本地变量会干扰$ _SESSION变量？

Question

以下代码在随机页面上的输出是:

            print $_SESSION['uid']; // logged in user
        // Get Data .
        $uid = $_GET['ID']; // part of random page processing
            print $_SESSION['uid'];

是:

1
2

我登录的用户ID正在改变!:@

登录(验证)页面的代码如下所示:

        // Authenticate
        $query = "SELECT * FROM User WHERE Email = '".$Email."' AND Password = '".$Password."'";
        $result = mysql_query($query);

        // Authenticated?
        if(mysql_num_rows($result)) {
            // Yes

            // Set session Vars
            $uid = mysql_result($result,0,ID);
            $Access = mysql_result($result,0,Access);

            session_destroy();
            session_start();
            $_SESSION['loggedIN'] = 1;
            $_SESSION['Access'] = $Access;
            $_SESSION['uid'] = $uid;

            // Print a successful login and redirect

Answer 1

你所看到的是一种副作用register_globals.基本上:

$uid

和

$_SESSION['uid']

当你这样做时,引用相同的变量:

$uid = $_GET['ID'];

它相当于:

$SESSION['uid'] = $_GET['ID'];

我的建议？关闭寄存器全局变量.它已在PHP 5.3中弃用,将在PHP 6中删除.要关闭它,请编辑php.ini文件并更改为此指令:

register_globals = Off

然后重启Apache(或任何你的Web服务器).