views:

337

answers:

1

I am trying to use PHP session without using cookies. I have enabled session.use_trans_sid and disabled session.use_cookies in my php.ini file. I have also disabled cookies in my firefox browser. Now, when I navigate between pages, I am unable to access the variable in the session object set from a previous page. BTW, I am aware that using session IDs as part of the URL is not a recommended approach.

I have provided the sample code snippet below for the two pages - page1.php and page2.php. Page1.php sets a variable in the session object to true and page2.php checks this variable's value and takes action accordingly.

Page1.php

<?php
session_start();
if (isset($_REQUEST["user"]))
{
    $_SESSION["name"] = true;
    $host = $_SERVER["HTTP_HOST"];
    $path = dirname($_SERVER["PHP_SELF"]);
    header("Location: http://$host$path/page2.php");
    exit;
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"&gt;
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>Page1</title>
</head>
<body>
<form method="get" action="/page1.php">
Name:<input type="text" name="user"/><br/>
<input type="submit" value="Login"/><br/>
</form>
</body>
</html>

page2.php

<?php
session_start();
if ($_SESSION["name"])
{
    echo("<h1>Name set.</h1>");
}
else
{
     echo("<h1>Name NOT set.</h1>");
} 
?>
+1  A: 

I have resolved the issue. Looks like php will not pass the session ID during re-directs as part of the re-direction URL even if the re-direct is to a page within the same website. This is why the session variable was not available within page2.php above and the output was always "Name NOT set". So I changed my re-direct URL on page1.php to have the session ID as part of it & that did the trick.

$sid = session_name() . "=" . session_id();
header("Location: http://$host$path/page2.php?$sid");
naivnomore
In trans_sid mode, PHP only inserts the session ID into HTML ('a' links and forms). It will not modify any javascript, onclick blocks, header() output, or externally linked files, such as CSS via 'link' headers.
Marc B