如何使用会话代替查询字符串

问题描述：

Using PHP.. I have a small app that I built that currently uses a querystring to navigate and grab data from a database. The key in the database is also in the string and that is not acceptable anymore. I need to change it. I would like to hide the db key and use a session in place of it but I'm not sure how to do that. In fact, there are also other variables in the query string that I would like to use sessions for if at all possible.

page.php?var1&var2&id=1

This is what my string looks like. I am looping through the results in the database and have given each row the id so that when the user clicks the row they want, but I'm not sure how I could do this with a session.

Does anyone have any ideas?

Thanks

EDIT: I'm developing an email type system where senders and recipients are getting and sending mail. Each piece of mail that is stored on the server will have its own unique key. Currently, I am using that number to retreive the message but the problem is that I don't want people to change the number and read other people's mail. I can probably use a GUID for this or even some sort of hash but I really hate long query strings. I was just thinking it would be so much cleaner if there was a way to "hide" the id all together.

使用PHP ..我有一个小应用程序，我构建当前使用查询字符串来导航和从中获取数据数据库。数据库中的键也在字符串中，不再可接受。我需要改变它。我想隐藏数据库密钥并使用会话代替它，但我不知道该怎么做。实际上，在查询字符串中还有其他变量，我想尽可能使用会话。 p>

page.php？var1＆amp; var2＆amp; id = 1 p >

这就是我的字符串的样子。我循环遍历数据库中的结果，并为每行提供了id，以便当用户单击他们想要的行时，但我不确定如何通过会话执行此操作。 p>

有没有人有任何想法？ p>

谢谢 p>

编辑：我正在开发一个电子邮件类型系统，发件人和收件人正在发送邮件。存储在服务器上的每条邮件都有自己唯一的密钥。目前，我正在使用该号码来检索邮件，但问题是我不希望人们更改号码并阅读其他人的邮件。我可以使用GUID这个甚至某种哈希，但我真的很讨厌长查询字符串。我只是觉得如果有一种方法可以将所有ID“隐藏”在一起，那将会更加清晰。 p> div>

答

UPDATED (Again ... Yeah, I know.)

Allowing access to a particular set of data through a $_GET parameter is much more accessible to any user that happens to be using the application.

UPDATED

For storing a private record key, you are probably going to want to use post data, and if you really want it to look like a link, you can always use CSS for that part.

Honestly, the best way to stop people from reading other people's mail is by having a relationship table that says only X person is able to access Y email (by id). That or have a field that says who is the 'owner' of the email.

The fact is that users can still get access to POST parameters, and can easily forge their own POST parameters. This means that anyone could realistically access anyone else's email if they knew the naming scheme.

In an ideal system, there would be a Sender, and a Recipient (The Recipient could be comma separated values). Only the people that are on one of those columns should be allowed to access the email.

How To Use Sessions (From Earlier)

First start off with calling session_start(), and then after that check for variables from previous scripts. If they aren't present, generate them. If they are, grab them and use them.

session_start();

if(!isset($_SESSION['db_key']))
{
    $_SESSION['db_key'] = // generate your database key
}
else
{
    $db_key = $_SESSION['db_key'];
}

Sessions are stored in the $_SESSION array. Whenever you want to use $_SESSION, you need to call session_start() FIRST and then you can assign or grab anything you like from it.

When you want to destroy the data, call session_destroy();

Also check out php.net's section on Sessions

答

There are some examples on how to use $_SESSION on php.

Registering a variable with $_SESSION

答

Your question isn't too clear to me, but I understand it like this:

You need some variables to decide what is being displayed on the page. These variables are being passed in the URL. So far so good, perfectly normal. Now you want to hide these variables and save them in the session?

Consider this: Right now, every page has a unique URL.

http://mysite.com/page?var1=x&var2=y

displays a unique page. Whenever you visit the above URL, you'll get the same page.

What you're asking for, if I understand correctly, is to use one URL like

http://mysite.com/page

without variables, yet still get different pages? That's certainly possible, but that means you'll need to keep track of what the user is doing on the server. I.e. "user clicked on 'Next Page', the last time I saw him he was on page X, so he should now be on page Y, so when he's requesting the site the next time, I'll show him page Y."

That's a lot of work to do, and things can get awkward quickly if the user starts to use the back button. I don't think this is a good idea.

If you need to take sensitive information out of the URL, obfuscate them somehow (hashes) or use alternative values that don't have any meaning by themselves.

It completely depends on your application of course, if the user is accumulating data over several pages, Sessions are the way to go obviously. Can you be a bit more descriptive on what your app is doing?

Edit:

but the problem is that I don't want people to change the number and read other people's mail

If your primary concern is security, that's the wrong way to do it anyway. Security through obscurity is not gonna work. You need to explicitly check if a user is allowed to see a certain piece of info before displaying it to him, not just relying on him not guessing the right id.

答

The issue with using sessions for using it in place of S$_GET or $_POST is that you need some way to read the user's input so that you can store it in the session, and you need a way to trigger a page refresh. Traditional means is via hyperlinks, which defaults to GET (unless you use Javascript) or forms, which defaults to POST.

Maybe ajax will help you here. Once the user has enter info into a form or a checkbox, use JS to send a request to insert the info to the PHP and send info back, whether it is to refresh the page or to fill a with content.

Hope this helps

如何使用会话代替查询字符串

相关推荐