I start sessions on all pages with:
- ob_start();
-
session_start();
at the top of the page before anything else.
When I login these sessions are set:
- $query = "SELECT *
-
FROM users
-
WHERE (email='$e' AND pass=SHA('$p'))
-
AND active IS NULL";
-
$result = mysql_query ($query);
-
if (@mysql_num_rows($result) == 1) {
-
$row = mysql_fetch_array ($result, MYSQL_NUM);
-
$_SESSION['user_id'] = $row[0];
-
$_SESSION['display_name'] = $row[3];
-
-
// Start defining the URL.
-
$url = './../members/main.php';
-
-
ob_end_clean(); // Delete the buffer.
-
header("Location: $url");
-
exit();
-
}
OK, I'm logged in. It's a recipe website and I migrate to a page that has a list of Beef recipes. I click on one and on the page displaying the recipe it shows the person who submitted the recipe's display name, e.g. Martha
Next to Martha's name is a link that says Click Here to see all my recipes. Here's the link:
- <a href='all_user_recipes.php?file=$user_id'>Click Here</a>
To display the recipe a query is ran that pulls the recipe from the
recipes table: recipe_id, c_id, user_id, recipe_title, ingredients, directions, notes, viewed, r_allow, submitted
The user_id is set in the users table when the person registered. The user_id is entered into most of the tables on this website.
Here's where things get screwy.
When I click on the link to see all of Martha's recipes, a query is ran that pulls all the recipes from the database that correlates with Martha's user_id. At the same time - my session is now populated with Martha's information. At the top of the screen where it used to say Hello, David P (my display_name, which was set in a session when I log in) --- now says, "Hello, Martha". When I go to the user Control Panel it is Martha's account that I'm in. I can change her password and delete all her recipes if I had a mind to.
I can change from Martha to someone else just by clicking on the link to see all of their recipes. It's as if the page variable ($user_id) is changing the session variable ($_SESSION['user_id']).
My server uses PHP Version 4.4.9
On the same page that displays the recipe along with the link to see all that person's recipes, is a link that allows me to add that recipe to my "favorite recipes box". This is just a table (favorite_recipes) that has 2 rows - recipe_id and user_id.
How it is suppose to work is that when I click on the "Add to Favorite Recipe Box" a page opens that takes my user_id ($_SESSION['user_id']) and that recipe's recipe_id ($recipe_id) and inserts it into the favorite_recipe table and gives me a happy message saying it's been added:
- $recipe_id = $_GET['recipe_id'];
-
$query = "INSERT INTO favorite_recipes (user_id, recipe_id)
-
VALUES ('".$_SESSION['user_id']."', '$recipe_id')";
-
$result = mysql_query($query);
-
if ($result) {
-
echo "Hurray! The recipe is added!";
-
} else {
-
echo "Too Bad. Recipe not added.";
-
}
What actually happens is that the recipe owner's user_id is entered instead of my session user_id and it changes my current session ($_SESSION['user_id']) and ($_SESSION['display_name']) - be it me or the person who I viewed all their recipes -- to the person whose recipe I just saved in my favorite recipe box. I am now them and when I go to the control panel I am in their account and once again can do mischief if I've a mind to.
So, it seems that whenever I click on a link my session changes. I don't get this. Any ideas?
