php button session check and allow access

Question

this is not help to me PHP check session, checking multiple variables to allow access to specific pages

PHP if condition number issue [duplicate]

i try simple php CRUD with session user.php if login usercan only access ore its print error but this is user.php top lines

<?php include('server.php') ?>
<?php

if(!isset($_SESSION['name'])){
// header("Location:login.php");
echo "nee to login to access this page" ;

exit;
session_destroy();
}
?>

and this my delete button code

<a href="server.php?delete=<?php echo $row['id'];?>" class ="btn btn-danger" > delete </a>

when this button gt clicked ip/user.php?delete=id (id get from data base) when with out login when type this ip/user.php?delete=20 its delete from data base how can i stop that?

its my server.php for delete

if (isset($_GET['delete'])) {
    $id = $_GET['delete'];
    $qry = "DELETE FROM crud WHERE id=$id" ;
    mysqli_query($conn, $qry);

    $_SESSION['message'] = "recoard deleted success";
$_SESSION['msg_type'] = "danger";
header('location: user.php');
}

So its like without login if you try to hit the URL then it gets deleted right? — Bits Please
– Bits Please, Commented Nov 30, 2018 at 7:51
no i just type url ip.user.php?delete=20 its day error but its delete from data bases — user8337986
– user8337986, Commented Nov 30, 2018 at 7:58
if user not login theycat access user.php but itf the directy type user.php?delete=10 its delete — user8337986
– user8337986, Commented Nov 30, 2018 at 8:07

Bits Please · Accepted Answer · 2018-11-30 08:08:16Z

1

//on the top of page check session is set or not
session_start();
if(isset($_SESSION) && isset($_SESSION['name']))
{
   if (isset($_GET['delete'])) 
  {
    $id = $_GET['delete'];
    $qry = "DELETE FROM crud WHERE id=$id" ;
    mysqli_query($conn, $qry);

    $_SESSION['message'] = "recoard deleted success";
    $_SESSION['msg_type'] = "danger";
    header('location: user.php');
  }
}
else
{
  echo 'cant access this page you need to login first';
}

if you still face issue try to print $_SESSION array and check does sesison really gets destroy?

If not then on logout.php

unset($_SESSION['name']);
session_destroy();

edited Nov 30, 2018 at 8:08

answered Nov 30, 2018 at 7:58

Bits Please

9071 gold badge7 silver badges23 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Bits Please Over a year ago

So on that page try to print_r($_SESSION) and check if yoy really get those values? If not then you might have issue for logout as session is not destroying...

Collectives™ on Stack Overflow

php button session check and allow access

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related