On Tue, Aug 14, 2001 at 08:42:22AM -0300, Christian Dechery wrote:
> I have pages that uses session for security that looks something like this:
> 
> <?php
>       session_start();
> 
>       if( !isset($uid) )
>       {
>               include("include/auth.inc.php");
>               auth_user();
>       }
> 
>       more code...
> ?>
> 
> so $uid tells me if the user is logged on or not...
> 
> but what if somebody calls the script directly from the address bar like 
> this: http://server/script.php?uid=10
> 
> wouldn't this be a security problem?


Christian,

This can indeed be a security issue. Try using
$HTTP_SESSION_VARS{"uid"} instead. It's a saver solution. Then one
cannot just use ?uid=10 in order to fool you. At least, not in that
way.

-- 

* R&zE:

-- 
-- Renze Munnik
-- DataLink BV
--
-- E: [EMAIL PROTECTED]
-- W: +31 23 5326162
-- F: +31 23 5322144
-- M: +31 6 21811143
-- H: +31 23 5516190
--
-- Stationsplein 82
-- 2011 LM  HAARLEM
--
-- http://www.datalink.nl
-- 

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
To contact the list administrators, e-mail: [EMAIL PROTECTED]

Reply via email to