="SELECT * FROM users WHERE UserName='$username' and Password='$password'";
			$result=mysql_query($query);

			// Mysql_num_row is counting table row
			$count=mysql_num_rows($result);
			// If result matched $myusername and $mypassword, table row must be 1 row

			if($count==1){
			// Register $myusername, $mypassword and redirect to file "login_success.php"
			$_SESSION['username'] = '$username';
			$_SESSION['password'] = '$password'; 
			header("location:add_product_form.php");
			}
			else {
			echo "Wrong Username or Password";
			}
			?>

im assuming those sessions should hold their username and password now, but i am still getting an error

PFMaBiSmAd · November 21, 2009

but i am still getting an error

And how would anyone be able to help you with that error or find what is causing it unless you post the error.

cags · November 21, 2009

PHP doesn't evaluate variables stored in a string delimited by single quotes, so...

$_SESSION['username'] = '$username';
$_SESSION['password'] = '$password';

Will result in a username of $username and a password of $password.

waynewex · November 21, 2009

Change

$_SESSION['username'] = '$username';
$_SESSION['password'] = '$password';

to

$_SESSION['username'] = $username;
$_SESSION['password'] = $password;

In your code, you're encapsulating your variables in single quotes. In PHP, single quotes will give you the literal of what is between those single quotes, meaning your username and password session variables will always literally be $username and $password and not what is actually in those variables. As opposed to double quotes.

Also - why are you storing their password in a session variable? That is a major security concern.

deansaddigh · November 21, 2009

thanks for the help.

I will kill the password session

thanks again guys

deansaddigh · November 21, 2009

ok i have changed it all.

so my pages are as follows

process login

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<?php
include '../includes/connection.php';
?>

<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<link rel="shortcut icon" href="../images/animated_favicon1.gif" />
<link rel="stylesheet" type="text/css" href="../css/layout.css" /> 



<title>Nextdayfrags.co.uk</title>
</head>

<body>
<!--wrapper to hold site-->
    <div id="wrapper">
    	
      <!--Logo holder-->
      <div id="header"></div>
        
        <div id="left">
       		<div class="nav">    
       			  	
	        	<ul>
					<li><a href="#">SPS frags</a></li>
					<li><a href="#">LPS frags</a></li>
					<li><a href="#">Soft Coral frags</a></li>
					<li><a href="#">Coral Frag packs</a></li>
					<li><a href="#">SPS Coral Colonies</a></li>
					<li><a href="#">LPS Coral Colonies</a></li>
	        		<li><a href="#">Anemones</a></li>
	        		<li><a href="#">Clean Up Critters/ Inverts</a></li>
	        		<li><a href="#">Coral Food</a></li>
	        		<li><a href="#">Reef Accesories</a></li>
	        		<li><a href="#">Gift Vouchers</a></li>
	        	
				</ul>
        	<div align="center">
        	 
			 <img src="images/paypal.png"/> 	
        		 
        	</div>
        	</div>
        </div>
        
        	<div id="right">
        
        		<?php
        		//Store details in variables 
        		$username=$_POST['username'];
			$password=$_POST['password']; 

			//Provent sql injections
			$username = mysql_real_escape_string($username);
			$password = mysql_real_escape_string($password);

			//Sql
			$query="SELECT * FROM users WHERE UserName='$username' and Password='$password'";
			$result=mysql_query($query);

			// Mysql_num_row is counting table row
			$count=mysql_num_rows($result);
			// If result matched $myusername and $mypassword, table row must be 1 row

			if($count==1){
			// Register $myusername, $mypassword and redirect to file "login_success.php"

			$_SESSION['username']= $username;
			header("location:add_product_form.php");
			}
			else {
			echo "Wrong Username or Password";
			}
			?>





        	
		</div>
          		



          
          
            
           
            
      
        
      
</div>
    
    
   

</body>
</html>

page where i actually use the session to print out username

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<?
session_start();
if(!$_SESSION['username'] ){
header("location:login.php");

}




?>


<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<?php
include '../includes/connection.php';
?>

<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<link rel="shortcut icon" href="../images/animated_favicon1.gif" />
<link rel="stylesheet" type="text/css" href="../css/layout.css" /> 


<title>Nextdayfrags.co.uk</title>
</head>

<body>
<!--wrapper to hold site-->
    <div id="wrapper">
    	
      <!--Logo holder-->
      <div id="header"></div>
        
        <div id="left">       		 
       <div align="center">	
       	<img src="../images/paypal.png" alt="Paypal verified" /> 
       </div>
        </div>
        
        <div id="right">
   			
   			<?php 
   				
   				echo 'welcome';
   				echo $_SESSION['username'];
   				
   			$message = $_GET["message"];
   			
   			
   				if ( $message != "" )
   				{
   				echo $message;
   				}
   			
   			?>
   			
   			
		<form id="form" name="form" method="post" enctype="multipart/form-data" action="../admin/process_product.php">
		<fieldset>
		<legend>Use this form to add a product</legend>
		<h1>Add Product</h1>
		<p>Please use this form to add a product</p>

		<label>Product Name</label>
		<input type="text" name="name"/><br /><br />


		<label>Product Catagory</label>
		<select name ='category'>
		  <option>LPS frags</option>
		  <option>SPS frags</option>
		  <option>Soft Coral frags</option>
		  <option>Coral Frag packs</option>
		  <option>SPS Coral Colonies</option>
		  <option>LPS Coral Colonies</option>
		  <option>Anemones</option>
		</select><br /><br />

		<label>Product Quantity</label>
		<input type="text" name="quantity"/><br /><br />

		<label>Product Price</label>
		<input type="text" name="price"/><br /><br />

		<label>Product Description</label>
		<textarea cols="30" rows="4" name="description"></textarea><br /><br />

		 <input type="hidden" name="MAX_FILE_SIZE" value="500000000" />
             <label>Add Picture:</label>  <input name="uploadedfile" type="file"  /><br /><br />
            	
             <label>Video Embed code</label>
		<textarea cols="30" rows="4"  name="video"></textarea><br /><br />
            			
		<button type="submit" class="submit">Add Product</button>

		</fieldset>
		</form>

	</div>
   			
        	
       
          		
     </div>        
      

    
    
   

</body>
</html>

But i am now getting this error

Notice: Undefined variable: _SESSION in C:\wamp\www\Php Shoping cart\admin\add_product_form.php on line 48

I appolagise for my poor coding skills, and thanks for your patiance

waynewex · November 21, 2009

You must include the function

session_start();

at the top of your pages in order for sessions to work properly.

deansaddigh · November 21, 2009

I have included this on the page

waynewex · November 21, 2009

You have.... AFTER output. Put session_start() at the very start of the page. Not after you output HTML etc.

jamesxg1 · November 21, 2009

Hiya,

I'm not that good at php but from what i do know apparently you should not use short tags.

<?
session_start();
if(!$_SESSION['username'] ){
header("location:login.php");

}


   

?>

to

<?php session_start();

if(!$_SESSION['username'] ){
header("location:login.php");

}
?>

James.

Sign In

echo whats in a session variable

Recommended Posts

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Join the conversation

Important Information