which is better to pass a PHP var in AJAX call to another page: POST or through the session?

Question

Hi,

in a PHP site I am building, I use a Prototype AJAX call to address some other php page. This called php page needs a variable that lives as a SESSION var on the first page (in the sense that it's used multiple times throughout that page anyway).

It's more curiosity than anything else but: which of both ways to pass our variable is preferable, if any:

• on the called page, start the session and get the var needed from there, or
• in the AJAX call, pass the session var on as a POST parameter

So, I am curious if there is a higher 'cost' to passing a POST var between pages, versus getting the var from the session (adding session_start() etc).

Answer 1

Using the POST method it's easy to cluster the servers since there is less state remembered on the server side, but at the cost of sending, potentially sensitive, data to the client.

Using the Session method, there is less bandwidth passing between the server and the client, but it's harder to scale across multiple front-end web servers.

Answer 2

If the value has no security concerns, pass it via the GET or POST method. Only ff the value has some security issues or it could be a serious problem if the user were to change the value (via a proxy or injection) then use SESSION.

Answer 3

I'd say use the session.
You're already suffering the overhead of sending the session id in the request header so you may as well make use of it. Having said that it's not a vast overhead anyway but neither is posting a small amount of data.
In order to post the data, you need to have it available at the client side too and if that's the only reason you have it at the client side, you've left yourself needlessly open for spoofing.
The scalability across load balanced servers, if it turns out to be a problem, is going to have to be dealt with anyway if you're using sessions.
So if your sessions are working, use them.

Answer 4

I am actually looking for an answer for your question.

Bu this is what I found: If the Variable is on the Session in the first page, this means that you cant call session_start() on the "ajax called" page. Unless there is some workaround Im not aware of?