passing form variables and using sessions

Dedix

I have a form with error checking, if I submit it, and there were any error, without using session_start() it's ok. But if I use this function, I lose all filled data from the fields, so I need to fill them all again even if there was only one wrong field. I use a javascript link (javascript:history.go(-1)) to get back to the form if there was an error.
It would be good if it worked with sessions also, beacause I need to use sessions for usermanagment.

Does anybody have any idea why is that, and how can I fix this problem?

Weedpacket

Without seeing any code we can only make wild unsubstantiated guesses. Mine is that you're using register_globals and session_register and so dumping all your variables from both sources into the same names instead of $POST[] or $GET[] for your form variables and $_SESSION[] for your session variables.

Dedix

My form is not in in php. I use templates (html).
So I have a simple form in html, and an error checking function in php, but as I said, if I comment the line "session_start();" it works fine.

Dedix

Here is some code examples.
(I hope it helps to help me out 🙂

From form template file:

<form action="index.php" method="POST">
<input type=hidden name=mode value=signup>
<tr>
	<td width="1"></td>
</tr>
<tr>
	<td colspan="2" align="center" valign="middle" class="in">
	<table cellpadding="1" cellspacing="0" border="0">
	<tr>
		<td colspan="2" align="left" class="regtblhead">szükséges regisztrációs adatok</td>
	</tr>
	<tr>
		<td colspan="2" align="left" class="in">Az alábbi adatok megadása kötelezõ.</td>
	</tr>
	<tr>
		<td colspan="2" align="left" class="in">&nbsp;</td>
	</tr>
	<tr>
		<td align="right" class="in" nowrap>Felhasználói azonosító?&nbsp;</td>
		<td> <input type="text" name="username" class="form" style="width: 150px" maxlength="32" value=""></td>
	</tr>

From inxex.php file: (signup)

case 'signup':

if ($lang == "hu" || $error) { $t->set_file(array("mainpage" => "hu.registration.form.ihtml")); }
if ($lang == "en") { $t->set_file(array("mainpage" => "en.registration.form.ihtml")); }
if ($lang == "") { $t->set_file(array("mainpage" => "hu.registration.form.ihtml")); }

if ($action == reguser) {

CheckEmpty2($username,$MsgRegEmptyUsername);
CheckEmpty2($useremail,$MsgRegEmptyUseremail);
CheckIfMatch($useremail,$useremail2,$MsgRegErrorUseremail2);
CheckEmpty2($usernick,$MsgRegErrorUsernick);
EmailIsValid($useremail,$MsgRegErrorUseremail);
UsernameIsValid($username,$MsgRegErrorUsername);

$pw_plain = RandPw($pass_length);
$userpw=md5($pw_plain);
$acode = CreateActivationCode($acode_length);

$userregdate = time();
$userinterests = "$ui1\n$ui2\n$ui3\n$ui4\n$ui5\n$ui6\n$ui7\n$ui8\n$ui9\n$ui10\n$ui11\n$ui12\n$ui13\n$ui14\n$ui15\n$ui16\n$ui17\n$ui18\n$ui19\n$ui20\n$ui21\n$ui22\n$ui23\n$ui24\n$ui25\n$ui26";

$ui = trim($userinterests);

$result = $DB_site->query("
INSERT INTO $dbtbl_members (user_name,user_email,user_pw,user_regdate,user_acode,user_nick,user_gender,user_dob,user_city,user_zip,user_country,user_prof,user_income,user_computer,user_cellphone,user_car,user_creditcard,user_netaccess,user_spentonl,user_buyonl,user_os,user_interests,user_icq,user_aim,user_yahoo)
VALUES ('$username','$useremail','$userpw','$userregdate','$acode','$usernick','$usergender','$userdob','$usercity','$userzip','$usercountry','$userprof','$userincome','$usercomputer','$usercellphone','$usercar','$usercreditcard','$usernetaccess','$userspentonl','$userbuyonl','$useros','$ui','$usericq','$useraim','$useryahoo')
");

	SendActivationMail($username,$useremail,$pw_plain,$usernick,$acode);

echo "<script>alert('MSG!\\n\\n- A regisztráció sikeres volt.";
echo "');document.location.href ='index.php';</script>";
echo "<noscript>MSG!<br>- A regisztráció sikeres volt.<br><br>";
echo "Használja böngészõje vissza gombját, hogy visszatérhessen az ûrlaphoz.</noscript>";
exit;

}
	break;

CheckEmpty function:
(suppose we have empty username field when submitting the form)

function CheckEmpty($strg,$errormsg ="")
{
	global $SiteFontFace,$MsgBackEditButton;
	$show ="";
	if($strg=="")
	{	echo TAG_Body($DefaultBGImage);
		include "./include/header.inc.php";
		include "./include/metatag.inc.php";
		echo "<div align=\"center\">";
		echo "<center><table border=\"1\" bordercolor=\"#000000\" width=\"$hibatablaszelesseg\" bgcolor=\"$szovegszin1\" cellspacing=\"0\" cellpadding=\"0\"><tr><td bgcolor=\"#000000\">";
	        echo "<font face=\"$FormFontFace\" size=\"$FormFontSize\" color=\"$szovegszin1\"><b>$hibafejlec</b></td></tr><tr><td align=\"center\">";
		echo "<br><b><font face=\"$FormFontFace\" size=\"$FormFontSize\" color=\"black\"><img src=\"kepek/egyeb/icon_stop.gif\" border=0> $errormsg</b>";
	        echo "<br><br></td></tr><tr><td bgcolor=\"#000000\" align=\"center\"><a href=\"javascript:history.go(-1)\"><font face=\"$FormFontFace\" size=\"$FormFontSize\" color=\"$szovegszin1\"><b>$MsgBackEditButton</b></CENTER></tr></table></div>";
		include "./include/footer.inc.php";
		exit;
	}
}

And here is the code that starts the session:
(I put this into the config file, so it's always called, but I have tried to enable session auto start in php.ini and got the same problem...)

if (defined('PHP_SESS')) session_start();

If I fill in the signup form correctly, but leave the username field empty and go back from the error page, all data vanish from fields.
But if change the session start line to: "

//if (defined('PHP_SESS')) session_start();

" (comment it) everything works fine, so I get all data back that I filled in after going back to the form from the error page. (Of course any session won't be created)

Weedpacket

My offhand guess (I usually use PHP to control what values forms are loaded with - partly because form processing is often handled by the same page) would be this:

With session_start() turned off, when you go back, since the request headers the browser sends would've be identical, your browser uses a cached copy of the form, and figured it might as well fill it out with the same form data.

But if the next page starts a session, it tries to create a cookie to store the session ID in. When you go back, that cookie needs to go into the request headers. Making it a different request, meaning that the browser doesn't use the cached copy of the form any more, which means it can't assume the data from the previous form is relevant anymore.

That's just a guess, though.