php - check if the user with email X has 1 or 2 open sessions

Question

Good,

I would like to know what is the safest and easiest way to check if a user is connected 2x in the same email. If he is he simply cancels 1 and gets the other.

How can I make that check?

Answer 1

There are several ways to do this. One option is to create a hashed value that is saved in the database for a later check. For example:

After the user confirms the email and password you open a session:

session_start();

$email = '[email protected]';

// esse é o valor gerado no após a confirmação do usuário
$valor_da_sessao = crypt($email, md5(date("d/m/Y H:i:s")));

$_SESSION['user'] = $valor_da_sessao;

// salva a sessao no banco de dados

$query = mysqli_query($conexao, "UPDATE sessao SET valor = '$valor_da_sessao' WHERE email = '$email'");

if($query){
    echo "DEU CERTO!";
    header("Location: pagina_inicial.php");
} else {
    echo "DEU ERRADO!"
}

Now, you just check, with each user action, if the session used by him is the original session.

Thus:

session_start();

$valor_da_sessao = $_SESSION['user'];

$query = mysqli_query($conexao, "SELECT * FROM sessao WHERE valor = '$valor_da_sessao'");

if(mysqli_num_rows($query) == 0){
    /*

        ESSA SESSÃO NÃO É ORIGINAL

    */

    unset($_SESSION['user']);
    session_destroy();
}

EDIT

After a few comments from @Inkeliz, they showed me that it’s really easy to circumvent the above answer. But it’s easy to fix too! For this, you need to change each user action the session value and the bank value. It will be impossible, this way, the same user be in 2 places at the same time.

Thus:

session_start();

$email = '[email protected]';

if(isset($_SESSION['user'])){

    $valor_da_sessao = $_SESSION['user'];

    $query = mysqli_query($conexao, "SELECT * FROM sessao WHERE valor = '$valor_da_sessao'");

    if(mysqli_num_rows($query) == 0){

        /*

            ESSA SESSÃO NÃO É ORIGINAL

        */

        unset($_SESSION['user']);
        session_destroy();

    } else {

        /*

            ESSA SESSÃO É ORIGINAL
            CRIA UM NOVO VALOR
            SALVA NO BANCO

        */

        $valor_da_sessao = crypt($email, md5(date("d/m/Y H:i:s")));

        $_SESSION['user'] = $valor_da_sessao;

        mysqli_query($conexao, "UPDATE sessao SET valor = '$valor_da_sessao' WHERE email = '$email'");

    }

}