How to use sessions in place of a querystring

Question

Using PHP.. I have a small app that I built that currently uses a querystring to navigate and grab data from a database. The key in the database is also in the string and that is not acceptable anymore. I need to change it. I would like to hide the db key and use a session in place of it but I'm not sure how to do that. In fact, there are also other variables in the query string that I would like to use sessions for if at all possible.

page.php?var1&var2&id=1

This is what my string looks like. I am looping through the results in the database and have given each row the id so that when the user clicks the row they want, but I'm not sure how I could do this with a session.

Does anyone have any ideas?

Thanks

EDIT: I'm developing an email type system where senders and recipients are getting and sending mail. Each piece of mail that is stored on the server will have its own unique key. Currently, I am using that number to retreive the message but the problem is that I don't want people to change the number and read other people's mail. I can probably use a GUID for this or even some sort of hash but I really hate long query strings. I was just thinking it would be so much cleaner if there was a way to "hide" the id all together.

Answer 1

UPDATED (Again ... Yeah, I know.)

Allowing access to a particular set of data through a $_GET parameter is much more accessible to any user that happens to be using the application.

UPDATED

For storing a private record key, you are probably going to want to use post data, and if you really want it to look like a link, you can always use CSS for that part.

Honestly, the best way to stop people from reading other people's mail is by having a relationship table that says only X person is able to access Y email (by id). That or have a field that says who is the 'owner' of the email.

The fact is that users can still get access to POST parameters, and can easily forge their own POST parameters. This means that anyone could realistically access anyone else's email if they knew the naming scheme.

In an ideal system, there would be a Sender, and a Recipient (The Recipient could be comma separated values). Only the people that are on one of those columns should be allowed to access the email.

---

How To Use Sessions (From Earlier)

First start off with calling session_start(), and then after that check for variables from previous scripts. If they aren't present, generate them. If they are, grab them and use them.

session_start();

if(!isset($_SESSION['db_key']))
{
    $_SESSION['db_key'] = // generate your database key
}
else
{
    $db_key = $_SESSION['db_key'];
}

Sessions are stored in the $_SESSION array. Whenever you want to use $_SESSION, you need to call session_start() FIRST and then you can assign or grab anything you like from it.

When you want to destroy the data, call session_destroy();

Also check out php.net's section on Sessions

Answer 2

There are some examples on how to use $_SESSION on php.

Registering a variable with $_SESSION

Answer 3

Your question isn't too clear to me, but I understand it like this:

You need some variables to decide what is being displayed on the page. These variables are being passed in the URL. So far so good, perfectly normal. Now you want to hide these variables and save them in the session?

Consider this: Right now, every page has a unique URL.

http://mysite.com/page?var1=x&var2=y

displays a unique page. Whenever you visit the above URL, you'll get the same page.

What you're asking for, if I understand correctly, is to use one URL like

http://mysite.com/page

without variables, yet still get different pages? That's certainly possible, but that means you'll need to keep track of what the user is doing on the server. I.e. "user clicked on 'Next Page', the last time I saw him he was on page X, so he should now be on page Y, so when he's requesting the site the next time, I'll show him page Y."

That's a lot of work to do, and things can get awkward quickly if the user starts to use the back button. I don't think this is a good idea.

If you need to take sensitive information out of the URL, obfuscate them somehow (hashes) or use alternative values that don't have any meaning by themselves.

It completely depends on your application of course, if the user is accumulating data over several pages, Sessions are the way to go obviously. Can you be a bit more descriptive on what your app is doing?

Edit:

but the problem is that I don't want people to change the number and read other people's mail

If your primary concern is security, that's the wrong way to do it anyway. Security through obscurity is not gonna work. You need to explicitly check if a user is allowed to see a certain piece of info before displaying it to him, not just relying on him not guessing the right id.

Answer 4

The issue with using sessions for using it in place of S$_GET or $_POST is that you need some way to read the user's input so that you can store it in the session, and you need a way to trigger a page refresh. Traditional means is via hyperlinks, which defaults to GET (unless you use Javascript) or forms, which defaults to POST.

Maybe ajax will help you here. Once the user has enter info into a form or a checkbox, use JS to send a request to insert the info to the PHP and send info back, whether it is to refresh the page or to fill a with content.

Hope this helps