Php Problem

fluiduk · 15 Jul 2006 at 14:30

Hi All

Getting somewhere on my site, come accross another little problem though.

This code

Code:

session_start(); 
$newip = $_SERVER['REMOTE_ADDR']; 
if (!isset($_SESSION['username']) ¦¦  
empty($_SESSION['username']) ¦¦ $newip!= $_SESSION['ip']) { 
 include "logout.php"; 
}

is giving me this error

Parse error: parse error, unexpected T_STRING in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\essential\admin\adminmain.php on line 4

Not really sure what the deal is.

Thanks
Aaron

Beansprout · 15 Jul 2006 at 14:50

Replace ¦¦ with ||

fluiduk · 15 Jul 2006 at 15:04

its the same

Una · 15 Jul 2006 at 15:27

PHP:

session_start(); 
$newip = $_SERVER['REMOTE_ADDR']; 

if (!(isset($_SESSION['username'])) || empty($_SESSION['username']) || ($newip!=$_SESSION['ip']))
{ 
          include "logout.php"; 
}

I guess this is what you want.

fluiduk · 15 Jul 2006 at 15:35

Pasted that in and now i get Parse error: parse error, unexpected '{' in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\essential\admin\auth.php on line 5

Tried taking it out and I get a different error

fluiduk · 15 Jul 2006 at 15:37

ps im loading it via an inlcude, ta

Aaron

Beansprout · 15 Jul 2006 at 15:37

Code:

<?php

session_start(); 
$newip = $_SERVER['REMOTE_ADDR']; 

if ( !isset($_SESSION['username']) || empty($_SESSION['username']) || $newip!= $_SESSION['ip'] ) { 
	include "logout.php"; 
}

?>

Should be alright - what's the rest of your code?

Una · 15 Jul 2006 at 15:38

Yeah try again with my edited code or Beansprouts - nerf my bracket matching today

I missed one off my last post.

fluiduk · 15 Jul 2006 at 15:39

that did it beansprout. Thanks guys

Aaron

fluiduk · 15 Jul 2006 at 15:46

only trouble is that people still seem to be able to view the page if they are not logged in which is a tad annoying.

fluiduk · 15 Jul 2006 at 15:59

Also... lol

can anyone spot why this wouldnt work, trying to make it safe from injections

$sql = "select * from adminusers where username='" . addslashes($_POST['username']) . "' and userpass='" . addslashes($_POST['userpass']) . "'" ;

Beansprout · 15 Jul 2006 at 16:08

Don't use addslashes - use mysql_real_escape_string() but also put this at the top of your pages...courtesy robmiller...oh fesk it you haven't read the other thread, which annoys me

In summary you need this part of his post - http://php.robm.me.uk/#toc-MagicQuotes - and the MySQL injection part