php - 是否可以直接使用 ajax 发送 php session 变量？

Question

我在 index.php 中有这个

    <?php

    include_once '..\connect.php';

    session_start();

    if (isset($_SESSION['username'])){
        $player_name = $_SESSION['username'];

    } else {    
        header( 'Location: http://localhost/Inventory/index.php' ) ;
        exit;
    }

    ?>

我正在向 request.php 发出 ajax 请求

    <?php
    //connect to databate and check for errors
    $con = mysql_connect ("localhost","root","");
    if (!$con) {
        die ('Could not connect to database: ' . mysql_error());
    }

    //select database and check selection
    if (!mysql_select_db ("GotA", $con)) {
        die ('Could not select database: ' . mysql_error());
    }

//I have to create this if not it doesnt find the sessions $player_name variable
    $player_name = $_POST['name']; 

    //***Create Player Array**//
    $player_info = "SELECT * from players where id = $player_name";
    $player_info2 = mysql_query($player_info) or die ('Couldnt get players name');
    $player_info3 = mysql_fetch_array($player_info2);

好吧，使用通过 javascript 发送的变量从数据中检索数据似乎不安全，难道没有办法直接使用 index.php( session 部分)中的变量吗？或者仅使用 javascript 传递信息是否安全？

Answer 1

为什么不在 request.php 中再次检索 session ？

代替:

$player_name = $_POST['name']; 

使用:

$player_name = $_SESSION['username']; 

在此之前一定要使用session_start()。