== not working the way Id expect it

Im trying to test if a variable is the same as another vairable:-
if ($_SESSION['loggedIn'] == $authKey) {

Open in new window


Which its saying it is, however it shouldn't, to debug I added:-
		echo "authKey = " . $authKey . "<br/>";
		echo "SESSION loggedIn - " . $_SESSION['loggedIn'] . "<br/>";

Open in new window


Which returns:-

authKey = 5f8e4f8b-f7db-4c6c-8beb-0336a7e1b443
SESSION loggedIn - 1

And then to test further I used:-
		if ($_SESSION['loggedIn'] == $authKey) {
			echo "T";
		} else {
			echo "F";
		}

Open in new window


Which returns T.

I dont understand why its returning that it is the same, when it isnt.

Any ideas how to fix it and why its happening?
tonelm54Asked:
Who is Participating?
 
Ray PaseurConnect With a Mentor Commented:
These isolated fragments of code are probably masking the problem, which will be better represented by the SSCCE (a sample that demonstrates the error, one we can install and run).  There is nothing inherently wrong in your code as you've shown it here, but this is not a code problem, it is a data-dependent problem, so we would need to see the origins of the data (variables) that are in play.  Are you using session_start() on all pages?

Useful references:
http://php.net/manual/en/types.comparisons.php
http://php.net/manual/en/language.operators.comparison.php
http://php.net/manual/en/language.types.type-juggling.php

Please see: https://iconoun.com/demo/temp_tonelm54.php
<?php // demo/temp_tonelm54.php
/**
 * https://www.experts-exchange.com/questions/28958236/not-working-the-way-Id-expect-it.html
 *
 * An Example SSCCE
 * http://sscce.org/
 *
 * Note that there is no session_start() statement in this example.  Not needed for this test.
 *
 */
error_reporting(E_ALL);
echo '<pre>';


// ASSIGN OUR TEST VARIABLES
$authKey = "123";
$_SESSION['loggedIn'] = "123";

// SHOW OUR TEST VARIABLES
echo "authKey = " . $authKey . "<br/>";
echo "SESSION loggedIn - " . $_SESSION['loggedIn'] . "<br/>";

// USE OUR TEST VARIABLES
if ($_SESSION['loggedIn'] == $authKey) {
	echo "T";
} else {
	echo "F";
}

Open in new window

Outputs:
authKey = 123
SESSION loggedIn - 123
T

Open in new window

0
 
Marco GasiFreelancerCommented:
Because, when you compares a number with a string, the string is converted in a number; any string which doesn't start with a number is converted to 0, the other to 1, so your comparison is

if 1 == 1 -> true

Replace equal operator == with identical operator === to avoid this issue.

But your code doesn't make sense to me because you're comparing a boolen value (loggedin which can be 0 or 1) with a string which represents a token so you'll always get false. You should change the logic and store ina  cookie or in the $_SESSION array the authKey when it is assigned and then perform your comparison against the coockie or the $_SESSION value
0
 
Ray PaseurCommented:
@Marco: I don't see it that way.  Check out this example.  That's why I think we are missing an important piece of the puzzle.

Please see: https://iconoun.com/demo/temp_tonelm54_FALSE.php
<?php // demo/temp_tonelm54_FALSE.php
/**
 * https://www.experts-exchange.com/questions/28958236/not-working-the-way-Id-expect-it.html
 *
 * An Example SSCCE
 * http://sscce.org/
 *
 * Note that there is no session_start() statement in this example.  Not needed for this test.
 *
 */
error_reporting(E_ALL);
echo '<pre>';


// ASSIGN OUR TEST VARIABLES
$authKey = "5f8e4f8b-f7db-4c6c-8beb-0336a7e1b443";
$_SESSION['loggedIn'] = "1";

// SHOW OUR TEST VARIABLES
echo "authKey = " . $authKey . "<br/>";
echo "SESSION loggedIn - " . $_SESSION['loggedIn'] . "<br/>";

// USE OUR TEST VARIABLES
if ($_SESSION['loggedIn'] == $authKey) {
	echo "T";
} else {
	echo "F";
}

Open in new window

Outputs:
authKey = 5f8e4f8b-f7db-4c6c-8beb-0336a7e1b443
SESSION loggedIn - 1
F

Open in new window

That aside, the correct (working) design for PHP client authentication is shown in this article:
https://www.experts-exchange.com/articles/2391/PHP-Client-Registration-Login-Logout-and-Easy-Access-Control.html
0
Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

 
Marco GasiFreelancerCommented:
Wooops, I see...
1
 
Dave BaldwinFixer of ProblemsCommented:
One of the thing that "session_start()" does is create or find the file that session data is stored in.  While it may not affect this simple demo, it is never a good idea to try to use $_SESSION variables without it.  You certainly can't expect to store any $_SESSION variables without it and expect them to be there on a second page.
1
 
Ray PaseurCommented:
Dave: Agreed, 100%, and that's why I asked about it right at the top.

In any real-world example session_start() would be a common-sense thing to do, but it's not necessary in this instance, and I didn't include it to avoid cluttering up my session with E-E test data.  I did, however, make note of this in the script comments, since it's one of those things that requires explanation.
0
 
tonelm54Author Commented:
Weirdly, my code still doesn't produce the right answer, but when I run yours it does, so must be something weird happening somewhere else thats throwing it off. Its only POC anyways
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.