[Resolved] [Resolved] Header redirct looses SESSION data

razz

Let me start by saying I am new to php. I have a lot of Javascript and html experience, but now I'm lost. I have been searching this and other forums for this and while it seems similar to other questions, there is something very odd here. The pages I am doing are forms for testing ideas for a registration page.

The first form (register.php) echo's the POST back to itself for validation. If validation fails it redisplays the form with added text at the top to say "please fill in all required fields". This works great. I even got it to keep the data (although that code was removed during troubleshooting). This page has a session_start(); and a $SESSION=$POST; as the first and second lines. I have added 1 'test' SESSION variable with $SESSION['test'] = 5;.and I have also added text to see the session_id. Even a print_r($SESSION);. These are set to show if it is reloaded due to failed validate. After submit it all works and displays the test and session variables from the form fine. (I leave 1 field blank to force a fail). All seems fine. I HAVE session id, session variables and post variables.

<?php
session_start();
header("Cache-control: private"); //ie6 fix
$SESSION = $POST;

$_SESSION['test'] = 5;

if($POST["submit"])
{
if (!$POST["fname"] || !$POST["lname"] || !$POST["address"] || !$POST["city"] || !$POST["state"] || !$POST["zip"] || !$POST["hphone"] || !$POST["wphone"] || !$POST["email"])
{
$error = "Please check your required fields";
}else{
header('LOCATION: display.php');
}
}
?>
-html here-

The header line take syou to the next page which starts with session_start();. Now the problem: IT WAS WORKING. This page pulls variables out of $POST, and I have used $SESSION. Then id addslashes the data and places the data into MySQL. It also displays the variables. I added a stripslashes is all and it failed. I took out the stripslashes and still failed. So I added the session_id code. For a while both pages were diffferent id's. Now they are the same id but not even the test session variable works. All code works if I POST direct to the display page.

top of display.php

<?php
session_start();
header("Cache-control: private"); //ie6 fix
if($SESSION['test']){
echo 'GOOD';
echo $SESSION['test'];
}ELSE
{
echo 'BAD';
}
// extract form data

-DATABASE CODE IS HERE-

I added the test just see if a fixed session variable would come over, but nooooo. Not for me.

How can this be? Same ID and the SESSION's display indicate they are set. Yet I get empty records inserted into mysql. I tried everything to avaiod this request, but I am lost. One other thing is the "refresh". It causes the record to entered again. I know redirect to another page. No way to trap the refresh?

Anyway, I really thank you all in advance for any ideas.

Razz

kobmat

Try This ...

<?php
session_start();
session_register("any_random_text_you_want");
header("Cache-control: private"); //ie6 fix
$SESSION = $POST;

$_SESSION['test'] = 5;

top of display.php

<?php
session_register("any_random_text_you_want");
header("Cache-control: private"); //ie6 fix
if($SESSION['test']){
echo 'GOOD';
echo $SESSION['test'];
}ELSE
{
echo 'BAD';
}
// extract form data

-DATABASE CODE IS HERE-

The think you lost all the session data cause on the display.php you are starting another session. just use session_start() and session_register(str) to set the session and use just session_register(str) on the suceeding pages

razz

Thanks Kombat for the response. I tried it and no luck. I even cleaned out all the code but the session stuf and still failed.

One interesting thing was using 'session_start' would allow a refresh' but session_register would not.

I just tried basic session code with a <a href=display.php>Display page</a>. Interesting that it passes session id as though it were a GET. The ID is appended to the url.

So, I treied to edit my header redirect as follows:

	header('LOCATION: display.php?PHPSESSID='.session_id());

and it worked!

WOW!, But I should not have to do that should I? Seems like overkill on the code end. I will gladly take it but from the learning point of view seems wrong.

The last thing was the REFRESH issue. During testing my MySQL insert codes are on the display page. Hit REFRESH and it adds another record. I have seen all the note saying redirect to another page and I will be, but again for learning...Is there a way to test for refrersh to stop it?

Thanks again to Kombat,

razz

I just thought I would update the question:

I do not like the idea of having to add the sessionid to the url. I think it is security issue if taking sensitive info over forms.

Why can I start a session and use the variables generated from the form on the first page, and see those variables on the 2nd page after a header() redirect, BUT then from the 2nd page, if someone clicks change or proceed, the 2nd page form sends to a script that redirects 'change' back to page 1 and 'proceed' to page three. The variables are gone. The sessionid still shows the same. All works if I manually add the id to the header redirect, but all is lost if using the default of session id in cookie.

I am willing to post the pages if needed but all pages have session_start(). The weird part is the variables pass to at least 1 page indicating that the session is working. Why would it suddenly stop working.

Please, any ideas are welcome. These pages are a testing ground for my first use of php/mysql.

razz

Shrike

I am having the exact same problem. From what I have read in bug reports it seems its down to the fact that the session cookie is not getting written to the browser before the header redirect, and so the next page cannot identify the client in spite of the fact that a session exists.

Suggested solutions range from using session_write_close() before doing the header redirect, or doing something client-side (meta refresh or a link of some sort) None of these solutions seem too great to me but there might not be alot of choice 🙂

razz

Thanks Shrike, I was begining to think I was going nuts. After much experimentation here is what I have found:

I am mostly testing on IE for Mac OS X. I also am using IE on Win Server 2003 Ent. Ed. The problems appear cookie related. The Mac browser I had set to ask for each site and had ACCEPTED the cookie for my test site. I even looked and it was listed and working. the next day the site failed. I looked at the cookie and it was at DECLINE....????? weird. I reset it and it worked for 15 min and then back to decline...??? man oh man. So I set to accept all and it works fine. The PC was also mixed on the result but not as bad and it appears to be similar issues although the cookie is accepted. On the Mac the cookie was ACCEPT yesterday and I just went to try the session_write_close(). No help but I went and looked and Bam the cookie was decline. It may have worked but I think I am on the right track with the cookies.

Wow. Never had any issues with code like this before but man this is a fun puzzle...

Thanks to those that helped.

razz