Question

function StoreUserProfileInSession( $username, $password )
{
        session_start();
        $query = pg_query( "SELECT * FROM mytable where username = '$username' AND password = '$password'" );

        $rows = pg_fetch_array( $query );

        foreach( $rows as $key => $value )
        {
            if( $key == 'password' ) //do not store password in session because it's DANGEROUS!
                continue;

            $_SESSION[$key] = $value;
        }
}

After this function is being called i am redirected to my frontend.
When I try to print_r($_SESSION); in there I only got a one value in session, and that is the user_id, I have many fields in my table.

Why am I only getting one value? what’s wrong with this?

Any help or idea would be greatly appreciated and rewarded!
Thanks! 🙂

Answer 1

Two things:

1. pg_fetch_array() is not returning what you expect.
2. $_SESSION cannot have any key name that could not also be a php variable name.

$rows looks like this:

$rows = array(
    'user_id' => 1
    1,
    'password' => 'THE PASSWORD',
    'THE PASSWORD',
);
$rows['user_id'] === $rows[0];
// etc

Thus in your foreach loop, right after the user_id key, you are actually doing this:

$_SESSION[0] = 1;

This is illegal, so the session object stops working.

Instead do this:

// PGSQL_ASSOC says, "only return named keys, not numeric keys"
$therow = pg_fetch_array($query, null, PGSQL_ASSOC);
unset($therow['password']);
$_SESSION['user'] = $therow;
pg_free_result($query);


// get user data like this:
$_SESSION['user']['user_id']