0

所以我让index.php (root)那个用户提交一个表单，它在页面加载时重新生成一个 session_id 并存储在隐藏的输入中。

在root index.php文件中输入数据后，它们将被发送到profile page具有：

session_start(); // Bring in old sessionID
$sess_id = session_id();

// If no sessionID redirect back home.
if(empty($sess_id)) {
  header('Location: ../index.php');   
}

// If don't enter, then reload page, redirect back home
elseif(empty($_POST['firstNm']) || empty($_POST['lastNm'])) {
  header('Location: ../index.php');   
}

// If sessionID first send off this data inputted from ../index.php then regenerate session id and update db
else {  
  // Connect to db
  $_SERVER['DOCUMENT_ROOT'] = 'SiteRoot/';
  // Grabs a new user's : username, pass, email from default [index.php] once submitted
  require_once($_SERVER['DOCUMENT_ROOT'].'cfg/'.'dbi.php');
  require_once($_SERVER['DOCUMENT_ROOT'].'registration/'.'inituserCredentialsGrab.php');

  // After submitting original values, update new session ID in database since original was viewable via source hidden inputs
  require_once($_SERVER['DOCUMENT_ROOT'].'registration/'.'newUserSessIDInitReg.php');
}

这个文件基本上得到了所有的初始输入。获取通过查看源...可见的初始 session_id 并重新生成它。重新生成后提交到数据库。

问题是，如果我转到RELOAD该页面，它似乎又重新生成了 id。我该如何解决这个问题，这样无论我在当前浏览器会话期间刷新多少次，它都不会执行regenerate_id？

4

1 回答 1

0

我会在我的新会话中存储一个标识已经重新生成的标志，并在进入页面时检查它。

例如：

session_start(); // Bring in old sessionID              
$sess_id = session_id();              

// If no sessionID redirect back home.              
if(empty($sess_id)) {              
  header('Location: ../index.php');                 
}              

// If don't enter, then reload page, redirect back home              
elseif(empty($_POST['firstNm']) || empty($_POST['lastNm'])) {              
  header('Location: ../index.php');                 
}              

// If sessionID first send off this data inputted from ../index.php then regenerate session id and update db              
elseif(!isset($_SESSION['already_stored'])){                
  // Connect to db              
  $_SERVER['DOCUMENT_ROOT'] = 'SiteRoot/';              
  // Grabs a new user's : username, pass, email from default [index.php] once submitted              
  require_once($_SERVER['DOCUMENT_ROOT'].'cfg/'.'dbi.php');              
  require_once($_SERVER['DOCUMENT_ROOT'].'registration/'.'inituserCredentialsGrab.php');              

  // After submitting original values, update new session ID in database since original was viewable via source hidden inputs              
  require_once($_SERVER['DOCUMENT_ROOT'].'registration/'.'newUserSessIDInitReg.php');
  $_SESSION['already_stored'] = true;
}

如果更新数据库的代码仍然需要在每次重新加载时运行，那么您可以移动 if 条件以仅围绕会话 id 本身的重新生成。

于 2012-07-24T15:10:00.347 回答