PHP in_array not working

Question

I am using the PHP in_array() function in order to authenticate (with sessions) if a user can access a particular page. For some reason, it is not working...

PHP PAGE

session_start();
require_once('../scripts/functions.php'); 
$role_auth = @$_SESSION['role_auth'];
access($role_auth, array(0,1,2,3,4));

access FUNCTION

function access($role_auth, $array){

if(!(in_array($role_auth, $array))){ 
   header("Location: ../index.html");
}
}

If I insert print statements in the function, I can see that all of the correct values are being passed into the function. The problem is, if the function is called without a session variable set, for some reason it is considered as being in the array, and it authenticates.

Any ideas?

Just a tip, you can use range(0,4) instead of array(0,1,2,3,4). php.net/range — TJ L
– TJ L, Commented Jul 1, 2009 at 16:14
A quick note on your security check. Make sure you call die() or exit() after you send the header, because the content afterward in the script will still be send. — merkuro
– merkuro, Commented Jul 1, 2009 at 16:21

Jason · Accepted Answer · 2009-07-01 16:11:25Z

10

you may want to enable strict type checks by using:

in_array($role_auth, $array, true)

as what is likely happening is that $role_auth is being eval'd as false and that could match 0 in your in_array statement.

what you SHOULD be doing is this:

session_start(); 
require_once('../scripts/functions.php'); 
$role_auth = (isset($_SESSION['role_auth']))?$_SESSION['role_auth']:-1; 
access($role_auth, array(0,1,2,3,4));

or something similiar. nothing good ever comes of using the @ operator

answered Jul 1, 2009 at 16:11

Jason

2,04911 silver badges13 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Cfreak · Accepted Answer · 2009-07-01 16:09:13Z

3

I would check to see if $_SESSION['role_auth'] is actually set (with isset) instead of using @ to suppress warnings (which is bad practice IMHO)

I think what's happening is that false == 0 ... so in_array returns true when nothing is in $role_auth because it sees it as 0 and 0 is in your array

answered Jul 1, 2009 at 16:09

Cfreak

19.4k6 gold badges52 silver badges64 bronze badges

Comments

Tom Ritter · Accepted Answer · 2009-07-01 16:10:00Z

3

 $role_auth = @$_SESSION['role_auth'];

The @ sign is suppressing any warnings you might get here, like index is not in array. How about something like this instead:

 if(isset($_SESSION['role_auth']))
    $role_auth = $_SESSION['role_auth'];
 else
    $role_auth = -1;//(or whatever an invalid role is)

answered Jul 1, 2009 at 16:10

Tom Ritter

102k32 gold badges143 silver badges174 bronze badges

1 Comment

Kimble Over a year ago

The @ is also quite expensive when it comes to performance as php turns error reporting on and off in the background.

Noah Medling · Accepted Answer · 2009-07-01 16:13:22Z

3

In php, the number zero is considered equal to most non-numeric things, for example:

null   == 0
false  == 0
""     == 0
"asdf" == 0

You probably need to make sure that $_SESSION actually contains the 'role_auth' key beforehand and convert it to the appropriate type, also passing the $strict parameter to in_array, thus guaranteeing a type check as well as a value check (=== vs. ==). Removing zero from your array might also be a good idea.

answered Jul 1, 2009 at 16:13

Noah Medling

4,7191 gold badge25 silver badges18 bronze badges

2 Comments

AgelessEssence Over a year ago

this surprises me!, 0 == "asdf" OMFG!! :@

AgelessEssence Over a year ago

HOLY SH#t!!, this behaviour affected my entire web app since was created! ( stock and serial codes related ), now i patched this and a consistency check was done... ( all is Ok! ) Seriously, i will nominate Noah Medling to Man of the Year =P

Collectives™ on Stack Overflow

PHP in_array not working

PHP PAGE

access FUNCTION

4 Answers 4

Comments

Comments

1 Comment

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

PHP PAGE

access FUNCTION

4 Answers 4

Comments

Comments

1 Comment

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related