Solved

== not working the way Id expect it

Posted on 2016-07-19
7
43 Views
Last Modified: 2016-07-26
Im trying to test if a variable is the same as another vairable:-
if ($_SESSION['loggedIn'] == $authKey) {

Open in new window


Which its saying it is, however it shouldn't, to debug I added:-
		echo "authKey = " . $authKey . "<br/>";
		echo "SESSION loggedIn - " . $_SESSION['loggedIn'] . "<br/>";

Open in new window


Which returns:-

authKey = 5f8e4f8b-f7db-4c6c-8beb-0336a7e1b443
SESSION loggedIn - 1

And then to test further I used:-
		if ($_SESSION['loggedIn'] == $authKey) {
			echo "T";
		} else {
			echo "F";
		}

Open in new window


Which returns T.

I dont understand why its returning that it is the same, when it isnt.

Any ideas how to fix it and why its happening?
0
Comment
Question by:tonelm54
7 Comments
 
LVL 108

Accepted Solution

by:
Ray Paseur earned 500 total points
Comment Utility
These isolated fragments of code are probably masking the problem, which will be better represented by the SSCCE (a sample that demonstrates the error, one we can install and run).  There is nothing inherently wrong in your code as you've shown it here, but this is not a code problem, it is a data-dependent problem, so we would need to see the origins of the data (variables) that are in play.  Are you using session_start() on all pages?

Useful references:
http://php.net/manual/en/types.comparisons.php
http://php.net/manual/en/language.operators.comparison.php
http://php.net/manual/en/language.types.type-juggling.php

Please see: https://iconoun.com/demo/temp_tonelm54.php
<?php // demo/temp_tonelm54.php
/**
 * https://www.experts-exchange.com/questions/28958236/not-working-the-way-Id-expect-it.html
 *
 * An Example SSCCE
 * http://sscce.org/
 *
 * Note that there is no session_start() statement in this example.  Not needed for this test.
 *
 */
error_reporting(E_ALL);
echo '<pre>';


// ASSIGN OUR TEST VARIABLES
$authKey = "123";
$_SESSION['loggedIn'] = "123";

// SHOW OUR TEST VARIABLES
echo "authKey = " . $authKey . "<br/>";
echo "SESSION loggedIn - " . $_SESSION['loggedIn'] . "<br/>";

// USE OUR TEST VARIABLES
if ($_SESSION['loggedIn'] == $authKey) {
	echo "T";
} else {
	echo "F";
}

Open in new window

Outputs:
authKey = 123
SESSION loggedIn - 123
T

Open in new window

0
 
LVL 30

Expert Comment

by:Marco Gasi
Comment Utility
Because, when you compares a number with a string, the string is converted in a number; any string which doesn't start with a number is converted to 0, the other to 1, so your comparison is

if 1 == 1 -> true

Replace equal operator == with identical operator === to avoid this issue.

But your code doesn't make sense to me because you're comparing a boolen value (loggedin which can be 0 or 1) with a string which represents a token so you'll always get false. You should change the logic and store ina  cookie or in the $_SESSION array the authKey when it is assigned and then perform your comparison against the coockie or the $_SESSION value
0
 
LVL 108

Expert Comment

by:Ray Paseur
Comment Utility
@Marco: I don't see it that way.  Check out this example.  That's why I think we are missing an important piece of the puzzle.

Please see: https://iconoun.com/demo/temp_tonelm54_FALSE.php
<?php // demo/temp_tonelm54_FALSE.php
/**
 * https://www.experts-exchange.com/questions/28958236/not-working-the-way-Id-expect-it.html
 *
 * An Example SSCCE
 * http://sscce.org/
 *
 * Note that there is no session_start() statement in this example.  Not needed for this test.
 *
 */
error_reporting(E_ALL);
echo '<pre>';


// ASSIGN OUR TEST VARIABLES
$authKey = "5f8e4f8b-f7db-4c6c-8beb-0336a7e1b443";
$_SESSION['loggedIn'] = "1";

// SHOW OUR TEST VARIABLES
echo "authKey = " . $authKey . "<br/>";
echo "SESSION loggedIn - " . $_SESSION['loggedIn'] . "<br/>";

// USE OUR TEST VARIABLES
if ($_SESSION['loggedIn'] == $authKey) {
	echo "T";
} else {
	echo "F";
}

Open in new window

Outputs:
authKey = 5f8e4f8b-f7db-4c6c-8beb-0336a7e1b443
SESSION loggedIn - 1
F

Open in new window

That aside, the correct (working) design for PHP client authentication is shown in this article:
https://www.experts-exchange.com/articles/2391/PHP-Client-Registration-Login-Logout-and-Easy-Access-Control.html
0
IT, Stop Being Called Into Every Meeting

Highfive is so simple that setting up every meeting room takes just minutes and every employee will be able to start or join a call from any room with ease. Never be called into a meeting just to get it started again. This is how video conferencing should work!

 
LVL 30

Expert Comment

by:Marco Gasi
Comment Utility
Wooops, I see...
1
 
LVL 82

Expert Comment

by:Dave Baldwin
Comment Utility
One of the thing that "session_start()" does is create or find the file that session data is stored in.  While it may not affect this simple demo, it is never a good idea to try to use $_SESSION variables without it.  You certainly can't expect to store any $_SESSION variables without it and expect them to be there on a second page.
1
 
LVL 108

Expert Comment

by:Ray Paseur
Comment Utility
Dave: Agreed, 100%, and that's why I asked about it right at the top.

In any real-world example session_start() would be a common-sense thing to do, but it's not necessary in this instance, and I didn't include it to avoid cluttering up my session with E-E test data.  I did, however, make note of this in the script comments, since it's one of those things that requires explanation.
0
 

Author Closing Comment

by:tonelm54
Comment Utility
Weirdly, my code still doesn't produce the right answer, but when I run yours it does, so must be something weird happening somewhere else thats throwing it off. Its only POC anyways
0

Featured Post

Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

Join & Write a Comment

Suggested Solutions

Deprecated and Headed for the Dustbin By now, you have probably heard that some PHP features, while convenient, can also cause PHP security problems.  This article discusses one of those, called register_globals.  It is a thing you do not want.  …
Password hashing is better than message digests or encryption, and you should be using it instead of message digests or encryption.  Find out why and how in this article, which supplements the original article on PHP Client Registration, Login, Logo…
Explain concepts important to validation of email addresses with regular expressions. Applies to most languages/tools that uses regular expressions. Consider email address RFCs: Look at HTML5 form input element (with type=email) regex pattern: T…
The viewer will learn how to dynamically set the form action using jQuery.

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

6 Experts available now in Live!

Get 1:1 Help Now