Using!isset() on Apache

Used to work on IIS

[Francis]

I have a login_check.php which receives two values from a form. Script is below (well, more or less).

<?php
session_start();
include("settings.php");

if (!isset($member_name) AND!isset($member_pass)) {
echo("<h1>You have not logged in!</h1>");
} else {
$member_name = strtolower($_POST["member_name"]);
$member_pass = strtolower($_POST["member_pass"]);
echo("Processing of logged-in member goes here!");
}

?>

I have inputted the correct member_name and member_pass but the!isset() command always get executed. That means, the "You have not logged in!" always get displayed. The reason why I placed isset() is because if some user immediately goes into the login_check.php without going through the form, they will be informed that they haven't logged in yet.

I previously have IIS and MySQL on WinXP platform, and I don't have any problems there when I log-in.

Now I've experimented a bit (became bolder I guess) and have installed the following, still on WinXP platform however:

1. ActivePerl 5.6.0.623
2. Apache HTTP Server 2.0.48
3. MySQL 3.23.55

Now, the!isset() always get executed even if variables mentioned have been set.

HELP!

[Birdman]

You probably need to access the form variables through the $_POST superglobal.

!isset($_POST["member_name"])

[DrDoc]

You probably need to access the form variables through the $_POST superglobal.

...and I would say that you probably need to access the variables using the $_SESSION superglobal.

if(!isset($_SESSION['member_name']) &&!isset($_SESSION['member_pass'])) {
echo("<h1>You have not logged in!</h1>");
} else {
$member_name = strtolower($_POST["member_name"]);
$member_pass = strtolower($_POST["member_pass"]);
echo("Processing of logged-in member goes here!"); //This is where you process the login, and set the session variables
}

[Francis]

Hey, thanks. That worked. However, I got this warning.

--- Warning: Unknown(): Your script possibly relies on a session side-effect which existed until PHP 4.2.3. Please be advised that the session extension does not consider global variables as a source of data, unless register_globals is enabled. You can disable this functionality and this warning by setting session.bug_compat_42 or session.bug_compat_warn to off, respectively. in Unknown on line 0 ---

I initially wanted to enable the register_globals but saw this warning on the php.ini:

--- You should do your best to write your scripts so that they do not require register_globals to be on; Using form variables as globals can easily lead to possible security problems, if the code is not very well thought of. ---

++ What possible security problems would this cause? How? What does it mean that scripts do not reque register_globals to be on? ++

So I changed both the session.bug_compat_42 and session.bug_compat_warn to off.

++ Would this cause any problems? ++
++ What is the usual configuration (or .ini) of hosting companies when it comes to this part? ++

Can I also do this:

<?php
session_start();
if (!session_is_registered("member_name") AND!session_is_registered("mem_pass") AND

!session_is_registered("valid_member"))
{
$valid_member = "0";
}
include("settings.php");
?>

Lastly, why is it that if I do: ht*p://localhost what appears is a list of the files in that folder because what I want is to automatically run the index file of the site. I still have to type in ht*p://localhost/index.php for me to display the main page.

Thanks again for the patience and help!

[coopster]

++ What possible security problems would this cause? How?

Malicious folk could introduce variables in your script by simply appending them to the query string, etc. For example,

mysite.com?userid=admin&authorized=yes

What does it mean that scripts do not reque register_globals to be on? ++

Your variable processing would require you to extract your <form> variables and otherwise from the Superglobal arrays [php.net] such as

$_GET

and

$_POST

.

So I changed both the session.bug_compat_42 and session.bug_compat_warn to off.

++ Would this cause any problems? ++
++ What is the usual configuration (or .ini) of hosting companies when it comes to this part? ++

Well, it's obviously a security risk or you wouldn't be getting the warning. Usual config? It depends on the hosting company. If they are worth their salt, it should be ON.

Lastly, why is it that if I do: ht*p://localhost what appears is a list of the files in that folder because what I want is to automatically run the index file of the site. I still have to type in ht*p://localhost/index.php for me to display the main page.

The index of a directory can come from one of two sources:

• A file written by the user, typically called

  index.html

  . The DirectoryIndex [httpd.apache.org] directive sets the name of this file. This is controlled by mod_dir [httpd.apache.org].
  
• Otherwise, a listing generated by the server.

Resource: [httpd.apache.org...]

---

Recommended follow-up reading:
Variables from outside PHP [php.net]
Using Register Globals [php.net]