Strange problems with PHPSESSID not being appended properly to URLS

rmcooke

Running PHP 5.2.8 on Apache 1.3.34

I have just changed the session handling in our site to append the session id to the URL rather than use a session cookie since it runs in an iFrame and session cookies were being rejected by Safari and IE6.

I have accomplished this by adding the following to the beginning of each script before session_start().

ini_set('session.use_trans_sid', 1);
ini_set('session.use_cookies', 0);

In most cases this seems to ensure that the session id is passed around correctly but I have a page which is not working correctly.

The source code looks like this:

?>
<table cellpadding="5">
					<tr>
                    	<td><a href="./submittestresults.php?idtest=<?echo $project['idtest']; ?>"><img src="../images/button-submit-test-case.gif" /></a></td>
                    </tr>
                	<tr>
                    	<td><a href="./downloadtestcase.php?appid=<?echo $project['appID']; ?>"><img src="../images/button-get-test-case.gif" /></a></td>
                    </tr>
                	<tr>
                    	<td><a href="./download-app.php?idtest=<?echo $project['idtest']; ?>"><img src="../images/button-download-app.gif" /></a></td>
                    </tr>
</table>
<?

This produces the following HTML code:

<table cellpadding="5">

<tr>
       	<td><a href="./submittestresults.php?idtest=31954&PHPSESSID=fe065f528b4b14c1ef7c41e6a548a403"><img src="../images/button-submit-test-case.gif" /></a></td>
</tr>
<tr>
       	<td><a href="./downloadtestcase.php?appid=3694&PHPSESSID=fe065f528b4b14c1ef7c41e6a548a403"><img src="../images/button-get-test-case.gif" /></a></td>
</tr>
<tr>
         <td><a href="./download-app.php?idtest=31954"?PHPSESSID=fe065f528b4b14c1ef7c41e6a548a403><img src="../images/button-download-app.gif" /></a></td>
</tr>


</table>

As you can see, the first two links work perfectly and the session gets maintained properly. The third link gets rendered incorrectly although the source code is formatted exactly as the first two.

Can anybody shed some light on this please. I hope to avoid adding the session id manually to each link in the site.

Thanks,

Richard

sneakyimp

I can see nothing you've done that might cause that behavior. I haven't forced trans-sid before so I'm not sure, but I would say that looks like a bug.

Weedpacket

For what is given I couldn't reproduce the problem in PHP versions 5.2.4, 5.2.5, 5.2.6, 5.2.8, or 5.2.9 (and there's nothing in the changelog about it). On the other hand, I am using Apache 2; I don't see what that would have to do with anything but it is a difference (I don't know how long Apache have been recommending 1.3 users to upgrade to 2.x).

Very incidentally, it is recommended to use <?php to start a PHP block, rather than <?; using the latter and having short_open_tags turned on is likely to cause problems in future.