PHP 4.0.6 session variable hell

Samaritan

Hi - I'm pretty new to php - I have a script that is working on my local server (the macromedia user authentication script), but it uses _SESSION and the server I am deploying to (4.0.6) doesn't like it.

I can't get any session variable to work, could someone who knows about these thing point me in the right direction?

Server session settings below:

session
Session Support enabled

Directive Local Value Master Value
session.auto_start Off Off
session.cache_expire 180 180
session.cache_limiter nocache nocache
session.cookie_domain no value no value
session.cookie_lifetime 0 0
session.cookie_path / /
session.cookie_secure Off Off
session.entropy_file no value no value
session.entropy_length 0 0
session.gc_maxlifetime 1440 1440
session.gc_probability 1 1
session.name PHPSESSID PHPSESSID
session.referer_check no value no value
session.save_handler files files
session.save_path /tmp /tmp
session.serialize_handler php php

session.use_cookies On On

Thanks for your time
samaritan

maybl8r03

The session settings looks quite vanilla. It is set to no session.auto_start which means that you will have to do a session_start() logic in your code. To be absolutely certain I do this


session_start();

Session documentation in PHP is rough - do not use session_register("xxx") if you are using $_SESSION vars.

Samaritan

Yeah - I am using session_start(), I have tried with $SESSION, $HTTP_SESSION_VARS, $GLOBALS[HTTP_SESSION_VARS], no joy with any of them - if I go

session_start();
$var="fun";
session.register('var');

and then use a link, ie let the HTML page load and click on a link, then it passes through a PID and the session is there to use, but if I try to redirect - even using a javascript redirect I lose the session.

Does this mean that the server is not saving my session properly? or that I'm not getting it properly???

Thanks for your quick response by the way

samaritan

maybl8r03

You might want to add the PHPSESSID into your GET vars

when you redirect:

$strCurrentSess = session_id();
session_start();

echo "<script language=\"javascript\">document.location='?PHPSESSID=". $strCurrentSess."';</script>";

This SHOULD be automated because your sessions are using cookies but apparently not...

session_id() should be called before session_start().

Samaritan

Ah - I have to go:

session_start();
$strCurrentSess = session_id();

and then append that to my URLs.

Does that mean that the server can't write to the server.cookie_path? And does it always do this session variables by using cookies? and isn't that not so secure?

but hey - if it works 😃

oh - and the session.cookie_path is set to /

would that be messing with things?

Thanks for your help

samaritan

Samaritan

Wooooh... I'm going mad - I swear there was another post in here...

Yeah - I am using session_start(), I have tried with $SESSION, $HTTP_SESSION_VARS, $GLOBALS[HTTP_SESSION_VARS], no joy with any of them - if I go

I have

Jeb_

Originally posted by Samaritan
Does that mean that the server can't write to the server.cookie_path? And does it always do this session variables by using cookies? and isn't that not so secure?

1st Question: No. It might be a case of your browser not accepting the cookie. It could also be a flaw in PHP 4.0.6 - I wouldn't know, I started with PHP 4.1.0. Ask your browser to prompt you for cookies and load up a fresh session. See what happens.

2nd Question: Yes, that is the default.

3rd Question: No. It's actually more of a risk by passing the ID through URL's instead of cookies.

If you want to automate the process of appending the ID to URL's, make use of the session.use_trans_sid directive. I'm not sure if it can be set a runtime though. The PHP manual will tell you more.