PHP会话变量不可用

Question

I have a PHP file (approvals.php) that only gets executed on an AJAX call. It has a postgresql query that searches a table and uses a customer id, which is set as a session variable. Problem is, it seems I can't access this session variable in this file. My query is like:

$query = "SELECT merchant_id FROM ndovu_merchant_users WHERE customer_id={$_SESSION['customer_id']}";
$result = pg_query($query);

I have tried to echo the session variable $_SESSION['customer_id'] but nothing. However on passing a fixed value to the query, it returns a result.

Answer 1

You need to place session_start(); above the code section where you use it; the top of the page is usually the best place to place it.

Also, it should be noted; you have what is potentially a large security flaw here, by passing in unescaped data.

You should look into using prepared statements if possible; or at least escape your inputs.