Page caching problem with PHP4 sessions

[ppavlovic]

I created a process for leaving ads. So, in every step user leaves some of his data (his name in first, his interests in second, etc...). With hidden field with name 'step' I propagate to to the next step (eq. in function step1() I set step=2, in step2() hidden element step is set to 3, etc...)

I have the following problem:
when user forgots to fill some of the required fields, I generate an error and ask the user to hit back button to corect his mistake. So when the user hit back button, browser says that the page has expired. How can I avoid this problem?

The proces is next:

---- script.php ---------
class object{};
$ad = new object;

session_start();
session_register("ad");

switch($HTTP_POST_VARS["step"])
{
case 1: step1(): break;
case 2: step2(): break;
}

step1()
{
echo "<FORM METHOD=POST ACTION=\"$PHP_SELF\">
<INPUT TYPE=\"hidden\" NAME=\"step\" VALUE=\"2\">
<INPUT TYPE=\"hidden\" NAME=\"PHPSESSID\" VALUE=\"" . session_id() ."\">
--- here goes some of the information I request (name, email...)
<INPUT TYPE=\"submit\" NAME=\"submit\" VALUE=\"Continue\">
</FORM>";
}

step2()
{
if (step2_is_ok())
{
$ad->email = $HTTP_POST_VARS["email"];
$ad->name = $HTTP_POST_VARS["name"];
$ad-> etc...

	// here goes another form...
	// same as before
}else
{
	echo "error..... hit back button";
}

}

regards,
coyote

[jariizumi]

There are several things you can do. The most recommendable would be to make it so that when there is an error, the page is generated with the same fields, have the fields' values restored, and the error printed in red, etc. which seems the most popular thing to do.

Secondly, one thing you can do is to have the form submitted to a script that saves all HTTP_POST_VAR's into a session and header("Location: nextpage.php"); or something of the like. That way, when they press the back button, they are taken to a pretty much static page (i.e., non-POST'd). Hope this gives you some ideas 🙂

[ppavlovic]

Thanks, it helps. But, here's another question
Can I pass a PHP session ID via URL, so that I can simulate half POST and half GET.
something like
<form method=post action="$PHPSELF?step=2&PHPSESSID=<? echo $PHPSESSID ?>"

blah blah blah... form

</form>

Just trying something 🙂

regards,
pavlovic

[ppavlovic]

I found this in archive and it helped:

We had the same problem. Here's the code we used to get around it. It detects a POST and then send headers to allow the client to cache the result which override the ones sent by start_session().

// Here we check to see if it was a "POST"
// form submit and allow caching so the
// back button won't give page expired
// These headers must be sent after the
// start_session() call on the page

if ($REQUEST_METHOD=='POST')
{
header('Expires: ' . gmdate("D, d M Y H:i:s", time()+1000) . ' GMT');
header('Cache-Control: Private');
}

Thanks for help

regards,
pavlovic