problem with $_SERVER['PHP_SELF']

Question

I have a link in one of my php pages where the friends of the logged in user are shown and there is a link like below for each of user's friends like this in this page:

echo "<a href='profile.php?id=$row[friend_id]'>$friend_row[name]</a>";

and as you can see the friend's ID is passed to the profile page and in profile page the user can see their profile and leave comments for them. Here is the form:

<form name="comment" method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>">
    <input type="text" name="comment" class="comment" />
    <input type="submit" name="submit" value="submit" class="comment" />
</form>

and this php code follows:

$insert="INSERT INTO comment (login_id,friend_id,msg)
                    VALUES ('$_SESSION[friend_id]','$_SESSION[id]','$_POST[comment]')";
$result = mysql_query($insert) or die(mysql_error());

Now my question is that $_SESSION[friend_id] which is equall to $_GET[id] by this command $_SESSION[friend_id]=$_GET[id] and was passsed to the page earlier has got no value and appears to be 0 on my SQL table after submitting the form. I tried to echo it before this php script get executed and it had the right value but after this php code is executed,it's gone!!!

Can anyone please tell me why?

Answer 1

No one can tell you why your variable contains a different value than you expect unless you post the code which actually initializes it, but just about everyone can tell you that shoving anything you pull out of the $_GET superglobal array into an SQL query is a terrible idea.

Answer 2

SQL injection woes aside, it seems like your session is not initiated...

If you are going to use the $_SESSION variable in any PHP file, always make sure you have session_start(); at the beginning of that file..

Hope that helps...