Is it bad using $_SESSION['id'] in queries?

Question

When person logins, he gets $_SESSION['id'] and it becomes his id taken from mysql table. Then I do mysql queries like SELECT * FROM members WHERE member_id = {$_SESSION['id']}.

So, is it safe? Can $_SESSION['id'] disappear or could hacker edit it somehow?

Thank you.

Answer 1

I would argue that it is always bad to create a query by simply inserting or concatenating variables. Instead, you should use a Prepared Statement that will guarantee protection against SQL Injection type attacks. IMHO, they also make code look better.

Answer 2

In theory, there is no way that clients can affect $_SESSION array, beacuse session data is stored on the server. But in practice, never trust this, because hacker can use another security hole and substitude $_SESSION['id'] with something bad.

Do this, before putting id into your query:

$_SESSION['id'] = intval($_SESSION['id']);