Geek Answers Handbook

Poor handling of PHP session variables?

Currently, I use the following code in my cms to check if the visitor is registered as an administrator so that he can edit the current page:

if($_SESSION['admin']=="1") { echo "<a href="foobar/?update">edit</a>"; }

But I worry that the code is unsafe. Is it not possible to change $ _session variables by the user?

What would be safer practice?

+4
source share
5 answers

No, this is a good way to do this. A user cannot change the global $ _SESSION unless he has access to your server. Remember to stay away from cookies on the client side .

To make it even more secure, a good way is to keep the IP address and check that it remains unchanged between each request.

+4
source

The code is fine, you just show the link. Just make sure your UPDATE script is also protected.

+3
source

$_SESSION variables cannot be set by the user. Therefore, the code is great, although usually you ask your backend user (usually only table users, sometimes LDAP) about current user privileges.

+1
source

I found this session security presentation

It explains how to avoid:

  • Session fixation.
  • Session Capture.

Also the slide with additional information has some really product links

+1
source

Session variables should be safe enough after your encoding is safe.

Also use instead. Stops errors with == You should probably also use true, as this is much faster than string comparisons.

 if( "1" === $_SESSION['admin'] )
0
source

More articles:


All Articles