PHP会话混淆
PHP会话混淆
提问于 2009-06-24 14:45:25
好吧，我像地狱一样迷惑。我有一个存储在会话中的对象。我可以向此对象添加项。到目前为止还很简单。我像这样初始化对象：
$template = new Template($mysqli);
$_SESSION['template'] = serialize($template);现在，这应该会创建一个全新的对象并将其分配给会话。然后，我有一些通过AJAX请求添加项的代码。代码如下：
$template = unserialize($_SESSION['template']);
$prodid = $_GET['product_id'];
$template->addItem($prodid);
echo var_dump($template->getItems());
$_SESSION['template'] = serialize($template);再说一次，应该很简单。现在的问题是，第一段代码没有重置$_SESSION['template']，所以我得到了到目前为止我添加的所有项，重新加载页面并不能修复它。
我找到了导致这个恶作剧的文件，但我不知道我能做些什么。它是一个include，站点的不同部分都需要它才能运行。我正在添加功能的网站，我不认为业主会高兴，如果我删除的功能。这是文件：
<?php
include_once( 'DBE.class.php' ) ;
################################################
# Function: Sessions_open
# Parameters: $path (string), $name (string)
# Returns: bool
# Description: This is an over-ride function call
# that we need to create so that the php internal
# session manager doesn't store our session in the
# file system, since we are storing it in the
# db. Storing a session in a file system on the
# server inhibits scalability for two reasons:
# 1: A large number of users may be hitting the site
# and clog the space on the hard-drive of the server
# due to the sheer amount of session files stored
# 2: The website may be behind a load-balancer and
# therefore the server handling the page request
# may not have the session stored on its file system
################################################
function Sessions_open ( $path, $name ) {
return TRUE ;
}
################################################
# Function: Sessions_close
# Parameters: N/A
# Returns: bool
# Description: This is an over-ride function call
# that we need to create so that the php internal
# session manager doesn't store our session in the
# file system, since we are storing it in the
# db. Storing a session in a file system on the
# server inhibits scalability for two reasons:
# 1: A large number of users may be hitting the site
# and clog the space on the hard-drive of the server
# due to the sheer amount of session files stored
# 2: The website may be behind a load-balancer and
# therefore the server handling the page request
# may not have the session stored on its file system
################################################
function Sessions_close () {
return TRUE ;
}
################################################
# Function: Sessions_read
# Parameters: $SessionID (string)
# Returns: (string) or (false) on error
# Description: This function is used at startup to read
# the contents of the session.
# If no sess data, the empty string ("") is returned.
# Otherwise, the serialized sess data is returned.
# On error, false is returned.
################################################
function Sessions_read ( $SessionID ) {
include_once( 'DBE.class.php' ) ;
$dbe = new DBE() ;
//default return value to false
$returnVal = FALSE ;
$query = "SELECT DataValue
FROM Sessions
WHERE SessionID = '$SessionID' " ;
$result = $dbe->Select( $query ) ;
if( count( $result ) == 1 ) {
$returnVal = $result[0]['DataValue'] ;
//update the session so that we don't time-out after creating
$query = "UPDATE Sessions
SET LastUpdated = NOW()
WHERE SessionID = '$SessionID'" ;
$dbe->Update( $query ) ;
} else {
//Insert here to simplify the write function
$query = "INSERT INTO Sessions (SessionID, DataValue) VALUES ( '$SessionID', '' )" ;
$dbe->Insert( $query ) ; //pass the insert stmt
//set returnVal to '' being that we didn't find the SessionID
$returnVal = '' ;
}
return( $returnVal ) ;
}
################################################
# Function: Sessions_write
# Parameters: $SessionID (string), $Data
# Returns: bool
# Description: This function is used at startup to read
# the contents of the session.
# If no sess data, the empty string ("") is returned.
# Otherwise, the serialized sess data is returned.
# On error, false is returned.
################################################
function Sessions_write( $SessionID, $Data ) {
include_once( 'DBE.class.php' ) ;
$dbe = new DBE() ;
//default to true
$returnVal = TRUE ;
//update the session
$query = "UPDATE Sessions
SET DataValue = '$Data'
WHERE SessionID = '$SessionID'" ;
$result = $dbe->Update( $query ) ; //pass the update stmt to the dbEngine..
//test for success
if( $result == -1 )
$returnVal = FALSE ;
//return the return value
return( $returnVal ) ;
}
################################################
# Function: Sessions_delete
# Parameters: $SessionID (string)
# Returns: bool
# Description: This function is used to delete the session
################################################
function Sessions_destroy( $SessionID ) {
include_once( 'DBE.class.php' ) ;
$dbe = new DBE() ;
$query = "DELETE FROM Sessions WHERE SessionID = '$SessionID' " ;
$dbe->Delete( $query ) ;
return( TRUE ) ;
}
################################################
# Function: Sessions_delete
# Parameters: $SessionID (string)
# Returns: bool
# Description: This function is used to delete the session
################################################
function Sessions_gc( $aMaxLifetime ) {
include_once( 'DBE.class.php' ) ;
$dbe = new DBE() ;
$query = "DELETE FROM Sessions WHERE (UNIX_TIMESTAMP(NOW()) - UNIX_TIMESTAMP( LastUpdated )) > $aMaxLifetime " ;
$dbe->Delete( $query ) ;
return( TRUE ) ;
}
session_set_save_handler( "Sessions_open", "Sessions_close",
"Sessions_read", "Sessions_write",
"Sessions_destroy", "Sessions_gc" ) ;
?>我认为这改变了会话的基本功能，但我不太确定。这会导致我在会话中重置模板时遇到麻烦。任何人有任何想法或知道我可以做什么来解决这个问题。我完全被难住了，所以我非常感谢你的帮助。
回答 4
Stack Overflow用户
回答已采纳
发布于 2009-06-24 15:18:42
我不确定这是否是问题所在，但当我阅读您的代码时，我会想到以下几点：
序列化对象依赖于mysql连接
$template =新模板($mysqli)；
虽然您的对象(也许)可以顺利地序列化和反序列化，但mysql连接不能，因此未序列化的$template尝试对无效的连接/文件句柄进行操作。
您可以尝试将未序列化的对象重新附加到有效的数据库连接。
如果不知道模板类中有什么(以及它使用了什么资源和如何使用)，就很难猜出问题出在哪里，但我希望这是一个足够好的线索，可以让我们从哪里开始查找。
为了让你更好地理解我在说什么，考虑一下：
template.php
<?php
class Template {
function __construct($c) {
$this->conn = $c;
$this->foo = "bar";
}
function get_data() {
$result = mysql_query("select 1234 as test", $this->conn);
$data = mysql_fetch_array($result);
return $data;
}
function attach_db($c) {
$this->conn = $c;
}
}
?>first.php
<?php
session_start();
require('template.php');
$conn = mysql_connect('localhost', 'root', '');
$template = new Template($conn);
?>
<pre>
Your $template var, freshly created:
<?php var_dump($template); ?>
Accessing the resources:
<?php var_dump($template->get_data()); ?>
<?php
$_SESSION['template'] = serialize($template);
?>
</pre>other.php
<?php
session_start();
require('template.php');
$template = unserialize($_SESSION['template']);
?>
<pre>
Unserialized $template:
<?php var_dump($template); ?>
(notice that $template->foo === "bar" so your session un/serialization is working correctly)
Accessing the (now invalid) mysql resources:
<?php var_dump($template->get_data()); ?>
</pre>调用first.php应该会得到这样的结果：
对新创建的$template变量执行
操作：
对象(模板)#1 (2) {
"conn"=>
资源(3)类型(mysql链接)
"foo"=>
string(3) "bar“
}
访问资源：
数组(2){
=>
string(4) "1234“
“测试”=>
string(4) "1234“
}
调用others.php应该会导致：
未序列化的$template：
对象(模板)#1 (2) {
"conn"=>
int(0)
"foo"=>
string(3) "bar“
}
(请注意$template->foo === "bar“，这样会话解串行化就可以正常工作了)
访问(现在无效) mysql资源：
警告: mysql_query()：提供的参数不是第9行template.php中的有效MySQL-Link资源
警告: mysql_fetch_array()：提供的参数不是第10行template.php中的有效MySQL结果资源
布尔值(False)
要解决这个问题，您可以重新创建无法取消/序列化的资源。
如下所示：
solution.php
<?php
session_start();
require('template.php');
$template = unserialize($_SESSION['template']);
?>
<pre>
Unserialized $template:
<?php var_dump($template); ?>
Attaching a valid db connection:
<?php
$conn = mysql_connect('localhost', 'root', '');
$template->attach_db($conn);
var_dump($template);
?>
Accessing the resources:
<?php var_dump($template->get_data()); ?>
</pre>现在，在调用first.php之后调用solution.php应该会得到以下结果：
未序列化的$template：
对象(模板)#1 (2) {
"conn"=>
int(0)
"foo"=>
string(3) "bar“
}
附加有效的数据库连接：
对象(模板)#1 (2) {
"conn"=>
资源(3)类型(mysql链接)
"foo"=>
string(3) "bar“
}
访问资源：
数组(2){
=>
string(4) "1234“
“测试”=>
string(4) "1234“
}
正如我所说的，如果不知道模板类做了什么，就不可能确切地说出发生了什么。这只是一种可能性;)
祝好运!
Stack Overflow用户
发布于 2009-06-24 15:16:34
看起来它们覆盖了标准的会话处理程序，将会话数据存储在数据库中。
查看Sessions表并检查序列化对象是否被正确存储。
Stack Overflow用户
发布于 2009-06-24 14:49:00
那么，您应该能够检查数据库以查看您的数据是如何存储的(如果有的话)。这肯定是我要开始的地方。
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：
https://stackoverflow.com/questions/1038830
复制相关文章
相似问题
腾讯云开发者
