Question

0

Hey everyone,

I am using the PHP in_array() function in order to authenticate (with sessions) if a user can access a particular page. For some reason, it is not working...

PHP PAGE

session_start();
require_once('../scripts/functions.php'); 
$role_auth = @$_SESSION['role_auth'];
access($role_auth, array(0,1,2,3,4));

access FUNCTION

function access($role_auth, $array){

if(!(in_array($role_auth, $array))){ 
   header("Location: ../index.html");
}
}

If I insert print statements in the function, I can see that all of the correct values are being passed into the function. The problem is, if the function is called without a session variable set, for some reason it is considered as being in the array, and it authenticates.

Any ideas?

edited Jul 1 at 16:10

asked Jul 1 at 16:05

behrk2
536●12

75% accept rate

2

Just a tip, you can use range(0,4) instead of array(0,1,2,3,4). php.net/range – tj111 Jul 1 at 16:14

1

A quick note on your security check. Make sure you call die() or exit() after you send the header, because the content afterward in the script will still be send. – merkuro Jul 1 at 16:21

Jason · Answer 1 · 2009-07-01 16:11:25Z

you may want to enable strict type checks by using:

in_array($role_auth, $array, true)

as what is likely happening is that $role_auth is being eval'd as false and that could match 0 in your in_array statement.

what you SHOULD be doing is this:

session_start(); 
require_once('../scripts/functions.php'); 
$role_auth = (isset($_SESSION['role_auth']))?$_SESSION['role_auth']:-1; 
access($role_auth, array(0,1,2,3,4));

or something similiar. nothing good ever comes of using the @ operator

Cfreak · Answer 2 · 2009-07-01 16:09:13Z

I would check to see if $_SESSION['role_auth'] is actually set (with isset) instead of using @ to suppress warnings (which is bad practice IMHO)

I think what's happening is that false == 0 ... so in_array returns true when nothing is in $role_auth because it sees it as 0 and 0 is in your array

Tom Ritter · Answer 3 · 2009-07-01 16:10:00Z

 $role_auth = @$_SESSION['role_auth'];

The @ sign is suppressing any warnings you might get here, like index is not in array. How about something like this instead:

 if(isset($_SESSION['role_auth']))
    $role_auth = $_SESSION['role_auth'];
 else
    $role_auth = -1;//(or whatever an invalid role is)

Noah Medling · Answer 4 · 2009-07-01 16:13:22Z

In php, the number zero is considered equal to most non-numeric things, for example:

null   == 0
false  == 0
""     == 0
"asdf" == 0

You probably need to make sure that $_SESSION actually contains the 'role_auth' key beforehand and convert it to the appropriate type, also passing the $strict parameter to in_array, thus guaranteeing a type check as well as a value check (=== vs. ==). Removing zero from your array might also be a good idea.

PHP in_array not working

PHP PAGE

access FUNCTION

4 Answers

Your Answer

Not the answer you're looking for? Browse other questions tagged php session php-in-array or ask your own question.

Hello World!

Related