Sessions and non session variables

johncox

I installed some code to use the session id to try to make it inconvenient for my users to share userids/passwords. Basically at user login I start a session and store the session id in a db table along with the userid. Then at the beginning of my page scripts I compare the current sessionid to that in the database. If not the same I send the user to a login page. Figure people might be less willing to share their login information if when they
are working in the system they would have to keep logging in if more then one session was started for the userid. Anyway that seems to work fine.

My users complete forms with various select boxes which when they submit are turned into an SQL statement and data is displayed. Without the session code they can click BACK and go back to the form and the form still has the values they entered and they can modify them and click submit again.

When I turn on the session code none of the variables are rememberd when the user clicks BACK. I don't register them since they are passed with the POST from the submit.

Also if I click on a link generated from the SQL page and then try to click back, I receive a message from IE saying that the page was generated from a form and for security reasons it will not be automatically displayed and requests the user to click Refresh.

Not sure if the above is clear but if anyone has any suggestions as to why IE is acting differently with the session code activated it would be appreciated.

John Cox

olaf

I think the problem with empty form-fields is not related to the sessions. Just this kind of code for each form-element:

<input type="text" name="email" size="32" value="<?php if (isset($email)) { echo $email; } ?>">

AcidRain

You can make button with name Edit, when you click it, php gets all $_POST's and insert into values of inputs, like olaf say.

johncox

Yes, I've done what olaf has said before but I don't think that is a solution for what I am seeing. If I don't include start_session() at the top of the form page then when I select options and click Submit, I can click Back on my browser and all the select boxes and input fields are as they were when I clicked submit.

If I include a session_start() on the form page, when I click back all the fields are reset.

So the browser is acting differently if a session_start() is there or not.

Also on some pages when I click back I receive the following browser page:

Warning: Page has Expired The page you requested was created using information you submitted in a form. This page is no longer available. As a security precaution, Internet Explorer does not automatically resubmit your information for you.

To resubmit your information and view this Web page, click the Refresh button.

Whether I get this depends on whether I am using a session or not. Don't use a session and the BACK remembers the form control settings and I never get the page expired warning. Use sessions and the browser doesn't remember the form control settings and I get the page expired warning.

It must have something to do with how things are handled in a session environment.

olaf

Originally posted by johncox
Yes, I've done what olaf has said before but I don't think that is a solution for what I am seeing. If I don't include start_session() at the top of the form page then when I select options and click Submit, I can click Back on my browser and all the select boxes and input fields are as they were when I clicked submit.

If I include a session_start() on the form page, when I click back all the fields are reset.

So the browser is acting differently if a session_start() is there or not.

It's not the server... The script is executed serverside.

Also on some pages when I click back I receive the following browser page:

Warning: Page has Expired The page you requested was created using information you submitted in a form. This page is no longer available. As a security precaution, Internet Explorer does not automatically resubmit your information for you.

this is the result of a missing value.

To resubmit your information and view this Web page, click the Refresh button.

Whether I get this depends on whether I am using a session or not. Don't use a session and the BACK remembers the form control settings and I never get the page expired warning. Use sessions and the browser doesn't remember the form control settings and I get the page expired warning.

It must have something to do with how things are handled in a session environment.

JC