PHP causing form invalidation

[F_SH]

Heya all

I've got an issue with PHP making my page stop validating as strict HTML (DTD: XHTML 1.0 Strict). I have a form with a bunch of < inputs ... > on it. To use these, they need to be put into a container, and for this I use the < fieldset> block:

<form ..>
   <fieldset>
      <input ..>
      <input ..>
   </fieldset>
</form>

Which normally would all be fine and dandy.

The problem arrises with PHP adding, immediately after the < form> tag when parsed some code. This code describes another input box, hidden, which seems to hold and transmit the PHP session ID (assumed from the field's name property, PHPSESSID). Anyway, since this is added immediately after the form opening, it occurs before the fieldset container and thus is HTML-invalid. Anyone know a way around this?

Curiously, the session data, the exact same code, is apphended also immediately after the < fieldset> opening. So one solution I can see would be to make PHP ignore the < form> tag; functionality would be maintained by the presence of the < fieldset>. I have no access to the PHP config though, so maybe this is not possible.

Parsed code is, with the added offenders bolded:

<form action="query_send.php" method="post">
<input type="hidden" name="PHPSESSID" value="47b29cada84eaba0278622b71001b000" />
<fieldset><input type="hidden" name="PHPSESSID" value="47b29cada84eaba0278622b71001b000" />
<input class="prompt" type="text" disabled="disabled" value="Your name" size="11" />
<input type="text" name="sender" size="29" />

[MarkR]

Personally I'd say the best way was to disable PHP from putting session IDs in your document at all. You can perhaps do this by setting session.use_only_cookies

I hate it when things do stuff behind my back, this includes PHP sticking its horrible session IDs everywhere. I'd much rather it just used cookies.

Alternatively, there is some control over this. read the docs for sessions.

Mark

[Weedpacket]

And see if this is already logged with bugs.php.net - and if it isn't, log it yourself. PHP shouldn't be sticking the same hidden field in a form more than once.

[F_SH]

MarkR - would be a good idea but I've no access to the server and so php.ini is off limits to me - is there any way to duplicate this with parsed code?

Weedpacket - there are at least two reported bugs on PHP.net (one is #22070). However, these are all closed, with no evident solutions offered save one similar to MarkR's. In any case, if it has been fixed I can't upgrade and it it hasn't I can't do the recommended workaround.

So.. any more ideas that might work?