What is the right way : url query or openning session?

Question

I have a search form for check avaiable rooms beteen two days. After search.php, I have listed available rooms. I want to get checkin and checkout dates for reservation. What is the right way?

1-urlquery :

<a href="rooms.php?roomID='. $value['room'].'&in='.$checkin.'&out='.$checkin.'">

2- open session for checkin and checkout

Thanks in advance

Answer 1

If using sessions, you must be aware that if the user opens several tabs in his browser, all tabs will share the same session -- might make things hard to code ;-)

Using URL would be OK ; beware of XSS, though : think about escaping the output properly, with functions such as htmlspecialchars() and/or urlencode(), depending on the situation.

One thing, though : in theory, if your rooms.php script is modifying some data (like saving something to database), you should use HTTP POST, and not HTTP GET.

ABout that, you can take a look at Safe methods -- and reading Idempotent methods and web applications can be interesting too.

Answer 2

Using session variables is probably the better way to do this since it allows you to store a lot more data on the server side and only pass the session token to the user as a cookie. The only problem is if the user has cookies disabled. This is a very small percentage of all users.

Using the session also means that you don't have to add the parameters to every link and every form on every page, and that it will still work if the user closes the page (not the browser), and then comes back later. I do this all the time when I'm searching for hotel deals.

Regarding the URL parameters, you should escape all parameters before passing them on to the user. Do this:

<?php
$url = "rooms.php?roomID=" . urlencode($value['room'])
       . "&in=" . urlencode($checkin)
       . "&out=" . urlencode($checkout)

?>
<a href="<?php echo $url ?>">...</a>

That way your page is not open to a cross-site-scripting attack.