PHP member's page works without users credentials? - php

Question

I have this php member page which will show a very basic information from the mysql database.
The issue that i noticed is that if you are logged out and visit the members page i.e. http://www.mywebsite.co.uk/member.php?id=17 and refresh the page from the browser, it will log you into the users account. and it doesn't really matter where and who it is. it will just logs the visitors into that account with id 17 or any other id on PAGE Refresh!!
this is my code for member.php
<?php
error_reporting(E_ALL);
ini_set('display_errors', '1');
?>
<?php
session_start(); // Must start session first thing
// See if they are a logged in member by checking Session data
$toplinks = "";
if (isset($_SESSION['id'])) {
// Put stored session variables into local php variable
$userid = $_SESSION['id'];
$username = $_SESSION['username'];
$toplinks = '' . $username . ' •
Account •
Log Out';
} else {
$toplinks = 'Register • Login';
}
?>
<?php
// Use the URL 'id' variable to set who we want to query info about
$id = preg_replace("[^0-9]", "", $_GET['id']); // filter everything but numbers for security
if ($id == "") {
echo "Missing Data to Run";
exit();
}
//Connect to the database through our include
include_once "config/connect.php";
// Query member data from the database and ready it for display
$sql = "SELECT * FROM members WHERE id='$id' LIMIT 1";
$query = mysqli_query($db_conx, $sql);
$count = mysqli_num_rows($query);
if ($count > 1) {
echo "There is no user with that id here.";
exit();
}
while($row = mysqli_fetch_array($query, MYSQLI_ASSOC)){
$username = $row["username"];
$_SESSION['username'] = $username;
$userid = $row["id"];
$_SESSION['id'] = $userid;
// Convert the sign up date to be more readable by humans
$signupdate = strftime("%b %d, %Y", strtotime($row['signupdate']));
}
?>
anyone can spot the reason why this is happening?
Thanks

Answer 1

Because obviously you're making them logged in. Checkout this line;
$_SESSION['id'] = $userid;
What's your main purpose with this line ?

Answer 2

// Use the URL 'id' variable to set who we want to query info about
$_SESSION['id'] = $userid;
That's the issue right there. Don't pull in data from the url if you want your application to be secure.
After you've checked that their username and password are correct set a variable equal to their user ID and use that value to log them in.