Is this code vulnerable?

Question

I have developed a php code given below. I would like to know what are the security vulnerabilities present within this php code?

<?php
        if(isset($_SESSION['id'])){
        // get data from mysql table where id = $_SESSION['id'];
        // shows data

        }else{
        echo "pls login";
        }

     ?>

Answer 1

That snippet in itself is not really a safety check, it just checks that a value exists before using it (good practice, but not security related). The meat of your code will be in:

from mysql table where id = $_SESSION['id'];

And it all depends how the data got to $_SESSION['id']. Either before inserting it there or before using it, you need to do the proper safety checks, based on what are you going to use the value for. In your case, check for SQL injection AND you better use parametrized queries.

If your SQL actually looks a bit like what you wrote, that is, a concatenation of strings with the $_SESSION['id'] unqouted as a numeric value, then, yes, this is VERY vulnerable.

Answer 2

As long as you properly clear the session variables after the user has logged out, this should be fine. Whilst this particular session variable isn't injectable, do make sure you're using parameterised queries in all of your code.