help with php_sessions

[bakaneko]

I am having trouble with php sessions. Everytime I go to a new page the session isnt the same. I am using apache 2, mySQL, and php 4.3.2 windows to develop a webinterface.

I started the session here in my Login.php:

session_start();
session_register('auth');
session_register('logname');

Then because the session couldnt work i used a hidden form to go to the members_page using this code:

echo "<form action = 'http://some_ip/Member_page.php' method='post'>

<input type = 'hidden' name = 'PHPSESSID' value = '$PHPSESSID'>
<input type = 'submit' value = 'Next Page'>
</form>";

Then in the members_page I tested the session IDs to make sure they are matching like this:

<?php
session_start();
$PHPSESSID = $_POST['PHPSESSID'];
$TEST = session_id();

if ($TEST != $PHPSESSID)
exit();l

...
?>

I want to have it so that they can use just links to navigate the members pages and not have to hit the submit form button. What am I doing wrong?

Thanks,

Bakaneko

😕

[savtrader]

I'm pretty sure the session function sets a cookie to pass the session id or is supposed to. Try this to pass the ID in a link or in a post var.

Use 'SID' to add session name value to a link.
use 'session_id()' to obtain the session ID only.

<?php
print "<p>".SID."</p>\n";
print "<a href=\"nextpage.php?".SID."\">link to next page</a>\n";
print "<p>Use this function to show just the Session ID ".session_id()."</p>\n";
?>

Be sure to call 'session_start()' prior to printing any html and use session_start on all session pages.
<?php
session_start();
?>

Bill

[bakaneko]

kewl... works!
but is there a way to hide the session id in the url? or no?
is there a security issue with that?

thanks alot,

bakaneko