session IDs and the like

[windandwaves]

Hi Folk

Forgive me for asking such a basic question... I have a site where I want to
track the user from start till end... To do this, I have setup the
following structure for each page, referring to startup.php, where the
session is managed. Can anyone check that I am doing it right. I thought I
was doing it right, but then the site started doing really, really funny
stuff, basically loosing track of sessions ...

I want my application to be as portable as possible, so I want to override
all the php.ini values that are important.

Thanks in advance (TIA)
- Nicolaas

<?php
include_once("s tartup.php");
if ( !startup( ) ) {
die("could not load application");
}
...
...//page content here
...
echo '<a href="testme.ph p?'.sid(false). '">link one on the page</a>';
echo '<a href="testme.ph p?a=3'.sid(true ).'">link two on the page</a>';
....
....//more page content here
....
?>
/*startup.php file: */
//function to start session
function startup() {
$expiry = 60 * 60 * 24 * 1000;
ini_set('sessio n.cache_limiter ', 'nocache');
ini_set('sessio n.use_trans_sid ', 1);
ini_set('arg_se parator.output' , "&amp;");
ini_set('sessio n.use_cookies', 1);
ini_set('sessio n.use_only_cook ies', 0);
setcookie("Cook ieTest", "t"); //set a cookie so next time we know if the
user can do cookies
ini_set('sessio n.cookie_lifeti me', $expiry);
session_start() ;
}
//function to include session ID in case they do not accept cookies
function sid($withamp) {
if($_COOKIE["CookieTest "] == "t") {
return '';
}
$s = session_id();
if($s) {
if($withamp) {
$v = '&amp;';
}
$v .= 'PHPSESSID='.$s ;
return $v;
}
}
/* end of startup.php */

[Berimor]

On Sun, 6 Nov 2005 11:09:58 +1300, windandwaves <wi*********@co ldmail.com>
wrote:

Hi Folk

Forgive me for asking such a basic question... I have a site where I
want to
track the user from start till end... To do this, I have setup the
following structure for each page, referring to startup.php, where the
session is managed. Can anyone check that I am doing it right. I
thought I
was doing it right, but then the site started doing really, really funny
stuff, basically loosing track of sessions ...

I want my application to be as portable as possible, so I want to
override
all the php.ini values that are important.

Thanks in advance (TIA)
- Nicolaas

<?php
include_once("s tartup.php");
if ( !startup( ) ) {
die("could not load application");
}
...
...//page content here
...
echo '<a href="testme.ph p?'.sid(false). '">link one on the page</a>';
echo '<a href="testme.ph p?a=3'.sid(true ).'">link two on the page</a>';
...
...//more page content here
...
?>
/*startup.php file: */
//function to start session
function startup() {
$expiry = 60 * 60 * 24 * 1000;
ini_set('sessio n.cache_limiter ', 'nocache');
ini_set('sessio n.use_trans_sid ', 1);
ini_set('arg_se parator.output' , "&amp;");
ini_set('sessio n.use_cookies', 1);
ini_set('sessio n.use_only_cook ies', 0);
setcookie("Cook ieTest", "t"); //set a cookie so next time we know if the
user can do cookies
ini_set('sessio n.cookie_lifeti me', $expiry);
session_start() ;
}
session_start() should first in output to browser. Try to place
thesetcookie() after session_start() .

//function to include session ID in case they do not accept cookies
function sid($withamp) {
if($_COOKIE["CookieTest "] == "t") {
return '';
}
$s = session_id();
if($s) {
if($withamp) {
$v = '&amp;';
}
$v .= 'PHPSESSID='.$s ;
return $v;
}
}
/* end of startup.php */

--
Exact Meta Search | Major Search Engine
http://exactsearcher.com

[windandwaves]

Berimor wrote:
......

session_start() should first in output to browser. Try to place
thesetcookie() after session_start() .
Ok, interesting ;-) Can you explain me why that is? Just so that I
understand.. Will do

//function to include session ID in case they do not accept cookies
function sid($withamp) {
if($_COOKIE["CookieTest "] == "t") {
return '';
}
$s = session_id();
if($s) {
if($withamp) {
$v = '&amp;';
}
$v .= 'PHPSESSID='.$s ;
return $v;
}
}
/* end of startup.php */

[Berimor]

On Sun, 6 Nov 2005 14:49:20 +1300, windandwaves <wi*********@co ldmail.com>
wrote:

Berimor wrote:
.....

session_start() should first in output to browser. Try to place
thesetcookie() after session_start() .
Ok, interesting ;-) Can you explain me why that is? Just so that I
understand.. Will do

the PHP Manual says

" ... Note: If you are using cookie-based sessions, you must call
session_start() before anything is output to the browser.
"

the nature of sesion mechanism is more complex than just cookie. You can
set cookie at any place of script - you just make easy operation - write
the information to broweser's cookie. When session starts it uses cookie
only to save session identificator but behind the curtains huge piece of
work being done - session prepares the, so called, session environment. I
have never dig it deeply though :)
Let mne know if this helped.

//function to include session ID in case they do not accept cookies
function sid($withamp) {
if($_COOKIE["CookieTest "] == "t") {
return '';
}
$s = session_id();
if($s) {
if($withamp) {
$v = '&amp;';
}
$v .= 'PHPSESSID='.$s ;
return $v;
}
}
/* end of startup.php */

--
Exact Meta Search | Major Search Engine
http://exactsearcher.com

[HappyHourHotSpots.com]

I dont know why PHP is so picky, but on the top of every page i write
that requires sessions the very first line is

<?php session_start() ; ?>

and then i do everything else in a new <?php ?> block. I spent about 2
days figuring that out when i was teaching myself PHP and found that
was the best way to do it. If anyone else knows a different method
then please let me know.

-Rick

----------------------------
Looking for a place to drink tonight? Visit HappyHourHotSpo ts.com!

[myname]

Berimor wrote:

the nature of sesion mechanism is more complex than just cookie. You
can set cookie at any place of script - you just make easy operation -
write the information to broweser's cookie.

Actually, a cookie is part of the header. So cookies must be sent before
content

http://dk2.php.net/setcookie

[Geoff Berrow]

Message-ID: <43************ ***********@dte xt01.news.tele. dk> from myname
contained the following:

the nature of sesion mechanism is more complex than just cookie. You
can set cookie at any place of script - you just make easy operation -
write the information to broweser's cookie.

Actually, a cookie is part of the header. So cookies must be sent before
content

Cookies are sent by the client to the server as long as they have
previously been set by the server . A cookie cannot be set and sent
simultaneously. I find this confuses the hell out of my students...

--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Berimor]

> Cookies are sent by the client to the server as long as they have

previously been set by the server . A cookie cannot be set and sent
simultaneously. I find this confuses the hell out of my students...

Sure, do doubt.
But if you read whole thread, problem was about SETTING session variable
and cookies, not sending.
So, if setcookie() was called before session_start() - sure there will be
a problem registering session in your browser - mean writing session ID to
it.
If php ini file set correct the interpretator will rise error.

--
---
Exact Meta Search | Major Search Engine
http://exactsearcher.com

[Berimor]

On Mon, 07 Nov 2005 09:17:27 +0200, myname <none@invalid > wrote:

Actually, a cookie is part of the header. So cookies must be sent before
content

http://dk2.php.net/setcookie

its Manual!!!

the PHP Manual says

" ... Note: If you are using cookie-based sessions, you must call
session_start() before anything is output to
the browser.
"


---
Exact Meta Search | Major Search Engine
http://exactsearcher.com

[myname]

Berimor wrote:

its Manual!!!

the PHP Manual says

" ... Note: If you are using cookie-based sessions, you must call
session_start() before anything is output to
the browser.
"

I was referring to the part where you said:
"You can set cookie at any place of script"

That is only true, as long there has not been sent anything to the
client. Or if using output buffering