PHP，带密钥的随机数组

Question

I have the below array which generates a random question with its key for a form.

I save the key in my database for later use, eg Password recovery etc...

The problem is each time the question is asked the key which is saved in the database is mostly not the one for the asked question.

Here is my insert.php for saving the key (secQ):

All the connections and validations which work correctly...

<?php
    include("questions.php");
    $dbh= $pdo->prepare("INSERT INTO users (secQ ) values (?)");
    $dbh->bindParam(1, $secQ );
    $dbh->execute();
?>

And this is my questions.php:

<?php
    function secQ(){
        $questions = array();

        $questions[0] = "1";
        $questions[1] = "2";
        $questions[2] = "3";
        $questions[3] = "4";
        $questions[4] = "5";

        $rand_key = array_rand($questions, 1);
        return array($rand_key, $questions[$rand_key]);
     }
    $q = secQ();
    $secQ = $q[0];
    $question = $q[1];
 ?>

I guess this is due to the fact that before secQ is inserted into the database there is the include("questions.php"); which it may again generate a different key randomly other than the askedquestion in the form.

Thanks a looot

Answer 1

This might be a good solution:

We can use sessions to communicate between the php files as follows:

in the insert.php:

$secQ = $_SESSION['secQ'];

in the questions.php:

$_SESSION['secQ'] = $secQ;

This works, but Im concerned about the security of this method as I start the session for the insert.php right before inserting the data into the database.

Any Comments on this would help a lot, thank you.