SESSIONS causing my form fields to clear

hadoob024

I'm not sure why this is happening and I tried doing some searches, but I haven't come across anything. Basically, in "form.php" I have a form. And I process the form in "formprocess.php". Now, through my verifying/sanitizing, if there was a problem with information submitted, "formprocess.php" handles it, and then tells the user to click on the back button on the browser (or the one that I supply).

Now here's the weird thing. If I don't use sessions, when the user clicks to go back to the form, their information is preserved in the form. However, if I try to add sessions to the page (as a hidden token to help prevent CSRF), if the user makes a mistake and has to go back to the form, their entered information is cleared. Has anyone seen this? I'm pretty sure it's the sessions that's doing it, because if I comment out the session code, it works fine and preserves the users inputted info on the form.

Here's basically what I have on "form.php":

session_start();
$secret = md5(uniqid(mt_rand(), true));
$_SESSION['secret'] = $secret;
<input type="hidden" name="secret" value="<?php echo $secret; ?>" />

And on "formprocess.php":

session_start();
if (!isset($_POST['secret']))
     errorcheck(2, 'User attempted accessing "addlistingprocess.php" without going through "addlisting.php".');
if (($_SESSION['secret'] != $_POST['secret']) || (!isset($_SESSION['secret'])))
{
     //Call error handling function with $problem = 2 (minor security breach)
     errorcheck(2, 'User attempted accessing "addlistingprocess.php" without going through "addlisting.php".');
}
else
{
	//unset() session variable
	//unset($_SESSION['secret']);
}

What in this code could be causing the form fields to clear? Thanks!!!

bradgrafelman

Probably the fact that you're sending a new session cookie back each time, so the browser disregards any cached information it stored.

Why not just redisplay the form, and fill in the values they entered? Then, you could display messages in red of which fields were incorrectly filled out.

hadoob024

This might seem dumb, but I thought that when a user clicks on the back button, that the previous page isn't being "reloaded", just whatever was there is being displayed again. Is this right or am I completely wrong here?

Hmm. Oh yeah, and when you say:

Why not just redisplay the form, and fill in the values they entered? Then, you could display messages in red of which fields were incorrectly filled out.

Can you dumb that down for me please? Basically, here's what I have for my error handling for this situation:

function errorcheck($problem, $problemtext)
{
	//Our error checking.  This handles 'expected' errors encountered 
	//while filling out forms.
	if ($problem === 2)
	{
		echo '<div align="center">';
		echo "The form was not submitted for the following reason(s): <BR /><BR />";
		echo $problemtext;
		echo "<BR />";
		echo "Please click on the \"Back\" button below, or use your browser's back button <BR />to return to the form and try again.<P>";
		echo '<FORM><INPUT TYPE="button" VALUE="Back" onClick="history.go(-1);return true;"></FORM>';
		echo '</div>';
		require('/home/virtual/ofre.com/var/www/includes/copyright.php');
		require('/home/virtual/ofre.com/var/www/includes/closetables.php');
		echo '</body></html>';
		exit;
	}
}

I basically have a form page and a form processing page. How can I have it go back and re-display the information that they've already entered? Thanks!

hadoob024

I was just doing some reading and came across the setting "session.cache_limiter". Could this have anything to do with my problem? The manual doesn't have too much information on this, regarding whether or not I can use it to help with my problem. Anyone have any experience with it? Thanks.

bradgrafelman

What I meant was, that instead of displaying a back button, redisplay the form and fill in any values they did...

    if ($problem === 2) 
    { 
        echo "<div align=\"center\"> 
The form was not submitted for the following reason(s): <br /><br />$problemtext<br />
<form method=\"POST\" action=\"whatever.php\">
Name: <input type=\"text\" name=\"name\" value=\"{$_POST['name']}\" /><br />";
        require('/home/virtual/ofre.com/var/www/includes/copyright.php'); 
        require('/home/virtual/ofre.com/var/www/includes/closetables.php'); 
        echo '</body></html>'; 
        exit; 
    }

etc.

hadoob024

Oh ok. I think I get it. I see what you're doing. I think I might try that out.

Any thoughts about "session.cache_limiter"? Could this be the cause of my problem? If I can solve it by manipulating "session.cache_limiter", then I might try it. If not, then I'll definitely implement your suggestion. I'm just being lazy and don't feel like re-writing my error handling function 🙂