ansaurus

Question

php, mySQL & AJAX: Unable to use sessions across the scripts in the same domain

Answer 1

A:

What is .upload()? Does it come from a library/plugin? If so, what one?

Does the move_uploaded_file() call get executed successfully?

From the events you describe it sounds to me like the form is being submitted straight to page3.

The code you've posted seems very incomplete (missing javascript, missing form fields, missing where $_SESSION members a b and c are set). You should create a minimalistic example and post the complete code.

AllenJB 2010-05-08 19:13:21

Devner 2010-05-08 19:40:11

@Allen Also $_SESSION members a b c set are the variables that hold user login info. Since that is sensitive data, I replaced it with samples. Those session variables are created when user logs in and destroyed when user logs out. Does that help fill up at least some of the missing information?

Devner 2010-05-08 19:43:14

Unfortunately I don't know how Flash works when it comes to cookies. If the file is being uploaded through a Flash applet, and the Flash applet doesn't share cookies with the browser, then the session won't get automatically passed.Instead you'll need to pass session_name() .'='. session_id() as a parameter of the url (GET data). I believe PHP should pick this up automatically. See the session handling section of the PHP manual.

AllenJB 2010-05-08 19:58:12

Although it is Flash that powers a bit of the AJAX frontend, the sessions are created in PHP. Also I am creating the sessions in page2.php based on the file received. So I am holding the file size and other attributes in session so that I can insert them into my DB on page3.php when user actually presses the SUBMIT button on page1.php. Also I wanted to avoid passing data through GET or POST so that the user does not see it and hence provides an additional layer of security to what goes on behind the scenes. So does that help us in moving further ahead?

Devner 2010-05-08 20:15:38

+1 for pointing me in the right direction. I considered the cookie information that you gave me and did some experiments to conclude that the library itself has some bugs. Bob has thrown more light on the exact issue. Appreciate all your help.

Devner 2010-05-08 21:27:50

Answer 2

+1 A:

From the SWFUpload documentation:

Cookie issue

On Windows the Non-IE Flash Player plugin (FireFox, Opera, Safari, etc) will send the IE cookies regardless of the browser used. This breaks authentication and sessions for many server-side scripting technologies.

Developers should manually pass Session and Authentication cookie information and manually restore Sessions on the Server Side if they wish to use Sessions

The SWFUpload package contains work-around sample code for PHP and ASP.Net

I suspect SWFUpload causes your problem.

Check if your javascript posts the session_id:

new SWFUpload({
   ...
   post_params: {
     "PHPSESSID" : "<?php echo session_id(); ?>"
   }
}

And if your PHP script reacts to the sent session_id.

if (isset($_POST["PHPSESSID"])) {
    session_id($_POST["PHPSESSID"]);
}
session_start();

(session.auto_start should be disabled in your php.ini or .htaccess)

Bob Fanger 2010-05-08 20:46:30

@Bob Looks like you probably hit the nail on spot. I was experimenting with the scripts that I had at hand and indeed, much to my disappointment that as long as the upload library was being used, the SESSIONS even did not echo out properly. But if I tested the scripts on standalone grounds, then they worked properly. This meant that there was indeed some problem with the library. I am a little unsure of what you mean by checking my javascript for the code that you gave me. Are you asking me to check if it exists or remove if it exists? Please let me know. Thank you.

Devner 2010-05-08 21:26:32

I employed the PHP script in mine on page2.php but still that does not work. Looks like they So by any chance did you happen to find out how this can be fixed with the current script?

Devner 2010-05-08 21:48:48

ansaurus

tags:

views:

answers:

php, mySQL & AJAX: Unable to use sessions across the scripts in the same domain

related questions