Php session variable bug

Question

There is a problem with session variables in my web-application. I have several types of documents, when user want to edit it, he pushes a button and php record number of document to $_SESSION['patent_number'] via GET method. All fine when launch application. I test it with 2 documents with 2 different numbers. In the begining all works fine, but then it seems that session variable is not changed and i see document with another number.

When user click "Edit" button, he sends a document number to patent_load.php, and it's always correct loading:

var patent_number=$(this).val();
$('#user_input_text').load('pages/patent/patent_load.php?section=patent_claims&patent_number='+patent_number);

But when i click to the section of document from menu, there appears old session number:

$('#user_input_text').load('pages/patent/patent_load.php?section=patent_claims');

Here is a patent_load.php:

session_start();
session_regenerate_id();

if (isset($_SESSION['id'])){

    $db=new mysqli('X','X','X','X');    
    $db->set_charset("utf8");

    $section=$_GET['section'];
    if(isset($_GET['patent_number'])){
        $number=$_GET['patent_number'];
        $_SESSION['patent_number']=$number;
        echo 'get is set';
    }
    $patent_number=$_SESSION['patent_number'];

        $query="select $section from new_patent_document where patent_number='$patent_number'";
        $result=$db->query($query);
        $row=$result->fetch_assoc();
        echo $patent_number.', ';
        echo $row[$section];

Any ideas how can i solve it and why session variable isn't updated. Thanks in advance.

Your code is very vulnerable to SQL injection! Take a look at PHPs PDO and its prepared statements. — jwueller
– jwueller, Commented Sep 27, 2010 at 9:51
@elusive Thanks for comment. When i solve this problem, i will implement prepared statements — dsplatonov
– dsplatonov, Commented Sep 27, 2010 at 9:56
What do you mean by, "there appears old session number". Does it get set once and then never again? Always show the previous to correct id? And are you referring to the patent_number of the actual SESSION number? — Steve Claridge
– Steve Claridge, Commented Sep 27, 2010 at 10:14
Try a var_dump( $_SESSION ) to see what you have at each point — Steve Claridge
– Steve Claridge, Commented Sep 27, 2010 at 10:16

Quamis · Accepted Answer · 2010-09-27 11:10:17Z

2

Check if the browser caches the requests you make via GET. I don't know how your app is designed, but if you use the "back" button from the browser(or via javascript) you will encounter this situation.

answered Sep 27, 2010 at 11:10

Quamis

11.2k13 gold badges54 silver badges67 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Spudley Over a year ago

It's a good point. When I had a similar issue in the past, I ended up adding a random element to the query string to make sure it didn't trigger any caches. A bit of a crude method, but it worked when I needed a quick-n-easy fix.

Quamis Over a year ago

you may use POST instead of GET if you dont want to add random value to the query... but using random values is the way to go as far as i know.

Sathia Musso · Accepted Answer · 2010-09-27 09:52:24Z

0

are you sure patent_number is a real number? have you tried

$query="select $section from new_patent_document where patent_number='$patent_number'";

die($query);

answered Sep 27, 2010 at 9:52

Sathia Musso

2,2504 gold badges25 silver badges42 bronze badges

1 Comment

dsplatonov Over a year ago

Yea, here is output: select patent_claims from new_patent_document where patent_number='5'

Collectives™ on Stack Overflow

Php session variable bug

2 Answers 2

2 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related