PHP sessionCheck函数代码示例

<?php

session_start();
include 'include/func.php';
//外部ファイル読み込み（関数群）
//idを取得[select.phpよりGETで取得]
if (isset($_GET["id"]) && $_GET["id"] != "") {
    $id = $_GET["id"];
} else {
    exit("Error");
}
//var_dump($id);
//select_enq.phpのページのセッションIDを比較し、ログイン認証済みかを判定
//ログイン認証してなければ処理がここでストップする。
sessionCheck();
// include/func.php に記載
//2.DB接続など
//2-1.DB接続
//1. 接続します
$pdo = connect_db();
// new PDO(...を関数として読み込み (include/func.php)
//2-2. DB文字コードを指定（固定）
$stmt = dbCharSet($pdo);
//3.SELECT * FROM gs_an_tableを取得（一覧表示準備）
$stmt = $pdo->prepare("SELECT * FROM an_table");
$status = $stmt->execute();
//４．SQL実行エラーチェック
dbExecError($status, $stmt);
//select_enq.phpと同じようにデータを取得
$view_table = "";
while ($get_id_result = $stmt->fetch(PDO::FETCH_ASSOC)) {

}
//require_once "database.ws";
/*
	解析 Action 
*/
$p = isset($_GET["p"]) && $_GET["p"] != "" ? $_GET["p"] : "default";
$par = explode("/", $p);
/*
	路径初始化
*/
switch ($par[0]) {
    case "default":
        displayTemp(WATERS_themeFront . "/index.php");
        break;
    case "admin":
        if (sessionCheck("login", "OK")) {
            $file = isset($par[1]) && $par[1] != "" ? $par[1] : "index";
            if (file_exists(WATERS_themeMan . "/" . $file . ".php")) {
                displayTemp(WATERS_themeMan . "/" . $file . ".php", $par[2]);
            } else {
                $file($par[2]);
            }
        } else {
            displayTemp(WATERS_themeMan . "/login.php");
        }
        break;
    case "page":
        $file = isset($par[1]) && $par[1] != "" ? $par[1] . ".php" : "index.php";
        displayTemp(WATERS_themeFront . "/" . $file, $par[2]);
        break;
    case "form":

    $MySQLConnection = new Mysql($mysql['host'], $mysql['port'], $mysql['user'], $mysql['password'], $mysql['database']);
    $MySQLConnection->connect();
    if ($result = $MySQLConnection->getQuery('SELECT x.matchID AS matchID, x.matchDate AS matchDate, y.teamName AS matchHomeTeam, y.teamLogo AS matchHomeTeamLogo, z.teamName AS matchForeignTeam, z.teamLogo AS matchForeignTeamLogo FROM matches AS x JOIN teams AS y ON y.teamID = matchHomeTeam JOIN teams AS z ON z.teamID = matchForeignTeam;')) {
        while ($row = mysqli_fetch_assoc($result)) {
            $userTips = getUserTips($MySQLConnection, $row["matchID"]);
            echo '
						<div class="panel panel-default">
							<form id="match_' . $row["matchID"] . '" method="POST">
								<div class="panel-body">
									<div class="panel-heading">' . $row["matchHomeTeam"] . ' vs. ' . $row["matchForeignTeam"] . '</div>
									<div class="input-group">
									 	<label>' . $row["matchHomeTeam"] . '</label>
									 	<input type="number"min="0"value="' . $userTips["tipScoreHome"] . '" name="ScoreHome" id="ScoreHome"  required/>
									 </div>
									<div class="input-group">
									 	<label>' . $row["matchForeignTeam"] . '</label>
									 	<input type="number"min="0" value="' . $userTips["tipScoreForeign"] . '" name="ScoreForeign" id="ScoreForeign" required/>
									 	<input type="button" value="Place Tip" onclick="placeTip(' . $row["matchID"] . ');"/>
									</div>
								</div>
							</form>
						</div>
					';
        }
    }
}
if (sessionCheck()) {
    buildPage();
} else {
    echo '<script type="text/javascript">', 'printError(\'You are not Logged in!\')', '</script>';
}

<?php 
include_once 'bin/include/head.php';
include_once 'bin/mysql.class.php';
function printCountrySelect()
{
    global $mysql;
    $MySQLConnection = new Mysql($mysql['host'], $mysql['port'], $mysql['user'], $mysql['password'], $mysql['database']);
    $MySQLConnection->connect();
    $result = $MySQLConnection->getQuery('SELECT * FROM countries;');
    echo '<select id="userCountry" name="userCountry"><option value="">---NO COUNTRY SELECTED---</option>';
    while ($row = mysqli_fetch_assoc($result)) {
        echo '<option value="' . $row["iso3166"] . '">' . $row["countryName"] . '</option>';
    }
    echo '</select>';
}
if (!sessionCheck()) {
    //'.$_SERVER['PHP_SELF'].'
    echo '
				<div class="col-sm-5">
		          <form id="regForm" class="form" method="POST">
		          	<fieldset>
		          		<legend>Account Information</legend>
		          		<label for="userLogin">Username: </label>
		            	<input type="text" id="userLogin" name="userLogin" placeholder="Boaty" required/>
		          		<label for="userPassword">Password: </label>
		            	<input type="password" id="userPassword" name="userPassword" placeholder="Pa$$w0rd" required/>
		          		<label for="userPasswordRepeat">Repeat: </label>
		            	<input type="password" id="userPasswordRepeat" name="userPasswordRepeat" placeholder="Pa$$w0rd" required/>
		          		<label for="userPassword">Email: </label>
		            	<input type="text" id="userEmail" name="userEmail" placeholder="boaty@mcboatface.co.uk" required/>
		            </fieldset>

/**
 * Back end routines to add/delete courses, invoked by faculty.php
 * @author Avin E.M; Kunal Dahiya
 */
require_once 'functions.php';
if (!sessionCheck('logged_in')) {
    postResponse("error", "Your session has expired, please login again");
}
require_once 'connect_db.php';
rangeCheck('cId', 2, 20);
$cId = strtoupper($_POST['cId']);
if (!isset($_SESSION['faculty'])) {
    $_SESSION['faculty'] = $_SESSION['uName'];
}
if (!sessionCheck('level', 'faculty') && !empty($_GET['faculty'])) {
    $_SESSION['faculty'] = $_GET['faculty'];
}
if (valueCheck('action', 'add')) {
    rangeCheck('cName', 6, 100);
    if (empty($_POST["allowConflict"])) {
        $_POST["allowConflict"] = 0;
    }
    try {
        $query = $db->prepare('INSERT INTO courses(course_Id,course_name,fac_id,allow_conflict) values (?,?,?,?)');
        $query->execute([$cId, $_POST['cName'], $_SESSION['faculty'], $_POST["allowConflict"]]);
        $query = $db->prepare('INSERT INTO allowed(course_Id,batch_name,batch_dept) values (?,?,?)');
        foreach ($_POST['batch'] as $batch) {
            $batch = explode(" : ", $batch);
            $query->execute([$cId, $batch[0], $batch[1]]);
        }

  | available through the world-wide-web at the following url:           |
  | http://www.php.net/license/3_0.txt.                                  |
  | If you did not receive a copy of the PHP license and are unable to   |
  | obtain it through the world-wide-web, please send a note to          |
  | license@php.net so we can mail you a copy immediately.               |
  +----------------------------------------------------------------------+
  | Authors : Salah Faya <visualmind@php.net>                            |
  +----------------------------------------------------------------------+

  $Id: editxml.php 307070 2011-01-04 11:45:55Z rquadling $
*/
//-- The PHPDOC Online XML Editing Tool
//--- Purpose: this is the actual xml editor script
//------- Initialization
require 'base.php';
$user = sessionCheck('?from=editxml');
$lang = $user['phpdocLang'];
$translationPath = $phpdocLangs[$lang]['DocCVSPath'];
//------- Frames split
if (isset($_REQUEST['split'])) {
    if ($_REQUEST['split'] == 'false' || !$_REQUEST['split']) {
        $_REQUEST['split'] = false;
    }
    $_SESSION['split'] = $_REQUEST['split'];
}
if (!empty($_SESSION['split']) && !isset($_REQUEST['noframes'])) {
    $source = $_REQUEST['source'];
    $file = $_REQUEST['file'];
    // ToDo automatically show the translated file in one frame and the source in another
    print "<frameset cols=*,*><frame name=frame1 src='editxml.php?file={$file}&source={$source}&noframes=1'><frame name=frame2 src='editxml.php?file={$file}&source={$source}&noframes=1'></frameset>";
    exit;

<?php

/**
 * Back end routines for user management, invoked by manage.php and setup.php
 * @author Avin E.M; Kunal Dahiya
 */
require_once 'functions.php';
require_once 'connect_db.php';
if ($_POST) {
    // if the user is not a dean, allow registration only if the system has no dean
    $newAdmin = 0;
    if (!sessionCheck('level', 'dean')) {
        $query = $db->query("SELECT count(*) FROM faculty where level='dean'");
        // Check if the system has no admin configured yet
        if ($query->fetch()[0]) {
            postResponse("error", "You are not authorized to register accounts.");
        }
        $newAdmin = 1;
    }
    rangeCheck('uName', 3, 25, false);
    if (valueCheck('action', 'addUser')) {
        rangeCheck('fullName', 6, 50);
        rangeCheck('pswd', 8, 32, false);
    }
    $uName = strtolower($_POST['uName']);
    if (valueCheck('action', 'deleteFaculty')) {
        $db->prepare('DELETE FROM faculty where uName =?')->execute([$uName]);
        postResponse("removeOpt", "Faculty deleted");
        die;
    }
    if (!empty($_POST['dept'])) {

        $faculty = $query->fetch();
        if (!$faculty) {
            postResponse("error", "Username is not registered!");
        }
        if ($faculty['pswd'] == pwdHash($uName, $_POST['pswd']) || @ldap_bind(ldap_connect($config['ldap_host']), "uid={$uName}," . $config['ldap_dn'], $_POST['pswd'])) {
            $_SESSION['logged_in'] = true;
            $_SESSION['fName'] = $faculty['fac_name'];
            $_SESSION['uName'] = $uName;
            $_SESSION['level'] = $faculty['level'];
            $_SESSION['dept'] = $faculty['dept_code'];
        } else {
            postResponse("error", "Invalid credentials");
        }
    }
}
if (sessionCheck('logged_in')) {
    $home = "faculty.php";
    if ($_SESSION['level'] == "dean") {
        $home = "dean.php";
    }
    if ($_POST) {
        postResponse("redirect", $home);
    }
    header("Location: " . $home);
    die;
}
?>
<!DOCTYPE HTML>
<html>

<head>

<?php

/*
  +----------------------------------------------------------------------+
  | PHP Version 4                                                        |
  +----------------------------------------------------------------------+
  | Copyright (c) 1997-2011 The PHP Group                                |
  +----------------------------------------------------------------------+
  | This source file is subject to version 3.0 of the PHP license,       |
  | that is bundled with this package in the file LICENSE, and is        |
  | available through the world-wide-web at the following url:           |
  | http://www.php.net/license/3_0.txt.                                  |
  | If you did not receive a copy of the PHP license and are unable to   |
  | obtain it through the world-wide-web, please send a note to          |
  | license@php.net so we can mail you a copy immediately.               |
  +----------------------------------------------------------------------+
  | Authors : Salah Faya <visualmind@php.net>                            |
  +----------------------------------------------------------------------+

  $Id: workbench.php 307070 2011-01-04 11:45:55Z rquadling $
*/
//-- The PHPDOC Online XML Editing Tool
//--- Purpose: this file is the frameset
require 'base.php';
$user = sessionCheck();
?>
<frameset cols="200,*">
 <frame name=listingframe src=cvslist.php>
 <frame name=fileframe src=intro.php>
</frameset>

    if ($course['allow_conflict'] && $current['allowConflicts']) {
        continue;
    }
    echo "<div class=\"{$course['course_id']}\">";
    foreach ($blocked[$course['course_id']] as $slot => $batches) {
        echo "<input type= \"hidden\" name=\"{$slot}\" value=\"{$batches}\" >";
    }
    echo "</div>";
}
?>
      </div>
      <div id="footer" style="position: relative">Powered by <a href="https://github.com/0verrider/QuickSlots">QuickSlots v1.0</a></div>
    </div>
    <div id="rightpane" style="width: 235px;margin-left:10px">
    <?php 
if (!sessionCheck('level', 'faculty')) {
    ?>
      <div class="title">Faculty</div>
      <select id="faculty" class="stretch">
        <?php 
    $query = $db->prepare('SELECT * FROM faculty where dept_code=?');
    $query->execute([$_SESSION['dept']]);
    foreach ($query->fetchall() as $fac) {
        echo "<option value=\"{$fac['uName']}\">{$fac['fac_name']} ({$fac['uName']})</option>";
    }
    ?>
      </select>
    <?php 
}
?>
      <div class="title" style="padding: 15px 0">Courses</div>

<?php

/**
 * Back end routines that call PhantomJS to generate printable timetable snapshot images
 * @author Avin E.M
 */
require_once 'functions.php';
if (!empty($_POST['filter']) && sessionCheck('logged_in')) {
    $imgPath = 'tmp/print_' . time() . '.png';
    $phantom = 'phantomjs' . DIRECTORY_SEPARATOR . 'phantomjs';
    $basUrl = 'http://' . $_SERVER['SERVER_ADDR'] . dirname($_SERVER['SCRIPT_NAME']);
    $printUrl = escapeshellarg($basUrl . '/?print=true&' . $_POST['filter']);
    // Serious vulnerability if not escaped
    exec($phantom . ' js/capture.js ' . $printUrl . ' ' . $imgPath);
    header('Content-Disposition: attachment; filename=' . $_POST['filename'] . '.png');
    header('Content-Type: ' . mime_content_type($imgPath));
    header('Content-Transfer-Encoding: binary');
    header('Content-Length: ' . filesize($imgPath));
    readfile($imgPath);
    unlink($imgPath);
}