Member Avatar for andrewliu

Hello,

If a user logs in with an email address and I have a session to save its email address so I can pass it along to other pages, how does it work if the user decides to update their email address in their account page? Will the session that was saved before the update, also change too when updated?

Do I have to make the user log back out so when they log back in, their new email is being saved in the session?

Thanks

  • 4 Contributors
  • 6 Replies
  • 122 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by andrewliu

Dani AI

Generated

Short answer and practical guidance for future readers: PHP session data lives on the server and does not automatically mirror database changes. If an email address was saved into the session at login, updating that email in the database will not change the session value unless server-side code explicitly updates the session or the application fetches fresh data from the database.

Two common, practical patterns (tradeoffs included):

  • Keep only a stable identifier (user id) in the session and read mutable fields like email from the database when needed. This avoids stale-session issues and is the pattern was pointing at.
  • If convenience requires storing email in the session, update the session value after the DB write completes (no need to force logout). Reassign the session key and consider regenerating the session id to reduce fixation risk. Example snippets:
/* after successful DB update */
$_SESSION['email'] = $newEmail;
session_regenerate_id(true);
/* recommended: store id at login */
$_SESSION['user_id'] = $userId;

/* later, load current email from DB using user_id */

Security and reliability notes: always use HTTPS for logins (Firesheep showed the risk), set cookie flags (Secure, HttpOnly, SameSite), enforce reasonable session timeouts, and call session_regenerate_id at login/privilege changes. See PHP session docs and OWASP session-management guidance for full hardening steps (PHP sessions, OWASP Session Management Cheat Sheet).

Tie-back to the thread: ’s suggestion to reassign after update works for immediate sync; ’s user-id approach is more robust long-term; ’s caution about using email as a login identifier is worth considering when designing authentication.

Recommended Answers

All 6 Replies

Member Avatar for qazplm114477

You could reassign the session on update to the new email address

Member Avatar for jrotunda85

One option to consider is storing a unique UserID in the session as opposed to something that could change. Doing so will allow you to populate any field (including e-mail address) while ensuring that if changes are made you don't have to destroy the session.

commented: that made more sense! +1
commented: yep +8
Member Avatar for Member #120589

I have to admit, jr has a nice little solution there. The user id will not change. I try to avoid using email addresses as logins, but I realise that this is an increasingly popular way to access sites.

Member Avatar for qazplm114477

yeah, jrotunda85 method is better than storing an email address into a session. as long as you have the user id stored in that session, you can always retrieve the user's email address. for security reasons, relying in sessions alone can be risky, session hijacking has been made easy thanks to a firefox plugin that was made. Use a combination of cookies and sessions or add more security to the login page, like session timeouts and stuff OR get a SSL certificate to encrypt your login.

Member Avatar for Member #120589

Good point. Firesheep really made me stand up and take note. I've discussed this with colleagues and we now avoid logging into 'open' sites on our school wifi. Darned technology!

Member Avatar for andrewliu

Great inputs guys! I will use unique IDs as sessions now! But I would like to use it in combinations with session emails. Maybe I can set it so if these two are equal and in the same row, then user is logged in.

Thank you! I will research in using cookies as well and timeouts. Thank you for the heads up. I will eventually get a SSL certificates!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.