2011-07-15 197 views
0
//Check against CSFR here 
      $key = md5(uniqid(rand(), TRUE)); 
      //$key = "234"; //using this works but not the idea 
      $_SESSION['key'] = $key; 


//form 
<form method="post" action="<?php echo HTTPF; ?>/complete_reg"> 
     <p> 
      <label> 
       <b>Email address:</b><br /> 
       <input type="text" id="user_email" name="user_email" value="" class="register_email" onblur='$("#checkid").html("Please wait..."); $.get("er_checkuser.php",{ cmd: "check", check_key: $("#check_key").val(), user: $("#user_email").val() } ,function(data){ $("#checkid").html(data); });' /> 
      </label> 
      <input type="hidden" id="check_key" name="check_key" value="<?php echo $key; ?>" /> 
      <span style="color:red; font: bold 12px verdana; " id="checkid" ></span> 

     </p> 

//calling page 
//er_checkuser.php 
foreach($_GET as $key => $value) { 
    $get[$key] = filter($value); 
} 

//For some reasons I don't know why the values are not the same but they should be 
if ($get['check_key'] == $_SESSION['key']) 

{ 

    echo $_SESSION['key']; 
    echo "<br>"; 
    echo $get['check_key']; 
} 
+2

我無法在任何地方看到session_start()... –

+0

頁面開頭處有session_start()(未顯示) –

回答

1

在使用$ _SESSION數組之前調用session_start()嗎?

+0

請確保在每個要使用的頁面上調用session_start() '$ _SESSION'變量。 –

2

啊我想我知道問題出在哪裏:你在每一頁上重新加載創建一個新的密鑰。因此,您在提交表單時也會創建一個新密鑰。

你應該做的是:

if(!isset($_GET['check_key']) { 
    $key = md5(uniqid(rand(), TRUE)); 
    $_SESSION['key'] = $key; 
} 
+0

當我這樣做時,$ get ['check_key']在調用頁面上沒有值。 –