session IDs and the like

[windandwaves]

Hi Folk

Forgive me for asking such a basic question... I have a site where I want to
track the user from start till end... To do this, I have setup the
following structure for each page, referring to startup.php, where the
session is managed. Can anyone check that I am doing it right. I thought I
was doing it right, but then the site started doing really, really funny
stuff, basically loosing track of sessions ...

I want my application to be as portable as possible, so I want to override
all the php.ini values that are important.

Thanks in advance (TIA)
- Nicolaas

<?php
include_once("startup.php");
if ( !startup( ) ) {
die("could not load application");
}
...
...//page content here
...
echo '<a href="testme.php?'.sid(false).'">link one on the page</a>';
echo '<a href="testme.php?a=3'.sid(true).'">link two on the page</a>';
....
....//more page content here
....
?>
/*startup.php file: */
//function to start session
function startup() {
$expiry = 60 * 60 * 24 * 1000;
ini_set('session.cache_limiter', 'nocache');
ini_set('session.use_trans_sid', 1);
ini_set('arg_separator.output', "&amp;");
ini_set('session.use_cookies', 1);
ini_set('session.use_only_cookies', 0);
setcookie("CookieTest", "t"); //set a cookie so next time we know if the
user can do cookies
ini_set('session.cookie_lifetime', $expiry);
session_start();
}
//function to include session ID in case they do not accept cookies
function sid($withamp) {
if($_COOKIE["CookieTest"] == "t") {
return '';
}
$s = session_id();
if($s) {
if($withamp) {
$v = '&amp;';
}
$v .= 'PHPSESSID='.$s;
return $v;
}
}
/* end of startup.php */

[Berimor]

On Sun, 6 Nov 2005 11:09:58 +1300, windandwaves <wi*********@coldmail.com>
wrote:

Hi Folk

Forgive me for asking such a basic question... I have a site where I
want to
track the user from start till end... To do this, I have setup the
following structure for each page, referring to startup.php, where the
session is managed. Can anyone check that I am doing it right. I
thought I
was doing it right, but then the site started doing really, really funny
stuff, basically loosing track of sessions ...

I want my application to be as portable as possible, so I want to
override
all the php.ini values that are important.

Thanks in advance (TIA)
- Nicolaas

<?php
include_once("startup.php");
if ( !startup( ) ) {
die("could not load application");
}
...
...//page content here
...
echo '<a href="testme.php?'.sid(false).'">link one on the page</a>';
echo '<a href="testme.php?a=3'.sid(true).'">link two on the page</a>';
...
...//more page content here
...
?>
/*startup.php file: */
//function to start session
function startup() {
$expiry = 60 * 60 * 24 * 1000;
ini_set('session.cache_limiter', 'nocache');
ini_set('session.use_trans_sid', 1);
ini_set('arg_separator.output', "&amp;");
ini_set('session.use_cookies', 1);
ini_set('session.use_only_cookies', 0);
setcookie("CookieTest", "t"); //set a cookie so next time we know if the
user can do cookies
ini_set('session.cookie_lifetime', $expiry);
session_start();
}
session_start() should first in output to browser. Try to place
thesetcookie() after session_start().

//function to include session ID in case they do not accept cookies
function sid($withamp) {
if($_COOKIE["CookieTest"] == "t") {
return '';
}
$s = session_id();
if($s) {
if($withamp) {
$v = '&amp;';
}
$v .= 'PHPSESSID='.$s;
return $v;
}
}
/* end of startup.php */

--
Exact Meta Search | Major Search Engine
http://exactsearcher.com

[windandwaves]

Berimor wrote:
......

session_start() should first in output to browser. Try to place
thesetcookie() after session_start().
Ok, interesting ;-) Can you explain me why that is? Just so that I
understand.. Will do

//function to include session ID in case they do not accept cookies
function sid($withamp) {
if($_COOKIE["CookieTest"] == "t") {
return '';
}
$s = session_id();
if($s) {
if($withamp) {
$v = '&amp;';
}
$v .= 'PHPSESSID='.$s;
return $v;
}
}
/* end of startup.php */

[Berimor]

On Sun, 6 Nov 2005 14:49:20 +1300, windandwaves <wi*********@coldmail.com>
wrote:

Berimor wrote:
.....

session_start() should first in output to browser. Try to place
thesetcookie() after session_start().
Ok, interesting ;-) Can you explain me why that is? Just so that I
understand.. Will do

the PHP Manual says

" ... Note: If you are using cookie-based sessions, you must call
session_start() before anything is output to the browser.
"

the nature of sesion mechanism is more complex than just cookie. You can
set cookie at any place of script - you just make easy operation - write
the information to broweser's cookie. When session starts it uses cookie
only to save session identificator but behind the curtains huge piece of
work being done - session prepares the, so called, session environment. I
have never dig it deeply though :)
Let mne know if this helped.

//function to include session ID in case they do not accept cookies
function sid($withamp) {
if($_COOKIE["CookieTest"] == "t") {
return '';
}
$s = session_id();
if($s) {
if($withamp) {
$v = '&amp;';
}
$v .= 'PHPSESSID='.$s;
return $v;
}
}
/* end of startup.php */

--
Exact Meta Search | Major Search Engine
http://exactsearcher.com

[HappyHourHotSpots.com]

I dont know why PHP is so picky, but on the top of every page i write
that requires sessions the very first line is

<?php session_start(); ?>

and then i do everything else in a new <?php ?> block. I spent about 2
days figuring that out when i was teaching myself PHP and found that
was the best way to do it. If anyone else knows a different method
then please let me know.

-Rick

----------------------------
Looking for a place to drink tonight? Visit HappyHourHotSpots.com!

[myname]

Berimor wrote:

the nature of sesion mechanism is more complex than just cookie. You
can set cookie at any place of script - you just make easy operation -
write the information to broweser's cookie.

Actually, a cookie is part of the header. So cookies must be sent before
content

http://dk2.php.net/setcookie

[Geoff Berrow]

Message-ID: <43***********************@dtext01.news.tele.dk> from myname
contained the following:

the nature of sesion mechanism is more complex than just cookie. You
can set cookie at any place of script - you just make easy operation -
write the information to broweser's cookie.

Actually, a cookie is part of the header. So cookies must be sent before
content

Cookies are sent by the client to the server as long as they have
previously been set by the server . A cookie cannot be set and sent
simultaneously. I find this confuses the hell out of my students...

--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Berimor]

> Cookies are sent by the client to the server as long as they have

previously been set by the server . A cookie cannot be set and sent
simultaneously. I find this confuses the hell out of my students...

Sure, do doubt.
But if you read whole thread, problem was about SETTING session variable
and cookies, not sending.
So, if setcookie() was called before session_start() - sure there will be
a problem registering session in your browser - mean writing session ID to
it.
If php ini file set correct the interpretator will rise error.

--
---
Exact Meta Search | Major Search Engine
http://exactsearcher.com

[Berimor]

On Mon, 07 Nov 2005 09:17:27 +0200, myname <none@invalid> wrote:

Actually, a cookie is part of the header. So cookies must be sent before
content

http://dk2.php.net/setcookie

its Manual!!!

the PHP Manual says

" ... Note: If you are using cookie-based sessions, you must call
session_start() before anything is output to
the browser.
"


---
Exact Meta Search | Major Search Engine
http://exactsearcher.com

[myname]

Berimor wrote:

its Manual!!!

the PHP Manual says

" ... Note: If you are using cookie-based sessions, you must call
session_start() before anything is output to
the browser.
"

I was referring to the part where you said:
"You can set cookie at any place of script"

That is only true, as long there has not been sent anything to the
client. Or if using output buffering

[Berimor]

On Mon, 07 Nov 2005 14:13:37 +0200, myname <none@invalid> wrote:

Berimor wrote:

its Manual!!!
the PHP Manual says
" ... Note: If you are using cookie-based sessions, you must call
session_start() before anything is output to
the browser.
"

I was referring to the part where you said:
"You can set cookie at any place of script"

That is only true, as long there has not been sent anything to the
client. Or if using output buffering

sure - i always use buffering.

Note: As of PHP 4, you can use output buffering to send output prior to
the call of this function, with the overhead of all of your output to the
browser being buffered in the server until you send it. You can do this by
calling ob_start() and ob_end_flush() in your script, or setting the
output_buffering configuration directive on in your php.ini or server
configuration files.

--
---
Exact Meta Search | Major Search Engine
http://exactsearcher.com

[R. Rajesh Jeba Anbiah]

windandwaves wrote:
<snip>

. Can anyone check that I am doing it right. I thought I
was doing it right, but then the site started doing really, really funny
stuff, basically loosing track of sessions ...

I want my application to be as portable as possible, so I want to override
all the php.ini values that are important. <snip> echo '<a href="testme.php?'.sid(false).'">link one on the page</a>';
echo '<a href="testme.php?a=3'.sid(true).'">link two on the page</a>'; <snip> /*startup.php file: */
//function to start session
function startup() {
$expiry = 60 * 60 * 24 * 1000;
ini_set('session.cache_limiter', 'nocache');
ini_set('session.use_trans_sid', 1);
I couldn't find errors in the code. But,
ini_set('session.use_trans_sid', 1) is possible only in PHP 5.

<snip> //function to include session ID in case they do not accept cookies
function sid($withamp) {

<snip>

This looks overkill. You don't have to append the URL's manually
when you use trans sid.

--
<?php echo 'Just another PHP saint'; ?>
Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com/

[windandwaves]

HappyHourHotSpots.com wrote:

I dont know why PHP is so picky, but on the top of every page i write
that requires sessions the very first line is

<?php session_start(); ?>

and then i do everything else in a new <?php ?> block. I spent about
2 days figuring that out when i was teaching myself PHP and found that
was the best way to do it. If anyone else knows a different method
then please let me know.

-Rick

----------------------------
Looking for a place to drink tonight? Visit HappyHourHotSpots.com!

I dont think you have to. I think you had some script that accidentally
outputted something (e.g. a line or a space).

My scripts go like this

<?php
session_start();
...
.....
....
?>

and it works fine.

[windandwaves]

R. Rajesh Jeba Anbiah wrote:

windandwaves wrote:
<snip>

. Can anyone check that I am doing it right. I thought I
was doing it right, but then the site started doing really, really
funny stuff, basically loosing track of sessions ...

I want my application to be as portable as possible, so I want to
override all the php.ini values that are important. <snip>

echo '<a href="testme.php?'.sid(false).'">link one on the page</a>';
echo '<a href="testme.php?a=3'.sid(true).'">link two on the
page</a>';

<snip>

/*startup.php file: */
//function to start session
function startup() {
$expiry = 60 * 60 * 24 * 1000;
ini_set('session.cache_limiter', 'nocache');
ini_set('session.use_trans_sid', 1);

I couldn't find errors in the code. But,
ini_set('session.use_trans_sid', 1) is possible only in PHP 5.

hmmm, i kept wondering why it did not work. I am using php 4.2
<snip>

//function to include session ID in case they do not accept cookies
function sid($withamp) {

<snip>

This looks overkill. You don't have to append the URL's manually
when you use trans sid.

see above. If use_trans_sid does not work then I will have to manually add
the session IDs for people without cookies???

Thanks for the reply. Much appreciated.

- Nicolaas

[windandwaves]

Berimor wrote:
.....

Note: As of PHP 4, you can use output buffering to send output prior
to the call of this function, with the overhead of all of your output
to the browser being buffered in the server until you send it. You
can do this by calling ob_start() and ob_end_flush() in your script,
or setting the output_buffering configuration directive on in your
php.ini or server configuration files.

I just started to use this. It is absolutely f. brilliant! I now delete
any extra spaces in my html using this system using the function below:

function trimmer($buffer) {
$buffer = preg_replace("/[\r\n]+[\s\t]*[\r\n]+/","\n",$buffer); //strip
blank lines (blank, with tab or whitespaces)
$buffer = trim(str_replace("\r\n", " ", $buffer)); //removes line-breaks
$buffer = trim(str_replace("\n", " ", $buffer));
$buffer = trim(str_replace("\t", " ", $buffer)); //removes tabs
$buffer = trim(eregi_replace(" +", " ", $buffer)); //removes spaces
return $buffer;
}

Works a treat. It makes the loading funny, because before I used this
function, I would slowly see the page being developed on the screen, while
now, you see a blank space for about a second and then the whole page shows
up at once. Something I also noticed on www.cnn.com, while my local
newspaper www.stuff.co.nz does it my old way (you slowly see the page being
build).