Is it safe to store the value in a session variable and make queries on the value?

Question

I have a website where the username is stored in a session variable at login. I am wondering if it is possible to make requests from the value stored in this session variable?

Answer 1

yes , the session is stored on the server side.

instead of saving the username, you can save the user ID (int) so that it takes up less server space. Remember that you must handle CSRF and session capture

Answer 2

, . , ( - ). - , , ( , $foo = 'bar';). - , ...

Answer 3

, , , . , , ; .. .

, SQL- , , , . , -, . , .

Answer 4

.

, , (HTTPS), - (cookie, , .)

, , , .

, :

, , SQL-, SQL.

Answer 5

in fact, it’s safe to use any variable in an SQL query if you follow the syntax and security rules.

And the data source has nothing to do here. Regardless of whether it is a session or file, or an RPC request or POST data. All data is equal for the request and should always be processed the same.

I know this is hard to understand, but it is very important, so at least give it a try.