0

When user login and all conditions are fulfill script save correct data to session.

if (pass == passinput && name ==nameinput) 
    $_SESSION['user_id'] = $data['user_id'];

And here is code where is problem..

if(isset($_SESSION['user_id'])) {

            $result = mysql_query("SELECT zustatek,nick,datumregistrace,ip FROM uzivatele WHERE user_id = '".mysql_real_escape_string($_SESSION['user_id'])."'");
            $data = mysql_fetch_array($result);
            echo "<div class='bg-danger kkt' align='center'>Vítej, <b>".$data['nick']."</b>";
            echo "<BR>Zůstatek:<b>".number_format($data['zustatek'])."$</b>";
            echo "<BR>Tvá IP adresa:<b>".$data['ip']."</b>";
            echo "<BR>Datum registrace:<b>".date_format($data['datumregistrace'],'U = Y-m-d H:i:s')."</b>";
            echo "<BR><a href='?logout'>Odhlásit</a>";
            echo "</div>";

After correct login are data announced, that is correct, but after reload page data disappear and appears empty values.. When i use prin_r($_SESSION) session contain save values from form but sql query doesnt work.

Jay Blanchard
  • 34,243
  • 16
  • 77
  • 119
flux
  • 9
  • 1
    If you can, you should [stop using `mysql_*` functions](http://stackoverflow.com/questions/12859942/why-shouldnt-i-use-mysql-functions-in-php). They are no longer maintained and are [officially deprecated](https://wiki.php.net/rfc/mysql_deprecation). Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) [statements](http://php.net/manual/en/pdo.prepared-statements.php) instead, and consider using PDO, [it's really not hard](http://jayblanchard.net/demystifying_php_pdo.html). – Jay Blanchard Sep 14 '15 at 17:12
  • 1
    [Your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) – Jay Blanchard Sep 14 '15 at 17:13
  • 1
    You really should use PHP's [built-in functions](http://jayblanchard.net/proper_password_hashing_with_PHP.html) to handle password security. If you're using a PHP version less than 5.5 you can use the `password_hash()` [compatibility pack](https://github.com/ircmaxell/password_compat). – Jay Blanchard Sep 14 '15 at 17:14
  • 3
    stop assuming your query succeeded. `$result = mysql_query(...) or die(mysql_error())`. never EVER assume success when dealing with external resources. always assume failure and treat success as a pleasant surprise. – Marc B Sep 14 '15 at 17:15
  • thanks guys i forget use function for db connect... i have one more question... how user can use sql injection in this script and how i can protect this problem? – flux Sep 14 '15 at 17:27
  • 1
    @flux The best method is as Jay suggests: Avoid using `mysql_query`, **do** use prepared statements. That fixes all your injection problems if applied in a disciplined manner. – tadman Sep 14 '15 at 17:30

0 Answers0