can $_SESSION suddenly stopp working?

burnmic

Hey everyone,

I've also read that any script that needs to use register variables isn't coded well, so i'm looking into alternatives, however, this won't be for a while i'm sure. The issue that seems to have suddenly cropped up is that $_SESSION seems to have stopped working.. ?

My hosts have told me to try setting register globals to "on", this shouldn't be the case as my phpinfo file already tells me:
"register_globals local value: On master value: On"

I use a form to grab variables, and then use the following code set in a "referral-variables.php" file,

<?php
session_start();
$_SESSION['partner'] = addslashes($_REQUEST['partner']);
$_SESSION['name'] = addslashes($_REQUEST['name']);"
?>

This file is then used as an include on all pages where the values are required:

<?php include('../partners/referral-form/referral-variables.php');
session_start();
?>

This was working fine yesterday, but it seems to have just suddenly stopped working, but I can't seem to figure out why this may be - almost 5 hours worth of trial and error and still no joy.

Any help would be appreciated!
thanks a lot
mic

PS: i'm using lunarpages > php version 4.4.9.

burnmic

[Threads merged...please do not cross-post. -- MOD]

NogDog

Try adding the following to the very start of the main page (the file called via the URL in your browser):

<?php
ini_set('display_errors', 1);
error_reporting(E_ALL);
// . . . rest of script . . .
?>

What I'm sort of expecting to see is a "headers already sent" warning with some info as to which line is failing in which file. (Once we debug this, you can remove those lines or just set the display_errors value to zero.)

burnmic

Hey Nogdog,

thanks for the reply 🙂

so I've added your code to the referral-variable.php file, and when loading a page that includes that file i get:

Notice: Undefined index: partner in /home/michae/public_html/seoblind/partners/referral-form/referral-variables.php on line 7

Notice: Undefined index: name in /home/michae/public_html/seoblind/partners/referral-form/referral-variables.php on line 8

Notice: A session had already been started - ignoring session_start() in /home/michae/public_html/seoblind/products_services/natural-search-engine-optimisation.php on line 2

I've not used the E_ALL command before - i've already learned something today 🙂
So i'm guessing the "undefined index" for the two variables "partner" and "name" would be the reason why the data isn't being stored.. however, I've no idea how to tackle that..?

Does this mean anything to you?
thanks again

laserlight

Why do you call session_start() twice? It happens in the file that is included, and then again in the file that includes. You probably only want it in the file that is included.

burnmic

Hi Laserlight,

Thanks for the feedback, I wasn't sure as to whether I need to call the session_start() in the page, even though it was already being called in an include. I'll go ahead and remove it from the individual pages, and simply leave it in the include 🙂

thanks!

hmm, still trying to work out what the undefined index means... i wish i was more intelligent!

burnmic

ps: now I simply get two lines or error code:

Notice: Undefined index: partner in /home/michae/public_html/seoblind/partners/referral-form/referral-variables.php on line 7

Notice: Undefined index: name in /home/michae/public_html/seoblind/partners/referral-form/referral-variables.php on line 8

also, the referral-variables.php file now states:

<?php
//reporting on errors
ini_set('display_errors', 1);
error_reporting(E_ALL);

session_start();
$SESSION['partner'] = addslashes($REQUEST['partner']);
$SESSION['name'] = addslashes($REQUEST['name']);
//echo "partner = ". $SESSION['partner'] ." and name = ". $SESSION['name'];
?>

laserlight

What those warnings are saying is that $REQUEST['partner'] and $REQUEST['name'] do not exist. Since $_REQUEST is an array, if those two variables do not exist, the indices 'partner' and 'name' are undefined for the array.

The implication is that you simply did not provide them say, via a form or the query string.

burnmic

hmm, well as far as I can tell the form is working fine - ie, the variables are stored on form submit, and display on the next page in both the url & php echo calls.

form is here to set variables: http://www.seoblind.com/partners/referral-form/seo-partner-referral-and-affiliate-information.php - I'll add the values for my name as "myname" and my business as "mybusiness" to this form and submit.

form code:

<table width="60%" height="100px" border="0" cellspacing="1" cellpadding="2">
<form name="partner-referral-form" id="partner-referral-form" method="get" action="seo-partner-referral-and-affiliate-result.php" />
  <tr>
        <th scope="row" class="align-right">Your Name:</th>
        <td><input type="text" name="name" /></td>
  </tr>
  <tr>
        <th scope="row" class="align-right">Partner / Business Name:</th>
        <td><input type="text" name="partner" /></td>
  </tr>
   <tr>
   		<th scope="row"></th>
        <td><input type="submit" value="create my link!" name="submit" /></form></td>
  </tr>
</table>

Submission page to add variables to dynamic url are here: http://www.seoblind.com/partners/referral-form/seo-partner-referral-and-affiliate-result.php?name=myname&partner=mybusiness&submit=create+my+link!

At this point, I want to be able click this link, navigate anywhere around the site (or even leave the site and come back), and have the variables retrieved from the session.

I've tested taking out the url parameters for the variables at stage 2 (ie, http://www.seoblind.com/partners/referral-form/seo-partner-referral-and-affiliate-result.php), and surprise surprise, I get the same error:

Notice: Undefined index: partner in /home/michae/public_html/seoblind/partners/referral-form/referral-variables.php on line 7

Notice: Undefined index: name in /home/michae/public_html/seoblind/partners/referral-form/referral-variables.php on line 8

So my understanding is that the $_SESSION variable definitely has no data sent via the form?
Thanks again for helping me out so far! 🙂

NogDog

Is this a script where the form and the form processing code are in the same file (i.e., the "action" of the form tag points to the same file that the form is in)? If so, then the warnings would be generated when you first access the page (to fill in the form) but not when you actually submit the form. If this is the case, then you would want to add some conditional code to check if those $_REQUEST values exist before you try to assign them to the session variables. If that's not the case, then there might be a more serious problem.

burnmic

Hey nogdog,

unfortunately not, so perhaps this is a more serious issue.. :queasy:

The form to submit is on this page: http://www.seoblind.com/partners/referral-form/seo-partner-referral-and-affiliate-information.php

The form action is "seo-partner-referral-and-affiliate-result.php" (which contains the include to the referral-variable.php file)

So on form submit you're taken to http://www.seoblind.com/partners/referral-form/seo-partner-referral-and-affiliate-result.php and at this point the variables are in the URL, and should be stored into the $_SESSION - at least that's my understanding.

hmmm, my hosts have told me "we'll pass this onto our tech team", but I get the feeling this will be an fruitless venture - although I honestly do think this is something on their side, as I've not changed a thing since yesterday.

NogDog

If I submit the form, I don't get the error, so that seems to be OK. If I go straight to the page via the URL (therefore no query string values), then I do get the error; which makes sense since nothing was sent in the query string. If that is the issue, then the question becomes what should happen in such a situation? Should the user only see the page when those values are present, or see it with an error, or it doesn't matter?

burnmic

well the idea is that I want to allow partners to be able to refer traffic to my site.

A partner generates their unique link (as you just have).
They send that link to one of their clients/leads, and as a result, their client visits my site.
As the variable for my partner is in the url, this should then be saved to the clients session.
If/when that particular client then registers their interest (ie, submits their details on one of the service forms > http://www.seoblind.com/products_services/natural-search-engine-optimisation.php), there are two hidden fields, one for each variable, which are submitted with that leads.

This way I can track who has referred who, and reward them with their referral fees.

The code used to pull the value from the session variable in all lead generation forms is:

<input type="hidden" name="partner" value="<?php echo $_SESSION['partner']; ?>" />
<input type="hidden" name="name" value="<?php echo $_SESSION['name'] ;?>" />

I hope that helps - sorry, I probably should have outlined this originally 🙂

burnmic

also, I've noticed the styling/display is distorted on the service pages due to the error reporting - not really sure why that happens, but it's only aesthetic 🙂

NogDog

I understand the general flow, but the question remains: what should happen if those $REQUEST values are not there? Users do strange things, sometimes maliciously. It is a trivial matter for someone to strip the query string from the URL and resubmit it, just to see what happens (and if any errors display which might give a hacker an insight into what your script is doing), or to change the values in the query string for the same reasons. So ignoring the "sunny day" scenario (which seems to work), you need to consider what you want to happen in the "rainy day" scenarios. It could be as simple as just assigning a default or empty value:

session_start();
$_SESSION['partner'] = (isset($_REQUEST['partner'])) ? addslashes($_REQUEST['partner']) : '';
$_SESSION['name'] = (isset($_REQUEST['name'])) ? addslashes($_REQUEST['name']) : '';

PS: Why the addslashes()? If for filtering for database query use, I'd recommend the applicable escaping function for the DBMS being used (e.g.: mysql_real_escape_string() for the MySQL extension), as addslashes() is too generic for such a purpose and may not handle all potentially problematic characters for the DBMS being used.

Oh, and I would recommend using $GET instead of $REQUEST, as $_GET is less ambiguous (unless there is some functional reason that you may need to support the same items submitted via other methods).

burnmic

Hi NogDog,

Thanks again for the response - I've had an official response from lunarpages, telling me "sessions are working fine", along with an example of.. you guessed it 'working sessions'... grrr.

so, it HAS to be something I'm doing wrong.. I just can't seem to save a variable to a session and retrieve it after the visitor has clicked through several pages.

I've taken your advice by replacing $REQUEST with $GET - i guess security will be my next phase 🙂

Ok, so those variables will not often be there (only upon a client referral to my site), so if the user has just stumbled upon the site, then the page will simply load as standard (at the moment that will generate an error code, but that's only because I'm trying to test the session variables). Once the page has loaded, the visitor might register their interest for more information on a service, and this data is then sent from the forms to a crm tool (no mysql db as of yet, but may look into this to backup leads).

For example, Tesco sign up to become a referrer client for seoblind.com.
They generate their link (www.seoblind.com/index.php?partner=tesco&name=john) and place it behind an image banner on their site.

A shopper then clicks the button, and is taken to seoblind.com (at this point I'm trying to get the variables $partner & $name to be pulled from the URL, and stored to the visitors session cookie). Once the session variables are set, the parameters in the url don't serve a purpose, as the data is already stored ready for retrieval (i think?).

The shopper clicks around the site (or even leaves the site, visits other sites and comes back to www.seoblind.com/index.php - again, the variables should already be saved for the site in the users cookie). The shopper then lands on a service page where he/she can choose to receive more information/register their interest for that product.

On the service pages (i.e, http://www.seoblind.com/products_services/natural-search-engine-optimisation.php), the "referral-variables.php" page is 'included' to begin with, and a form is used to allow the shopper to enter their data (which is sent to a CRM tool). Two hidden fields are within this form that retrieve the session data from the shoppers session/cookie, and these hidden fields are then assigned to the lead within the CRM tool:

<input type="hidden" name="partner" value="<?php echo $_SESSION['partner']; ?>" />
<input type="hidden" name="name" value="<?php echo $_SESSION['name']; ?>" />

Sorry again for the long winded response. I was hoping that by writing it out in good detail I may have realised something was wrong, but nothing clicked.

Perhaps my understanding of the session variable isn't correct (being able to store data to specific variables, and retrieve this data after multiple page views), but that doesn't explain why it worked perfectly a couple days ago. I MUST have changed something and not realised, but really struggling here! haha

again, appreciate your time and help so far! 🙂

ooh, ps: I was advised to use addslashes incase a persons name or partner name had apostrophies or quotes, etc. ie, "tesco's".. what function would you use in this situation?

burnmic

I've worked it out, and I can't believe what the issue was.

I built another site with 3 test pages, but the same structure (page1 to send variables via a form, page2 to save variables to session, and page3 to pull variables from a session).

Turns out this worked absolutely fine.. I compared the code, and realised I was pulling in the referral-variables.php file (which was using the variables from the URL) in a the services page - where NO variables where in the URL, and so the session data was being overwritten with nothing!

I've replaced:

<?php include('partners/referral-form/referral-variables.php'); ?>

with this:

<?php session_start(); ?>

and now the forms pull in the session data obtained from the referrers link! thank god, I was really pulling my hair out on this, but it feels good to get passed this stage.

However, I've already noted a problem - which would have been evident even if I had not noticed this issue.

I need the referral link to point to it's own page (where I'll run the referral-variables.php script to store data to users session) and that page needs to auto-forward the client to index.php.

The reason for this is that the referral links currently point to the index.php page (where the referral-variables.php script is run to save data to session).

If at any time a user revisits this page after initially landing on index.php, the variables are overwritten with nothing again - in short, I need to remove this script from the homepage, and instead create a new landing page that auto-forwards to index.php after capturing the data.

I know I could use a landing page with header('index.php') to run the code, save the data, load the header file... but interested to know what the best practice for this would be?

Thanks again for your all your help nogdog and laserlight 😃