sessions!@#?%! 1

[alfalf]

Hello.

I'm having an problem with my sessions & PHP sessions setup. I used one example membership code (an online example) as follows:

I have 2 login/procedure files:
1. checkuser.php (checks if user have entered correct username/pw) & other
2. login_success (if login correct, displays members area menu).

Both of this files deal with session_start(), session_register() and $_SESSION variable. Shema code preview (just relevant code lines):
1. checkuser.php:
<?
session_start();
... some code...
session_register('first_name');
$_SESSION['first_name'] = $first_name;
session_register('last_name');
$_SESSION['last_name'] = $last_name;
session_register('email_address');
SESSION['email_address'] = $email_address;
session_register('special_user');
$_SESSION['user_level'] = $user_level;
mysql_query(&quot;UPDATE users SET last_login=now() WHERE userid='$userid'&quot;
header(&quot;Location: login_success.php&quot;
...

2. login_success.php (login was correct):
<?
session_start();
echo &quot;Welcome &quot;. $_SESSION['first_name'] .&quot; &quot;. $_SESSION['last_name'] .&quot;! You have made it to the members area!<br /><br />&quot;;
echo &quot;Your user level is &quot;. $_SESSION['user_level'].&quot; which enables you access to the following areas: <br />&quot;;
if($_SESSION['user_level'] == 0){
echo &quot;- Forums<br />- Chat Room<br />&quot;;
}
if($_SESSION['user_level'] == 1){
echo &quot;- Forums<br />- Chat Room<br />- Moderator Area<br />&quot;;
}
...

What happens:
When I enter username/password and press Submit, checkuser.php is called. After that, if all was OK, login_success.php is called. But my $_SESSION variables are not displayed (in login_success.php) at all. What more, I get 3 sess_* files in my session.save_path, two empty, one have all session variables.

Now, normally I checked what online php manual had to say, and got even more confused. Literaly, quote: ½Caution: If you are using $HTTP_SESSION_VARS/$_SESSION and disable register_globals, do not use session_register(), session_is_registered() and session_unregister(). If you enable register_globals, session_unregister() should be used since session variables are registered as global variables when session data is deserialized. Disabling register_globals is recommended for both security and performance reason½ - end quote.

Never the less, I excluded sesion_register('...') from code, and the same thing happend (3 sess_* files, two empty, one correct, and my session variables are not displayed on login_success.php page). And it become clear to me, that every time session_start() is used, new sess_* file was made.

Finnaly, I asumed that there's some missconfiuguration in my php.ini file. I have compared it with one from online manual and can't see any differences (and evenmore, this is the same php.ini from PHP4.3.3. zip pakage I installed). I only corrected path for sessions and cookies. If needed, I will post it.

Now, I have this configuration: Microsoft IIS 5.0 SP4 server, PHP 4.3.3. (ISAPI), All that on W2000 SP4. (Perhaps I will change this again).

Now that I had finnaly chosen my server configuration, finnaly tuned my mail server, and Almost finished my PHP study, I come to this stupidity. Must be that I really do have problem with (file) sessions (and my biggest enemy yet = php.ini).

Can anyone please suggest what this problem might be?
Concerning that I DO WANT TO HAVE Register_globals=Off, and I don't care too much about url trails or cookies (wether they exist or not), to what I plan to do, http security won't become so much security problem.

Thanks in advance.

 

[sleipnir214]

The problem is not PHP. It's IIS.

When you issue a Location: header, the HTTP status changes from 200 (&quot;Found&quot to 301 (&quot;Moved&quot. Mi&cent;ro$oft took it upon themselves to write IIS in such a way that when the status is 301, cookies will not be sent to the browser on that connection. IIS just drops them.

PHP's session system needs to send cookies to be able to carry the session variables from script to script. session_start(), assuming that since no session token is available, creates a new session token and session store every time it is invoked.

You could perform your redirection some other way. HTML META tags or client-side scripting.

You could also restructure your code so that instead of redirecting at all, your code uses if-blocks and include() statements to output your various login status messages.

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[alfalf]

Thanks sleipnir214.

I tested it with include() instad of header(&quot;loaction...) and:
1. yes, one sess_* file was created and
2. my $_SESSION vars apeared,
3. and because I used include(), wasn't directed to desired location, but left on checkuser.php page.

Does it mean that Apache does not do that (301 reseting sess_* token)? Also, does sql driven sessions solve this matter? Logicaly yes, do they? I think so.

Never the less, thanks. I haven't tested sql driven sessions yet, but surely do tomorow, that's my last chapter.

 

[sleipnir214]

SQL-stored sessions have nothing whatsoever to do with this.

Apache does not have this problem.

I think from your questions you're not understanding what goes on with sessions and cookies.

When you issue session_start(), one of the things the PHP engine does is look for a session token that the browser passed in when the script was invoked. If PHP can find no such token, it assumes that a new session is to be created.

If it finds a session token, it uses that token to perform its lookups into either the filesystem or the database.

IIS will never send both cookies and the &quot;Location:&quot; header. Thus unless PHP was successfully able to set the cookie on the browser previously, every time you have session_start() and the &quot;Location:&quot; header in the same stream, PHP will never find a session cookie and will always start a new session.


You're going to have to restructure your code a little.

What I often do is write my version of check_user.php so that if no form has been submitted to it, it outputs a blank HTML form which will submit back to the same script.

If the script has form-submitted input, it processes it. If successful, it uses &quot;Location:&quot; to forward the user on. Otherwise it reoutputs the form with appropriate error messages.

The first thing the script does in either case is invoke session_start().

But notice that the script never has to start a brand-new session and use the &quot;Location:&quot; header both in any one run. It either starts a new session and outputs a blank form or reuses an existing session and forwards the browser. This bypasses IIS's 301/cookie quirk.

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!

 

[alfalf]

Thanks.

Notice : Must say that Your aswers are usually very theoreticaly and practicaly suported, and also, I noticed (one cannot) that You're having a grat deal of will to help people arround. Perhaps You work here? Then my question is - How can You find time for Yourself? I haven't any wish to offend, but only to thank You for Your effort. It must be that all of us are realy boring!

That's why I'm giving You two stars (if it is going to be accepted here), although it's little comfort and value.

Thanks mate!

 

[sleipnir214]

No, I don't work for Tek-Tips.

Actually, you just got lucky. I happened to be in the site when you posted your question.

Want the best answers? Ask the best questions:

http://www.catb.org/~esr/faqs/smart-questions.html

TANSTAAFL!!