Sessions and Caching. Problems encountered with the "Back" button!

ElMongol

Hi,

I'm a relative newcomer to PHP, thrown in at the deep-end in a new job! So I'd appreciate some help 🙂

I've constructed a series of 5 forms for the user to fill in, at the end of the series, there's a final page which displays the input, and allows the user to go back and edit each form.

Each form has 4 "modes". They are:

1 (One) - User input of info into blank page
2 (Two) - Validation/handling of the above input
3 (Three) - User editing existing info
4 (Four) - Validation/handling of the above

The final form (the one which reviews the input) sets $SESSION['edit'] to true. Quite straightforward eh? So if any of the 5 pages is accessed and ($SESSION['edit']) then I've made the script go to mode 3:

if ($_SESSION['edit'])
/*
If $edit is set to true (1) if being refered back from end.php.
So if we've been sent here from end.php, then we're editing an existing record.
*/
{
	$_SESSION['edit'] = 0; // reset to false (0)
	$_SESSION['nextfunc'] = 3;
}

Now you'll notice there's a session var called "nextfunc" - this is important! It's the way we decide which function to call (remember the list above?)

I was very exciting and called the functions (modes) like the above:

if ((!$_SESSION['nextfunc']) AND (!$_SESSION['edit'])) // 1 (One) - User input of info into blank page
{
	$_SESSION['nextfunc'] = 2;
	modeone ();
}

elseif ($_SESSION['nextfunc'] == 2) // 2 (Two)- Validation/handling of the above input
{
	$_SESSION['nextfunc'] = 0;
	modetwo ();
}

elseif ($_SESSION['nextfunc'] == 3) // 3 (Three) - User editing existing info
{
	$_SESSION['nextfunc'] = 4;
	modethree ();
}

elseif ($_SESSION['nextfunc'] == 4) // 4 (Four) - Validation/handling of the above
{
	$_SESSION['nextfunc'] = 0;
	modefour();
}

else // 5 - If something goes wrong.
{
	echo "<div align=center>
<h1>Something went wrong, and it's most likely <b>YOUR</b> fault!</h1>
<h2>Mail the <a href=mailto:me>administrator</a> please, and say that you're seeing this screen.</h2>
</div>";
}

So hopefully you understand how it works now?

User comes to the page for the first time, so we go to the function "modeone". The action of each <form> is $PHP_SELF by the way. Then upon submission we go to "modetwo". If all is fine (passes validation), this happens:

header("Location: [url]http://localhost/perstest[/url]".$_SESSION['nextpage']);

^ The PHP parsing thingy here turned that into a url, not me! ^

"nextpage" is the name of the next page in the sequence, it's set manually at the top of each page like so; $_SESSION['nextpage'] = "foo.php". Still with me? I told you it would be complicated!

Anyway, the user will eventually go to the nextpage, then the next, etc. Until they reach the end page. Here they can go back to each page (we set $_SESSION['edit'] = 1😉. So this make the page serve "modethree", which is essentially "modeone" but with the fields filled in from the user's input. Oh! "Where's the input stored?" you ask? Well, after each successfull page completion, it's saved in the database, rather than storing it up as we go along for insertion at the end. The reasoning is that "eventually" I'll make it so people can login, complete a few pages, then come back another time.

So, hopefully now you see how it all works?

What's the problem? I'll tell you!

Pressing the browser's "Back" button, will do one of two things (depending on your browser):

1 - Take you back to the previous form, but it's empty.
or
2 - Give you a "page expired" error msg.

But I solved this! I put at the top of each page:

session_cache_limiter('public');

Which was lovely, and it worked great!

Except it then messed up going from the "Edit" page, back to any of the 5 "form pages" - it tended to deliver you to "modetwo" - irrespective of the fact that "edit" was true.

So my question (Hurrah! Finally!) is something like: How can I make sure that the back button remains fully functional (else Jakob Nielsen will hunt me down and kill me with his teeth!) whilst at the same time not doing anything that messes up my session vars? Just to recap, at the top of each page is:

session_start();
session_cache_limiter('nocache');
ob_start ();

I hold the output buffers, as I user the header() command to send users to either the nextpage, or the endpage - depending on the "mode".

Sorry for such a long post, but I tried to be as descriptive as possible.

Thanks!

planetsim

well its you cache_limiter(); thats the problem which you may have already guessed. Now thats why its going to mode to.. if my thinking is right the cache_limiter(); has either deleted that session or recongnised that the visitor has been there...

Now im not sure on what you can do except made it a pop up window and disable back space but then you can right click and still do the same..

Other than that id suggest get rid of the cache limiter and hope no one presses back

ElMongol

Yeah, that's what I did in the end :-(

Thanks anyhoo!

(quite annoying though, surely this isn't an unusual problem?)

planetsim

ive never actually used that limiter at all.. i cant seem to find anything really useful for it.. but maybe if this is a register form which is what it sounds like.. why do you need all the pages.. 1 big page is good.. then sendem back if somethings wrong to do it all over again..

daveyboy

Thing is, the standards say a browser should NOT cache pages containing POST data. IE does cache the pages - since when did MS pay attention to any standards? - so you can print it, but other browsers may ask if you want to resubmit the form or just say, 'invalid page'. This is CORRECT behaviour.

I don't really understand why you need your modes set in the session - remember you cannot guarantee that the user will go to the next page or the previous one. He may go from the last page to the second or open 2 pages in seperate windows, which might leave your session flag invalid.

Why can't you use $GET and $POST vars to tell whether the user has submitted a form or wants to edit it, e.g. 'myfile.php?mode=edit'? This way, the mode of the page will always be relevant to the current page, and not a page the user may have open in another window.

ElMongol

Originally posted by planetsim
ive never actually used that limiter at all.. i cant seem to find anything really useful for it.. but maybe if this is a register form which is what it sounds like.. why do you need all the pages.. 1 big page is good.. then sendem back if somethings wrong to do it all over again..

Ah no. It's actually for job applications. Four pages; 1. Personal Info 2. Education 3. Experience 4.References/Statement

Plus equal ops too.

The limiter tells the browser what to do with the cache - as it's not supposed to cache POST stuff - however, if a user presses [back] because they know they made a mistake, they'll see that all the info is gone. Which is annoying!

Cheers,

ElMongol

Originally posted by daveyboy
Why can't you use $GET and $POST vars to tell whether the user has submitted a form or wants to edit it, e.g. 'myfile.php?mode=edit'? This way, the mode of the page will always be relevant to the current page, and not a page the user may have open in another window.

This is my first real, sole PHP development. I'm a "re-skilled" designer, if the truth be known 😉

But anyway, I think I'll recode it if I get time. Shame really, as I thought the Mode/Session thing was a great idea 🙁