PHP Session Var 不跨页面传输

Question

我有一个连接文件，它包含在我的文件标题中。 header 包含一个 session 开始，我已经检查过跨页面的 session ID 是否相同。我试图在某些 HTML 中回显 $_SESSION['userFirstName'] 以显示用户名。我不明白为什么它是空白的。除了“注意: undefined index :userFirstName

”之外，Chrome 没有任何错误消息

这是我的 connect.php

<?php
/*Login handled here*/
$servername = "localhost";
$usernameDB = "root";
$passwordDB = "";
$nameDB = "teacheasy";

//set user and password to values from form
if ( isset($_POST['username']) && isset($_POST['password']) ) { 
    $user = $_POST['username'];
    $pass = $_POST['password'];
} else {
    echo "The values weren't sent";
}

//connect to the database
$_SESSION['connection'] = new mysqli($servername, $usernameDB, $passwordDB,$nameDB);

//Check if the connection was successful
if($_SESSION['connection']->connect_error){
    die("Connection to the database failed: " . $_SESSION['connection']->connect_error);
} else{
//once the DB is connected, get information from the DB to check the records against the data entered
    $sqlUser = "SELECT `teacher_username` FROM `teacher` WHERE `teacher_username`='$user'";
    $sqlPass = "SELECT `password` FROM `teacher` WHERE `password`='$pass'";
    $resultUser = mysqli_query($_SESSION['connection'], $sqlUser);
    $resultPass = mysqli_query($_SESSION['connection'], $sqlPass);
    $textUser = $resultUser->fetch_assoc();
    $textPass = $resultPass->fetch_assoc();

    //get first name and last name to populate the user
    $sqlUserFirstName = "SELECT `first_name` FROM `teacher` WHERE `teacher_username`='$user'";
    $sqlUserLastName = "SELECT `last_name` FROM `teacher` WHERE `teacher_username`='$user'";
    $resultUserFirstName = mysqli_query($_SESSION['connection'], $sqlUserFirstName);
    $resultUserLastName = mysqli_query($_SESSION['connection'], $sqlUserLastName);
    $_SESSION['userFirstName'] = $_POST[$resultUserFirstName->fetch_assoc()];
    $_SESSION['userLastName'] = $_POST[$resultUserLastName->fetch_assoc()];

    //check if the user and password match records in the database
    if($user == $textUser['teacher_username'] && $pass == $textPass['password']){
        //open the calendar if they match
        echo "<script> window.location.assign('../calendar.php'); </script>";
    } else{
        //set this up to load a log in failed page rather than a blank page with error message
        echo "The data entered has no match.";
    }

}

Answer 1

这是你做的

$user = $_POST['username']
// "SELECT `first_name` FROM `teacher` WHERE `teacher_username`='$user'" // SQL injection here
$_SESSION['userFirstName'] = $_POST[$resultUserFirstName->fetch_assoc()];

正如@jeroen 在评论中所说 $_SESSION['userFirstName']必须为空，因为 $_POST 中没有等于 $resultUserFirstName->fetch_assoc() 的键它返回一个数组! .你应该得到一个 undefined index 错误。

$_POST是一个数组，其中包含已随 http 请求发布到您的服务器的变量。它与数据库查询返回的数据无关，除非 $_POST['username'] === teacher.first_name和 teacher.first_name === teacher.teacher_username

尝试

$_SESSION['userFirstName'] = $resultUserFirstName->fetch_assoc()['first_name'];

代替

$_SESSION['userFirstName'] = $_POST[$resultUserFirstName->fetch_assoc()];

你也容易受到 SQL injection 的攻击攻击，你应该乐于总是使用准备好的语句。检查此答案以了解如何 switch to prepared statements如果您习惯于连接。