How do I put a session value into a javascript?

Question

I have a session['password']. I would like to get the session value and use it to validate against user's input.

if(opw != $_session['password']){
      errors[errors.length] = "Sorry, password does not match.";
}

This is what I have been trying, however if I input this they do not read the session. And ignore this conditions. How do I actually insert session value into Javascript?

Answer 1

Your inline JavaScript code:

var session = <?php print $_SESSION['password']; ?>;

Is that what you're looking for?

Answer 2

You need to surround the $_SESSION in <?php echo ?> . This causes the PHP variable to be printed into the Javascript on the page.

if(opw != <?php echo $_SESSION['password']; ?> ){

However, this is a deeply insecure method of checking a password and I advise against using it. If not transferred over SSL, the password will be sent in plain text on every page view. Furthermore, it is likely to be cached by the web browser where anyone with access to the computer may read it.

Answer 3

You'll have to actually echo out the errors manually:

// do all of your validation and add all of the errors to an array.
if($opw != $_session['password']){
     $errors[] = "Sorry, password does not match.";
}

echo "<script type=\"text/javascript\">var errors =  ".
          json_encode( $errors ).";</script>";

Then, later:

<script type="text/javascript">alert(errors)</script>

Answer 4

Please note that PHP is totally different from JS. PHP is a server side coding-language, meaning it get's executed when your server is rendering the requested page. In that page (which contains some HTML) there can also be JS. However, JS cannot connect to PHP in the way you think it does. For this you could use Ajax or something (but that's way too complicated for the goal you're trying to achieve).

You probably want something like this

// eg. index.php or something
...
<?php
session_start();
if ($_POST['password'] == 'somePassYouDefined') {
    echo 'Authenticated';
}else if (isset($_POST['password'])) {
    echo 'Couldn\'t authenticate ...';
}else {
    ?>
    <form method='post'>
        <input type='password' name='password' placeholder='Password' />
        <input type='submit' />
    </form>
    <?php
}
?>

Answer 5

As the other answers have suggested, you have to embed your PHP session value into the javascript when the page is generator. But the others have forgotten one important thing - you have to generate VALID javascript or your entire script will get killed with a syntax error.

if (opw != <?php echo json_encode($_SESSION['password']) ?>) {

Note the call to json_encode - it's not just enough to output the password string. You have to make sure that the password becomes a VALID javascript string, which json_encode ensures.

Answer 6

ASP version:

if(opw != '<%=Session("password")%>' ){

I added quotes because a password is usually a string.

When the user runs this script, the html page that is downloaded to their computer will display the password IN PLAIN TEXT, ie:

if(opw != 'BOBSPASSWORD' ){

So, if they don't know or have a password, they can view/source and find it.