Trouble with sessions

[amir103]

I'm trying to get sessions to work, but I'm having trouble. To test it, I made two php files: one which creates the session, and the other which picks up the sessions and displays it. Here they are:
<?
session_start();
$_SESSION['bob']='it worked';
?>
and
<?
session_start();
include 'bob.php';
echo $_SESSION['bob'];
?>

You can see that the second script includes the first, this is because I need the simple mechanism of a value to be passed on to another file, but that first file cannot redirect (or use the header function) to the second. This is because these files are not browsed, instead: the first script acts as an XML parser (in the more complicated version) and has to pass on the info to another page which simply displays it in the right format (font, sizer, colour etc.). So the second script is also included in the actual page, so that the information is shown in the font and colour.

The script I have above simply doesn't work, and says: Notice: Undefined index: bob on line 4.

How can I make the first script pass on information to the second considering the limitations?

[mlseim]

The very first thing in the first script ... you set the session variable(s)

<?
session_start();
session_register(name);
$name = "Bob Smith";
session_register(user);
$user = "12345678";
?>

In ANY OTHER SCRIPT, you then do this ....

<?
session_start();

// your next script
// blah blah
//
// anywhere in this script, you can utilize the
// two variables $name and $user.

$echo "Hi $name, you are user: $user";

?>


Finally, closing your browser ends the session, or you can have
a log-out script that kills them, like this ....

<?php
if(session_start()){
session_destroy();}
header ("location: index.php");
?>

[amir103]

Are you sure that's correct? Because it didn't work at all. Don't you have to use this: '$_SESSION'?

[Fou-Lu]

That code will work in a register_globals = 1 environment - it was used frequently pre php 4.2. Most hosts still allow register globals for backwards compatibility, but I would not recommend depending on register globals.
Heres what I recommend testing. Try an output for session_id() instead of your session variable. To start with, if its an empty string, there is no session handling at all. Second, if you get a wacky output (32 random hex chars), then you've got a session. Make note of it, either the first four or last four characters. Refresh the page. If the session id changes, it means that you cannot carry a session id, and its constantly refreshing.
PHP has the craziest default session handling variables I've ever seen. If I'm not mistaken, the [important] defaults are:

session.use_cookies = 1;
session.use_only_cookies = 1;
session.use_trans_sid = ;

So the first thing I would do, is use a globalized session script that FIRST changes these values:

<?php
ini_set("session.use_cookies", 1);
ini_set("session.use_only_cookies", 0);
ini_set("session.use_trans_sid", 1);

Then go with your session handling. Use the trans_sid only if you don't want to have to append a SID to the end of every one of your links, though if your security is an issue, I wouldn't use the built in session handling anyway. Try those, then get back to use if it doesn't work.

[Troy297]

lol - follow the advice above... your first bit of script doesn't actually start a session it... well it doesn't really do anything. You need to use the php, session_register() to actually create sessions....

[Fou-Lu]

Do not use session_register. It will ONLY work in a register_globals environment - which has been disabled by default as of php version 4.2.0, and will be removed entirely from php versions 6.0.0. Do not rely on a register_globals environment - stick with the $_SESSION superglobal you are currently using.
There is nothing wrong with your script either. session_start is all that is required to initialize a session in php, and you are setting via $_SESSION superglobal. Therefore, it is down to a configuration issue with your php.ini session.* directives.

[CFMaBiSmAd]

Firstly, if you are just including files, using a session to pass values is a waste of resources (it causes a session file to be created with file reads/writes and causes a session cookie to be sent to the browser that is never used.) Just set normal variables and they can be accessed directly after the include(...) statement.

Secondly, I tested the code (ignoring that the second session_start(); in the included file will cause a Notice: message that a session has already been started if the include(...) works) the only way I could duplicate your Notice: message about the Undefined index: bob was if the include(...) failed. However, this causes a Warning message about the failure of the include(...) statement. It is possible but unlikely that notice messages are enabled but warnings are not.

Try putting this in after your first opening php tag in the main file -
error_reporting(E_ALL);