Session vars and cookies blocked

nobru

Hi there,

I don't wanna use cookies on my site, only sessions.
But if I block all cookies in my browser options, session vars do not work anymore (session registered vars are not available).
So what test can I conduce so that I can check that sessions vars are blocked?

I tried the following:
// On the home page (index.php)
session_register("acceptcookies");

// And on another page (for ex. search.php), accessed from the home page
if(isset($_SESSION['acceptcookies'])){
echo("Session cookies accepted<br>");
} else {
echo("Session cookies refused");
}

if(isset($SESSION)){
foreach($SESSION as $c=>$v){
echo ($c. " is worth ".$v."<br>");
}
}

... then I'll get this (output):
Session cookies refused (eg $SESSION['acceptcookies'] IS NOT SET)
acceptcookies is worth (Doesn't this mean that $SESSION['acceptcookies'] is set???)

I am really confused...
Thanks in advance for any enlightening, I am in the dark.

Bruno

Quevas

Are you using session_start() ?

nobru

I am afraid yes...

Weedpacket

From the manual
Passing the Session ID

There are two methods to propagate a session id:

Cookies
URL parameter

The session module supports both methods. Cookies are optimal, but since they are not reliable (clients are not bound to accept them), we cannot rely on them. The second method embeds the session id directly into URLs.

PHP is capable of doing this transparently if compiled with --enable-trans-sid. This option is always enabled in PHP 4.2 and later. If you enable this option, relative URIs will be changed to contain the session id automatically. Alternatively, you can use the constant SID which is defined, if the client did not send the appropriate cookie. SID is either of the form session_name=session_id or is an empty string.

nobru

WeedPacket, I am not talking about session IDs, but thanks anyway.

Take a look at this, this is interesting:
Let's consider I only have this piece of code on a page index.php.

<?
session_start();
$acceptcookies = 1;
session_register("acceptcookies");

$acceptcookie = 1;
session_register("acceptcookie");

$acceptcookiez = 1;
session_register("acceptcookiez");

$aceptcookies = 1;
session_register("aceptcookies");

if(isset($SESSION)){
foreach($SESSION as $c=>$v){
echo ($c. " is worth ".$v."<br>");
}
}
?>

When I launch the page and then refresh, something weird happens.
I get this as an output:

acceptcookies is worth // Weird, huuuu?
acceptcookie is worth 1
acceptcookiez is worth 1
aceptcookies is worth 1

Is that a bug???
Nobru😕

Weedpacket

Originally posted by nobru
WeedPacket, I am not talking about session IDs, but thanks anyway.

Well, you must be, because that's how PHP identifies sessions - hence the name. What the entry says is that if PHP can't store the session id as a cookie, it will stick it in the URL instead.

Take a look at this, this is interesting:
Let's consider I only have this piece of code on a page index.php.

...

When I launch the page and then refresh, something weird happens.
I get this as an output:

acceptcookies is worth // Weird, huuuu?
acceptcookie is worth 1
acceptcookiez is worth 1
aceptcookies is worth 1
[/B][/QUOTE]

I cut and pasted your code and got all 1's.

But why waste time and effort with session_register() anyway? Just use $_SESSION and be done with it.

nobru

Looks like weird things are happening on my system.
I did the acceptcookie test outside the rest of my code and it worked, but i have no clue why id didnt in the rest of the code.

My problem is that I do not use global vars and I have some pages that require login.
So I used to store my data in session vars (so that they are "persistent" all over the browser life, but how can I do then if cookies are blocked? It just doesnt work.

And his PHPSESSID secure enough to this purpose?