Hi, I've made my first ever log in script, being a newbie to php, and although everything seems to work great every so often my webpage is throwing up this error message:

 

Warning: Unknown: Your script possibly relies on a session side-effect which existed until PHP 4.2.3. Please be advised that the session extension does not consider global variables as a source of data, unless register_globals is enabled. You can disable this functionality and this warning by setting session.bug_compat_42 or session.bug_compat_warn to off, respectively. in Unknown on line 0

 

I'm having trouble figuring out what this means, let alone how to fix it. As far as I can tell it's saying that the way I'm assigning values to session variables is wrong (eg: $_SESSION['username'] = $username) but it's hard to imagine another way to declare them. Also from everything I've read it seems that to enable register_globals is not an option.

 

After much googling the only alternative I could find to using a session is to try and attach information to REQUEST variables, but this seems very messy and the only way I can think how to do it would be to have hidden inputs in every page and have the whole site rely on submit buttons for navigation. Ouch. There must be a better way!

 

Can anyone help?

 

Thanks in advance!

Where is the data for $username coming from?

Are you settiing the session after something has been sent to the browser? Have you checked your scripts locally?

Where is the data for $username coming from?

 

When someone first opens the page, if the session variables for username and password are not set it gives them a login form and ends the script. Once they've entered their details the page reloads and assigns their information, in the form of request variables, to the session variables and then goes on to check that info in a mysql database.

 

I hope that makes sense ... I'm very new to this

Are you settiing the session after something has been sent to the browser? Have you checked your scripts locally?

 

If I understand you right (I'm not sure if I do) then I guess no, the session is first assigned the value of the (initially non-existant) request variable right at the beginning, even before the form has ever been filled in. I'm not sure how you check something locally, but if you mean on my computer then no, I don't have any server software to be able to do that. Not ideal I know ...

can you post or pm your code please?

can you post or pm your code please?

 

Here it is, I hope it's coherent enough to understand ...

 

<?php 
session_start();

if (!isset($_SESSION['username']))
{$username = $_REQUEST['username'];
$_SESSION['username'] = $username;}

if (!isset($_SESSION['password']))
{$password = $_REQUEST['password'];
$_SESSION['password'] = $password;}

?>

<html>
<head>
</head>
<body>

<?php

if (isset($_REQUEST['log_out']))
{unset($_SESSION['username']);
unset($_SESSION['password']);}

mysql_connect("localhost", "dbname", "password") or die(mysql_error());
mysql_select_db("dbname") or die(mysql_error());
$username = $_SESSION['username'];
$result = mysql_query("SELECT * FROM combined WHERE username='$username'");
$row = mysql_fetch_array($result);

if ((!isset($_SESSION['password']))||($row['password']!=$_SESSION['password'])||($_SESSION['password']=="")||($row['active']=="0"))
{include ("form.html");
die;}
else
{$result2 = mysql_query("SELECT type FROM combined WHERE username='$username'");
$row2 = mysql_fetch_array($result2);
$type = $row2['type'];
$_SESSION['type'] = $type;}

if ((isset($_REQUEST['profile']))||(isset($_REQUEST['edit_profile'])))
{include ("edit_profile.php");
die;}

if ((isset($_REQUEST['delete']))||(isset($_REQUEST['submit_delete'])))
{include ("delete.php");
die;}

if ((isset($_REQUEST['event']))||(isset($_REQUEST['submit_event'])))
{include ("add.php");
die;}

if ((isset($_REQUEST['edit']))||(isset($_REQUEST['select_edit']))||(isset($_REQUEST['submit_edit'])))
{include ("edit.php");
die;}


?>

<form action="log_in.php" method="post">
<input class="submit" type="submit" name="event" value="Add Event" /><br />
<input class="submit" type="submit" name="edit" value="Edit Event" /><br />
<input class="submit" type="submit" name="delete" value="Delete Event" /><br /><br />
<input class="submit" type="submit" name="profile" value="Edit profile" /><br /><br />
<input class="submit" type="submit" name="log_out" value="Log Out" />
</form>

</body>
</html>

 

I'm sure it's full of all kinds of other gaping holes and stuff, but like I said it's my first one so be gentle

hmmm... can you try changing $_REQUEST to $_POST and see if that makes a difference?

 

 

the reason i think this might be the case is this bit of the warning..

 

Please be advised that the session extension does not consider global variables [A.K.A $_REQUEST] as a source of data

hmmm... can you try changing $_REQUEST to $_POST and see if that makes a difference?

 

Cool - I'll let you know ..

This bit (that I've spaced out to make it easier to read):

 

if (!isset($_SESSION['username'])) {
$username = $_REQUEST['username'];
$_SESSION['username'] = $username;
}

if (!isset($_SESSION['password'])) {
$password = $_REQUEST['password'];
$_SESSION['password'] = $password;
}

 

is trying to set username and password even before the form has been submitted - so on first page load $_REQUEST['username'] and $_REQUEST['password'] won't have anything in.

 

You need to check that the data you're assigning exists, and I'd recommend using $_POST over $_REQUEST.

Very good point jem!

 

in that case you might want to wrap it around a if $_POST check as done below

 

if(is_array($_POST)){

if (!isset($_SESSION['username'])) {
$username = $_REQUEST['username'];
$_SESSION['username'] = $username;
}

if (!isset($_SESSION['password'])) {
$password = $_REQUEST['password'];
$_SESSION['password'] = $password;
}

}

What you guys said there made a lot of sense, but when I tried it I still got the error.

 

Maybe if I try and make the session data come straight from the table?

well, found this... bit weird... http://bugs.php.net/bug.php?id=41540

 

this may or may not be a php bug of sorts... the below code however should suppress the error at least

<?
ini_set('session.bug_compat_42', 1);
ini_set('session.bug_compat_warn', 0);
?>

Thanks Snider, didn't quite fix the problem, but interesting reading. I'll consider suppressing the error message if I can't find any way of fixing it but that doesn't bode well for the future

 

Thanks for your help

just curious... what version of php are you running?

5 ... although I can't say anything about any numbers that might come after that

Btw, in addition to the problem you're having, you'll need to address this part:

 

$result2 = mysql_query("SELECT type FROM combined WHERE username='$username'");

 

because you're passing unsanitised data to the database.

 

I recommend my own articles (of course ):

http://www.jemjabella.co.uk/articles/php-security-tips

http://www.jemjabella.co.uk/articles/php-security-checklist

I recommend my own articles (of course ):

 

Thanks Jem, I was aware of this but it's in the giant queue of many things that need to be addressed before this could be a real site. I had a look at your articles though and bookmarked them, they were really useful and explained a few things that I've not been able to find out about yet. So thankyou!