Register Globals Off and Included Files

mwd2005

I'm having a little trouble trying to convert some of my code in order for it to work with Register Globals Off. First off, how can I get code inside an included file to access a session variable (or a $POST or $GET variable for that matter)?

For instance, I have a login page, with just a username and password field and submit button, that posts the info to a login script that checks against a MySQL database, and if there is a problem, it is supposed to set a session variable called "login_status" equal to "error" and redirect back to my login page, which, has a file included on it that has code to display error messages based on what the session variable is equal to). The problem is that the code inside the included error message file is not able to access the session variable and check against the value, to determine which message to display. However, if I place all of the code that is inside the include file into the login page itself, the session variable is accessed just fine.

Any ideas? I do have session_start(); at the top of my login page, and I tried adding it to the top of the include file, but no dice.

Hexx

an example of code would be nice, but have you tried $_REQUEST['varname'] ??

mwd2005

Ok,

Here's an example of the code inside the included file that display the error messages:

if($_SESSION["login_status"] == "error")
{
echo("
<br>
<table border=\"0\" align-\"center\" valign=\"top\" cellpadding=\"2\" cellspacing=\"0\">
<tr>
<td colspan=\"2\" align=\"center\" class=\"error\">
There was a problem logging in. If this is in error, please call $phone_number.
</td>
</tr>
</table>
");
}

In the login script that checks against the database, I set the session variable "login_status" equal to "error" with the following:

$_SESSION["login_status"] = "error";

right before I redirect to my login page:

header("Location: login.php");

It is really simple code...nothing fancy, so I'm just wondering why it doesn't work. Again, if I paste that exact code into the login form page, it works just fine (which I don't like to do because I like to keep the php code inside include files...separate from the html pages).

Yes, I have tried using $_REQUEST["login_status"], but it doesn't access the variable either.

Thanks.

mwd2005

This is weird... I was including my file by using the direct url (i.e. include("http://www.somesite.com/includes/status.php")😉

What I didn't realize is that you can no longer include a file using the url with the register globals off (That's what I'm figuring anyway)...so what I did was use the document root to include it (i.e. include $_SERVER['DOCUMENT_ROOT'] . "/path/to/include/status.php"😉

Seems to work ok now.

Weedpacket

Originally posted by mwd2005
What I didn't realize is that you can no longer include a file using the url with the register globals off (That's what I'm figuring anyway)...

No, it's not because register_globals is off. It's because an http URL is not the same thing as a file path - it pays to keep the difference in mind.

When you use a URL, the script sends a request to the server for the page you're requesting, the server passes the script it finds to PHP, which executes it, then sends the results back to your script. The two scripts are two entirely separate requests and only have as much to do with each other as any other two entirely separate requests. So, no variables are passed between them.