HTTP_SESSIONS No Go...TRY IT!

jbutler

Someone please try this simple experiment and enlighten me as to what PHP is considering a "session". I have register_globals turned on...or off, doesn't make any difference to this.

=========test1.html========
<?
if ($uname) {
session_register("mem");
$HTTP_SESSION_VARS["mem"]=$uname;
}
echo session_name().'<br>';
echo session_is_registered("mem").'<br>';
echo $HTTP_SESSION_VARS["mem"].'<br>';
?>
<form>
<input name="uname">
</form>
<a href="test2.html">Next</a>

==========test2.html========
<?
echo session_name().'<br>';
echo session_is_registered("mem").'<br>';
echo $HTTP_SESSION_VARS["mem"].'<br>';
?>
<a href="test1.html">Previous</a>

============================
For me, the results are:

Test1: works fine, reporting the session_name, that "mem" is registered with the session, and correctly echoing that var.

Test2: oops...reports only the (same) session name...no "session" variable.

Please note that there isn't really anything in between the two pages that would cause the session to dump its variables...or am I missing something?

I've tried HTTP_STATE_VARS, gc_globals, turning register_globals on and off, GLOBALS...ad infinitum.

I can ONLY keep the variables alive by propagating them in the URL, which I would rather not do, because many visitors send the URL they see to their friends, which is a big security risk when the URL string includes login information.

I reallyreally appreciate any modifications to the above code or my server settings that will allow me to use sessions.

Thanks a lot in advance!

Using: FreeBSD 4.4, PHP 4.1.2

PHP Config: './configure' '--enable-inline-optimization' '--with-apxs=/usr/local/apache/1.3.12/bin/apxs' '--with-config-file-path=/usr/local/lib' '--disable-debug' '--enable-memory-limit' '--with-gettext' '--without-pear' '--with-regex=system' '--enable-mbstring' '--enable-mbstr-enc-trans' '--with-iconv=/usr/local' '--with-gdbm=/usr/local' '--with-dbm=/usr/local' '--enable-sockets' '--enable-versioning' '--enable-ftp' '--with-imap' '--with-mcrypt=/usr/local' '--with-mhash=/usr/local' '--with-mysql=/usr/local/mysql' '--with-zlib' '--with-zlib-dir=/usr'

PHP.ini: session_autostart = 1
(track_vars is always on as of v.4.0.3)

jbutler

By the way, in my sessions_path directory I can see all of the sessions, and when I open a recent one (created during my test of the previous code), I can see the "mem" variable with the appropriate value.

So it's not like PHP isn't recording the session, it's just not remembering where it put it, or something.

Thanks again.

jbutler

I added:

echo session_id().'<br>';

to the results display on both test pages and it's clear that there is a new session being initiallized for each page.

Now why is that?

Anon

1) It won't work if register_globals is turned off, because then $uname won't have its proper value. Use $_GET['uname'] instaead.

2) session_register('mem') is unneeded.

3) Ditto for session_is_registered: use isset($HTTP_SESSION_VARS['mem']) instead.

4) Since you're using PHP4.1.2, you might as well use $_SESSION[] instead of $HTTP_SESSION_VARS[].

With those changes (and a couple more because I don't have .html parsed as .php and I don't have automatic session starting) I get:

test1.php:

<?
session_start();
$uname=$GET['uname'];
if ($uname) {
$SESSION["mem"]=$uname;
}
echo 'ID:'.session_id().'<br>';
echo 'Isset:'.isset($SESSION['mem']).'<br>';
echo 'Mem:'.$SESSION["mem"].'<br>';
?>
<form action='test1.php'>
<input name="uname">
</form>

<a href="test2.php">Next</a>

test2.php

<?
session_start();
echo 'ID:'.session_id().'<br>';
echo 'Isset:'.isset($SESSION['mem']).'<br>';
echo 'Mem:'.$SESSION["mem"].'<br>';
?>

<a href="test1.php">Previous</a>

Which work for me. Dropping the session_start() lines and changing the .php extension to .html would match your configuration.

jesus_hairdo

try passing the session id in the URL, so in the <a href=test2.php> change it to:

<a href="test2.php?PHPSESSID=<?=session_id()?>>
It might be that magic quotes is not on, or isn't working properly.
Part of magic quotes is that it tries to automatically add the phpsessid to the URL / set a cookie with the session ID in / add a hidden input to a form that passes the session ID. This doesn't always work, so its best to manually add these.

jbutler

Still not happening, although I appreciate your approach.

Every page request results in a new PHP session starting. This is the root problem. When I go to read from the session, there's nothing in it because it's a fresh session.

Please look over the config settings in my first message for clues...if there are any.

I HAVE been passing variables in the URL, but I no longer wish to do this for security reasons that I mentioned in the first message. I really want to use sessions.

Thanks for more comments and code! This isn't solved, yet...

jbutler

Ooooohhh...okay...

So the session is ONLY maintained EITHER (a) through cookies OR (b) through the URL. There is NO other way in which the session is tagged for reference.

No INETD, MAC address, or IP reference is used...JUST the cookie or URL variable.

[Assuming your PHPSESSIONID is named PHPID, in php.ini or through a session_name() assignment:]

======test1.php======
<?
$uname=$GET['uname'];
if ($uname) {
$SESSION["mem"]=$uname;
}
echo 'ID:'.session_id().'<br>';
echo 'Isset:'.isset($SESSION['mem']).'<br>';
echo 'Mem:'.$SESSION["mem"].'<br>';
?>
<form>

<input type="hidden" name="PHPID" value="<?echo session_id()?>">
<input name="uname">
</form>

<a href="test2.php?PHPID=<?echo session_id()?>">Next</a>

======test2.php======
<?
echo 'ID:'.session_id().'<br>';
echo 'Isset:'.isset($SESSION['mem']).'<br>';
echo 'Mem:'.$SESSION["mem"].'<br>';
?>

<a href="test1.php?PHPID=<?echo session_id()?>">Previous</a>

THIS works.

As long as the session id is passed, then variables stored with that session can be retrieved from it. Without the URL-addition OR setting and retrieving a cookie to "remember" the session, it has no reference, and starts a new session with each request. (Note that session_auto_start is set to true in php.ini)

Whew! Not so bad. I was imagining some super-intelligence at work in PHP sessions, but it turns out to be quite logical.

Thanks for everything, y'all. Problem solved!