Sessions Struggles - PHP

Question

对于我的应用程序，有三个级别的用户：

• 顶级（00）
• mid“district”level
• 较低级别

构建的界面允许用户创建将分发到移动应用程序的消息。

我让它工作正常，但后来被委任添加中级。现在，即使消息看起来正确更新，我遇到的问题是，我收到“您无权访问此页面”消息，而不是在提交消息后显示“消息已更新”和表单

这不会发生在中/区级别，只会发生在较低和较高级别。有些原因，对于这两个，在提交表单后它没有正确读取$_SESSION['store']（虽然它在正常加载页面时按预期工作，而不是通过POST）。

我非常感谢任何指导：

 <?php
session_start();

function format($input) {
$input = trim($input);
$input = stripcslashes($input);
$input = htmlspecialchars($input);
return $input;
}
 $con = new PDO("sqlite:managers.db");
$store = $_SESSION['store'];
$stores;
$file;
$district;


$file = "messages/" . $store . ".txt";

if(!file_exists($file)) {
$temp = fopen($file, "w"); // create file
fclose($temp);
}


if(strpos("d", $store) == 0) { 
$district = true;
$sql = "SELECT district FROM managers WHERE store = '$store'";
$statement = $con->query($sql);
$row = $statement->fetch();
$storesArray = explode(",", $row[0]);
}



if($_SERVER['REQUEST_METHOD'] == 'POST') {

$newMessage = format($_POST['message']);


$writer = fopen($file, "w");
fwrite($writer, $newMessage);
fclose($writer);


if($district) {
foreach($storesArray as $store) {
$fileName = "messages/d" . $store . ".txt";

if(!file_exists($fileName)) {
$temp = fopen($fileName, "w"); // create file
fclose($temp);
}

$writer = fopen($fileName, "w");
fwrite($writer, $newMessage);
fclose($writer);

}
}
}


$handler = fopen($file, "r");

$currentMessage = fread($handler, filesize($file));
fclose($handler);



?>


// some code omitted //



<?php 
if($store == "" || $store == null) {
echo "<p>You do not have permission to view this page</p>";
} else {


echo "<h2>Manage Messages";  if($store == "00") {
echo "<a href='admin.php'><input type='button' id='adminBack' value='Back' /></a></h2>";
} else {
echo "<a href='adminUI.php'><input type='button' id='adminBack' value='Back' /></a></h2>";
}

if($_SERVER['REQUEST_METHOD'] == 'POST') {
echo "<h2>Message Updated!</h2>";
}
echo "<form class='admin' class='col-md-6' method='post' action='manageMessages.php'>
<div class='form-group'>
<label for='message'> Message: </label> 
<textarea class='form-control' id='message' name='message' >$currentMessage</textarea>
<input type='submit' value='Post Message' />
</div>
</form>";

}
?>
 </div>
<!-- end page specific content -->

设置会话的登录页面：

<?php
session_start();


function format($input) {
$input = trim($input);
$input = stripslashes($input);
$input = htmlspecialchars($input);
return $input;
};

$store; $pass; $valid;

echo "<script>function redirect() {
location.assign('manageMessages.php');
}

function adminRedirect() {
location.assign('admin.php');
}</script>";

if($_GET['logout']) {
session_unset();
session_destroy();

}
if($_SERVER['REQUEST_METHOD'] == "POST") {

if(!empty($_POST['store']) && !empty($_POST['pass'])) {
$store = format($_POST['store']);
$pass = format($_POST['pass']);

 $con = new PDO("sqlite:managers.db");

$sql = "SELECT *FROM managers WHERE store = '$store' AND password = '$pass'";

$statement = $con->query($sql); 
$rows = $statement->fetchAll();
$count = count($rows);
if($count != 1) {

$valid = false;

} else { 

$valid = true;
} 
}
 else {
 $valid = false;
 }


}
?>

// excess code //

<?php 
           $location;
          if($valid) {

     $_SESSION['store'] = $store;
          if($store == "00") {

         echo "<script>setTimeout(adminRedirect(), 1);</script>";
          } else {

          echo "<script>setTimeout(redirect(), 1);</script>";
          } } elseif ($valid === false) {
          echo "<h3>Please enter a valid store/password combination!</h3>";
          } 
          ?>
          <h2>Admin Login</h2>
          <form class="admin" method="post" action="adminUI.php"> 
          <div class="form-group">
          <label for="store">Store Number: </label> 
          <input type="text" class="form-control" name="store" id="store" />
          <label for="pass">Password:</label>
          <input type="text" class="form-control" name="pass" id="pass" />
          <input type="submit"  value="Login" />
          </div>
          </form>

Answer 1

您的$store变量被您的foreach覆盖：

foreach($storesArray as $store) 

您必须为该foreach使用不同的名称，例如：

foreach($storesArray as $store2)