I'm using sessions now but I've just realized a potential problem. It's a small job board and the employers have to register and login to post ads, and the job seekers have to register, login and post a resume in order to respond to certain ads.
The employers and the job seekers register their information into their own database table.
I don't fully understand how sessions work. This that I'm using came from a book by Larry Ullman (chapter 13). I have this on my login page:
[PHP]session_start();
if (isset($_SESSION['first_name'])) {
echo "Welcome {$_SESSION['first_name']}!";
}
if (isset($_POST['submitted'])) { // Check if the form has been submitted.
require_once ('./includes/mysql_connect.php'); // Connect to the database.
// Validate the email address.
if (!empty($_POST['email'])) {
$e = escape_data($_POST['email']);
} else {
echo '<p><font color="red" size="+1">You forgot to enter your email address!</font></p>';
$e = FALSE;
}
// Validate the password.
if (!empty($_POST['pass'])) {
$p = escape_data($_POST['pass']);
} else {
$p = FALSE;
echo '<p><font color="red" size="+1">You forgot to enter your password!</font></p>';
}
if ($e && $p) { // If everything's OK.
// Query the database.
$query = "SELECT * FROM users WHERE (email='$e' AND pass=SHA('$p')) AND active IS NULL";
$result = mysql_query ($query) or trigger_error("Query: $query\n<br />MySQL Error: " . mysql_error());
$_SESSION['first_name'] = $row[3];
$_SESSION['user_id'] = $row[0];
$_SESSION['last_name'] = $row[4];
$_SESSION['company_name'] = $row[5];
$_SESSION['email'] = $row[1];
$_SESSION['city_name'] = $row[7];
$_SESSION['stateid'] = $row[8];[/PHP]
The first question I have is, in order for me use this:
[PHP]if (isset($_SESSION['first_name']) && isset($_SESSION['last_name']))
{
echo " {$_SESSION['first_name']} {$_SESSION['last_name']}";
}[/PHP]I'll have to set it upon login like this:[PHP]$_SESSION['last_name'] = $row[4];[/PHP]correct?
Here is where I could have a problem; on top of every page is [PHP]session_start();[/PHP]I don't want a job seeker with the same name as an employer to be able to access the employer area.
How can I ensure this doesn't happen?
Should I change the !isset from this:
[PHP]if (!isset($_SESSION['first_name'])) {
// Start defining the URL.
$url = 'http://' . $_SERVER['HTTP_HOST'] . dirname($_SERVER['PHP_SELF']);
// Check for a trailing slash.
if ((substr($url, -1) =='/') OR (substr($url, -1) == '\\') ) {
// Chop off the slash.
$url = substr ($url, 0, -1);
}
// Redirect to this page if not logged in.
$url .= './../register/login.php';
header("Location: $url");
// Quit the script.
exit();[/PHP]to this:[PHP]if (!isset($_SESSION['first_name']) && (!isset($_SESSION['email'])) {[/PHP]because the email is unique.
The session script I'm using doesn't say to give the cookie a unique name. In fact, the only place it even mentions cookies is on the logout page:[PHP]$_SESSION = array(); // Destroy the variables.
session_destroy(); // Destroy the session itself.
setcookie (session_name(), '', time()-300, '/', '', 0); // Destroy the cookie.[/PHP]
Looks like the cookie name is - session_name. But I use this for both the job seeker area and employer area.
The time is set to -300 or 5 minutes. He doesn't elaberate on what the -300 means, but best I can tell it has something to do with destroying the session after the person logs out. However, I've noticed that if I login and am inactive for 5 minutes I have to log back in. Now this may be a problem say, if it takes me longer than 5 minutes to make a job ad. Will I have a problem when I go to submit the ad only to find I've beed logged out and my all that I entered is gone.
Thanks
DavidPr
