Help with Invision session check

[Fallen_angel]

Hi ,

 

I am making a web app tutorial system and  was hoping someone could help me out with a flaw in my session check code because it is doing something very strange. 

 

Before i go any further I should say that this session check is to check an invision session I have Invision 2.2 on my localhost where I am building the webapp so that could be related to the issue although I don't think it is i thought it was worth a mention .  anyways first the code

 

<?php
include "connect.php";
$mid = intval($_COOKIE['member_id']);
        
      // Look up member
      $result = mysql_query("SELECT m.id, members_display_name, member_login_key, mgroup_others, g.g_access_cp FROM  ibf_members m, ibf_groups g WHERE id = $mid AND m.mgroup = g.g_id");
      $member = mysql_fetch_array($result);
        
    // Name/password matches?
        if (($member['id'] == $mid) and ($member['member_login_key'] == $_COOKIE['pass_hash']))
        {
        
            echo  "<div class='welcome'>Welcome ".$member['members_display_name']."</div><br />";
            return true;

            
        }
        else
        {
        
            echo "<div class='loginmessage'>Welcome Guest.</div><br />";
          
        }
    ?>

 

Anyways onto explaining whats happening,  I by default clear all cookies when i close off my browser  and when I open a fresh copy of a page that is supposed to do a session check it doesn't seem to work , the bellow code is basically supposed to do a session check and then eighther echo , Welcome (username )  if a forum user is logged in , or it is supposed to echo Welcome Guest ,  Instead though for some unknown reason it just echo's Welcome. 

However and this is where it gets weird ,  if I log into my dev version of invision and then go back to the same page it works fine for logged in members and echo's Welcome (Username). So i figured it must be the else part of the statement , but before i fiddled with it i decided to try and use the Delete cookies set by this board function. when I used that function and then went back to my webapp , it echoed Welcome Guest as it should !! Closed my browser and it went back to not working again until I repeat the above steps

 

If someone could tell me what they think is happening here and how to fix it I would really appreciate it

 

 

[hvle]

I think your query is wrong:

SELECT m.id, members_display_name, member_login_key, mgroup_others, g.g_access_cp FROM  ibf_members m, ibf_groups g WHERE id = $mid AND m.mgroup = g.g_id

change to:

SELECT m.id, members_display_name, member_login_key, mgroup_others, g.g_access_cp FROM  ibf_members as m, ibf_groups g WHERE id = $mid AND m.mgroup = g.g_id

[Fallen_angel]

Thanx for picking up on the error but it seems to be working the same way still doing that ,

 

However after being given a bit more time I have come up with the bellow code that checks for the cookie itself first and then echo's what it's supposed to if the user is not logged in , and ofcourse once they login it all works fine already so thats not a problem either

 

If somone could please have a look at what i have now though and see if I have bloated it a bit too much or if they can advise of weaknesses in doing my checking this way I would really appreciate it

 

think I have it but could you guys have a look and see if I am beign a bit sloppy or doing anything un needed here please

 

<?php 
include "connect2.php";

if (isset($_COOKIE['session_id'])) {

$mid = intval($_COOKIE['member_id']);
$ses = intval($_COOKIE['session_id']);

  // Look up member
  $result = mysql_query("SELECT m.id, members_display_name, member_login_key, mgroup_others, g.g_access_cp FROM  ibf_members m, ibf_groups g WHERE id = $mid AND m.mgroup = g.g_id");
  $member = mysql_fetch_array($result);
  
  // Look up session
  $result2 = mysql_query("SELECT id,member_name,member_id FROM  ibf_sessions WHERE member_id= $mid AND  id = $ses");
  $member2 = mysql_fetch_array($result2);

// Name/password matches?
	if (($member['id'] == $mid) and ($member['member_login_key'] == $_COOKIE['pass_hash']))
	{

		echo  "<div class='welcome'>Welcome ".$member['members_display_name']."</div><br />";
		return true;


	}
		else
	{

		echo "<div class='loginmessage'>Welcome Guest.</div><br />";
	  
	}
  }
else
	{

		echo "<div class='loginmessage'>Welcome Guest.</div><br />";
	  
	}

?>

 

 

thanx again to anyone in advance

 

 

[hvle]

um, I still see you did not fix the failed query.

 

...FROM  ibf_members m,...

[HuggieBear]

I think your query is wrong:

Thanx for picking up on the error but it seems to be working the same way still doing that

 

It's not an error.  Table aliases don't need to use 'AS' the same way that column aliases do.

 

Regards

Huggie