session variable and NS

[inusrat]

Hi,

I am setting a session variable, it is working fine both on IE and NS. But on NS when I go to a page using the following

<script language="JavaScript">
location.href="

http://test420.biz/orderapproval.php"

</script>

i get error on the "orderapproval" page saying "Undefined index: id"


But if i go to the page "orderaproval"manual through link i do not get any error


<?php
echo "<td><A HREF=orderapproval.php>Continue Shopping</a></td>";
?>

the problem is only on NS, i wonder what is going on..

Thanks

http://www.786Marriage.com

http://www.amasspharma.com

http://www.ambdex.com

 

[MattNeeley]

It more then likely has something to do with the session being lost as in the manual link you are using a relative link and in javascript you are using an absolute link. try changing the javascript to location.href="orderapproval.php

 

[inusrat]

thanks, that was it, it works now......

http://www.786Marriage.com

http://www.amasspharma.com

http://www.ambdex.com

 

[Olavxxx]

ps.
when using href or form submit, it might be good to do it like this:

<a href="orderapproval.php?<?=SID?>"></a>

Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster

 

[inusrat]

Thanks, I am little confused. In my case i set two session variables. One is called id and other is called profileid

In this situation how exactly my href syntax will look like.

<a href="orderapproval.php?<?=id&profileid?>"></a> ????


I think i got it all wrong

thanks

http://www.786Marriage.com

http://www.amasspharma.com

http://www.ambdex.com

 

[Olavxxx]

Why do you make your own session variable?
I think that's a bad idea!

<?=SID?> is the REAL session id!

Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster

 

[chessbot]

DaButcher:
Why should one pass the session variables in the href? Isn't the idea of session variables that they are invisible and don't need to be passed?

--Chessbot

"See the TURTLE of enormous girth!"
-- Stephen King, The Dark Tower series

 

[inusrat]

I am doing something like this on my home page

A.
if(!isset($_SESSION["id"]))
{
$cart_id = md5(uniqid(rand()));

$_SESSION['id'] = $cart_id;
}


B.
later when i need to use it I I do
$sessionid = $_SESSION['id'];

I did not know that it will automatically set the session id.

How will retrive that session id value?, something that I am doing in "B"

http://www.786Marriage.com

http://www.amasspharma.com

http://www.ambdex.com

 

[Bastien]

chessbot

The answer is, it depends. There are security holes and gaps if you pass the session id in the url (like users passing it around), but its no less safe than if you pass the session id in the hidden fields with POST.

The issue is that not all users allow session cookies (or have it turned on). This is an acceptable workaround, though it depends on the level of risk that your app can take without compromising the data.

Bastien

Cat, the other other white meat

 

[chessbot]

But aren't sessions stored server-side?

--Chessbot

"See the TURTLE of enormous girth!"
-- Stephen King, The Dark Tower series

 

[Bastien]

The session DATA is stored serverside, but a session cookie is stored on the client. (Simple way to see, open IE > Tools > Internet Options > Privacy > Advanced > "session cookie" is there

Bastien

Cat, the other other white meat

 

[chessbot]

So what is a "session cookie", exactly? Does it have anything to do with the $_SESSION[] array? Can I access the "session data" without using a cookie?

--Chessbot

"See the TURTLE of enormous girth!"
-- Stephen King, The Dark Tower series

 

[Olavxxx]

If you do not accept cookies (security on client), you need to parse the SID in the href, form action or something like that. (or sessions will not work!)

I dont think it's that insecure, since you will see your own session id, not anyone elses.

For administrative logins, etc. you can leave out the SID, if you know the users do not block the SID.

Olav Alexander Mjelde

http://www.volvo-power.net

Admin & Webmaster

 

[chessbot]

This thread has gone slightly off topic; for continued discussion of session storage please see thread434-944936.

--Chessbot

"See the TURTLE of enormous girth!"
-- Stephen King, The Dark Tower series