If you replace the variables with the actual data, your first example (correct code) is:
if( dy337y==dy337y&&1) Note: you are AND’ing a string with a number. !empty is either 0 or 1
for the incorrect code:
if( gh8rwp==NULL&&1) Note: an empty variable is either tested as NULL or 0, both will not work here!
So, this has turned out a bit tricky and confusing. Also, the second display showed another error. You only UNSET the security value when the results are positive, you leave it in place if the tests fail. That is why your second display showed the gh8rwp. this was due to the fact that the compare fails because of the ANDing of the string with the isset’s 1. Hope that made sense. So, here is one way to correct these issues.
For these two lines:
if( isset($_POST[‘submit’]) && isset($_SESSION[‘security_code’]) ) {
if( $_SESSION[‘security_code’] == $_POST[‘security_code’] && !empty($_SESSION[‘security_code’] ) ) {
Change them to this:
[php]
if( isset($_POST[‘submit’]) && isset($_SESSION[‘security_code’]) ) {
if( $_SESSION[‘security_code’] == $_POST[‘security_code’] ) {
[/php]
What this does is only process all the code if it is SUBMITTED and has a SESSION security_code set and then removes the extra compare. The other way would be to add ()'s around the == section, but, this way is better. Note that in the first compare, you are ANDing (&&) bits, 0 and 1 in whatever combination they happen to be. ANDing 0’s and 1’s are always correct. No mixed data-types such as strings and 1’s as in the old versions. Then, the second compare is a straight forward one.
As far as the old security code being left active, you can UNSET it after the message that they have given an incorrect security code at the end. Also, you may want to UNSET it after the an email error where it says email-error-message-not-sent. In that way, they have to retype the code if an error occurs.
Let us know… And, sorry that I didn’t catch that tricky compare issue sooner! Hope it works!