simplexml_load_file and $_SESSION

Question

Hi everyone,

I have a problem using simplexml_load_file and session vars in PHP.

So, I have 2 PHP files, one generates some XML and the other one reads it. The file that generates XML should read some $_SESSION vars, which had been set in the other, but it won't...

For instance, say the first file is something like:

FILE 1 (reads XML)

<?
session_start();
$_SESSION['test'] = 'test!!!';
echo '<b>In file 1</b><br />';
echo 'var = '.$_SESSION['test'].'<br />';  // This correctly outputs "test!!!"
echo '<b>Reading file 2</b><br />';
$xml = simplexml_load_file("http://www.someurl.com/2.php");
echo 'var = '.$xml['var'];                 // This does <b>NOT</b> output "test!!!"... why?
?>

FILE 2 (generates XML)

<?
header('Content-type:application/xml');
session_start();

echo '<?xml version="1.0" encoding="utf-8"?>';

echo '<test>';
echo '<var>'.$_SESSION['test'].'</var>';
echo '</test>';
?>

The strange thing is, if I open file 2 directly it DOES read $_SESSION["test"]

Things I already tried (and did not work)

• Not calling session_start() in the second file

• Calling session_write_close() before simplexml_load_file in the first file

• Accessing the file using fsockopen instead of simplexml_load_file. This also returns an empty tag... so it's not an issue with simplexml_load_file...

I'm a bit out of ideas... can anyone help?

Thanks nico

Answer 1

From a user/browser point of view, the session is passed from page to page via a cookie that contains the session identifier.

A bit like this :

• page 1 creates a session and send the cookie containing its identifier to the browser
• the browser requests page 2 and send the cookie with its request
• the server sees that cookie ; it allows it to load the session
• page 2 is sent, alongside the cookie, that will be re-used for other pages

Here, you have two pages, but the session identifier is not passed from file 1 to file 2 -- which means file 2 doesn't even know there is an existing session.

In fact, you have two clients, here :

• for file 1, the client is the guy using his browser
  • who is the one with the session
• for file 2, the client is file 1
  • who doesn't have a session identifier
  • hence, is another user, who doesn't share the session of the guy using his browser