Valid XHTML with PHP sessions?

**Ian.H** · Jul 17 '05, 07:32 AM

Re: Valid XHTML with PHP sessions?

On Wed, 28 Jul 2004 16:56:29 +0000, Justin Koivisto wrote:
[color=blue]
> OK, on my quest to get one PHP site that is actually valid XHTML 1.0
> (strict)...
>
> PHP 4.3.8: session.use_tra ns_sid=1
>
> What is happening is the validator (that doesn't use cookies) sees
> things like the following in the source (which are put in there from the
> use_trans_sid setting after script execution):
>
> ...
> <a href="/statistics/?PHPSESSID=1423 fa4c27d130ea743 ffd9912f60de4">
> ...
>
> Which throws errors like:
>
> Line 48, column 139: document type does not allow element "input" here;
> missing one of "p", "h1", "h2", "h3", "h4", "h5", "h6", "div", "pre",
> "address", "fieldset", "ins", "del" start-tag
>
> and
>
> Line 66, column 194: cannot generate system identifier for general
> entity "PHPSESSID"
>
> Anyone have any hints or pointers to correct this?[/color]

Justin, I haven't tested this and something simply off the top of my
head.. have you tried making your HTML something like:

<form ...><div>
[ form elements here ]
</div></form>

I don't know what routine PHP uses when inserting the session ID into a
form area other than it appears to add it to a newline under the <form>
initiation line. Hoping that it kind of "ignores" the <div> after <form>,
it'll end up dumping the hidden element into the <div> area which will
allow for valid XHTML (<form> is not a container etc etc)

It may be that, PHP actually checks for the entire <form...> tag and
inserts the hidden field directly after it inwhich case the above idea
would obviously fail, but it's something I'd try myself if you haven't
already. Would be interested to hear the results of this if you do try it =)

Regards,

Ian

--
Ian.H
digiServ Network
London, UK

http://digiserv.net/

**Justin Koivisto** · Jul 17 '05, 07:32 AM

Re: Valid XHTML with PHP sessions?

Ian.H wrote:
[color=blue]
> On Wed, 28 Jul 2004 16:56:29 +0000, Justin Koivisto wrote:
>
>[color=green]
>>OK, on my quest to get one PHP site that is actually valid XHTML 1.0
>>(strict)...
>>
>>PHP 4.3.8: session.use_tra ns_sid=1
>>
>>What is happening is the validator (that doesn't use cookies) sees
>>things like the following in the source (which are put in there from the
>>use_trans_s id setting after script execution):
>>
>>...
>><a href="/statistics/?PHPSESSID=1423 fa4c27d130ea743 ffd9912f60de4">
>>...
>>
>>Which throws errors like:
>>
>>Line 48, column 139: document type does not allow element "input" here;
>>missing one of "p", "h1", "h2", "h3", "h4", "h5", "h6", "div", "pre",
>>"address", "fieldset", "ins", "del" start-tag
>>
>>and
>>
>>Line 66, column 194: cannot generate system identifier for general
>>entity "PHPSESSID"
>>
>>Anyone have any hints or pointers to correct this?[/color]
>
>
>
> Justin, I haven't tested this and something simply off the top of my
> head.. have you tried making your HTML something like:
>
> <form ...><div>
> [ form elements here ]
> </div></form>[/color]

It is. Everything about the page is valid, except when useing trans-sid.
I turned it off to be sure...
[color=blue]
> I don't know what routine PHP uses when inserting the session ID into a
> form area other than it appears to add it to a newline under the <form>
> initiation line. Hoping that it kind of "ignores" the <div> after <form>,
> it'll end up dumping the hidden element into the <div> area which will
> allow for valid XHTML (<form> is not a container etc etc)
>
> It may be that, PHP actually checks for the entire <form...> tag and
> inserts the hidden field directly after it inwhich case the above idea
> would obviously fail, but it's something I'd try myself if you haven't
> already. Would be interested to hear the results of this if you do try it =)[/color]

Nope. PHP replaces '<form ...>' with '<form ...><input... />' - even if
there is a DIV element after the FORM start tag.

It's not just the form elements... In anchor tags, if you have something
like:

<a href="/?group=3">group 3</a>

it's changed to:

<a href="/?group=3&PHPSES SID=djf8fdjrigk v7eru4i4ei8h3r9 f5n">group 3</a>

It uses "&" instead of "&", and since it's done *after* script
execution, there isn't a way to simply do a preg_replace on the output
buffer. :\

--
Justin Koivisto - spam@koivi.com
PHP POSTERS: Please use comp.lang.php for PHP related questions,
alt.php* groups are not recommended.

**Andy Hassall** · Jul 17 '05, 07:32 AM

Re: Valid XHTML with PHP sessions?

On Wed, 28 Jul 2004 17:17:48 GMT, Justin Koivisto <spam@koivi.com > wrote:
[color=blue]
>It's not just the form elements... In anchor tags, if you have something
>like:
>
><a href="/?group=3">group 3</a>
>
>it's changed to:
>
><a href="/?group=3&PHPSES SID=djf8fdjrigk v7eru4i4ei8h3r9 f5n">group 3</a>
>
>It uses "&" instead of "&", and since it's done *after* script
>execution, there isn't a way to simply do a preg_replace on the output
>buffer. :\[/color]

Just set arg_separator.o utput correctly and you're sorted.

--
Andy Hassall <andy@andyh.co. uk> / Space: disk usage analysis tool
http://www.andyh.co.uk / http://www.andyhsoftware.co.uk/space

**GreyWyvern** · Jul 17 '05, 07:32 AM

Re: Valid XHTML with PHP sessions?

On Wed, 28 Jul 2004 16:56:29 GMT, Justin Koivisto <spam@koivi.com > wrote:
[color=blue]
> OK, on my quest to get one PHP site that is actually valid XHTML 1.0
> (strict)...
>
> PHP 4.3.8: session.use_tra ns_sid=1
>
> What is happening is the validator (that doesn't use cookies) sees
> things like the following in the source (which are put in there from the
> use_trans_sid setting after script execution):
>
> ...
> <a href="/statistics/?PHPSESSID=1423 fa4c27d130ea743 ffd9912f60de4">
> ...
>
> Which throws errors like:
>
> Line 48, column 139: document type does not allow element "input" here;
> missing one of "p", "h1", "h2", "h3", "h4", "h5", "h6", "div", "pre",
> "address", "fieldset", "ins", "del" start-tag[/color]

<form> isn't a container. The <input> tag needs to be contained within a
grouping tag. Don't use <div>, use <fieldset> instead for more meaningful
HTML.
[color=blue]
> Line 66, column 194: cannot generate system identifier for general
> entity "PHPSESSID"
>
> Anyone have any hints or pointers to correct this?[/color]

I tried inserting that <a> tag in my own XHTML Strict pages and they still
validated fine.

What I'm guessing is that it isn't the "/statistics/?PHPSESSID=..." links
it's complaining about, but those where there are extra GET variables like
"/statistics/?id=4&PHPSESSID =..." where the validator would try to make
PHPSESSID into an html entity and fail.

Do you have a URI we could look at?

Grey

--
The technical axiom that nothing is impossible sinisterly implies the
pitfall corollory that nothing is ridiculous.
- http://www.greywyvern.com - Orca Knowledgebase: Completely CSS styleable
Knowledgebase/FAQ system

**Tim Van Wassenhove** · Jul 17 '05, 07:32 AM

Re: Valid XHTML with PHP sessions?

In article <0dRNc.749$jz4. 24622@news7.onv oy.net>, Justin Koivisto wrote:[color=blue]
> Ian.H wrote:[color=green]
>> I don't know what routine PHP uses when inserting the session ID into a
>> form area other than it appears to add it to a newline under the <form>
>> initiation line. Hoping that it kind of "ignores" the <div> after <form>,
>> it'll end up dumping the hidden element into the <div> area which will
>> allow for valid XHTML (<form> is not a container etc etc)[/color][/color]

If you search this group, or the php bug database (think #13472) you'll
find workarounds...

--
Tim Van Wassenhove <http://home.mysth.be/~timvw>

**Toby Inkster** · Jul 17 '05, 07:32 AM

Re: Valid XHTML with PHP sessions?

Justin Koivisto wrote:
[color=blue]
> OK, on my quest to get one PHP site that is actually valid XHTML 1.0
> (strict)...[/color]

Not hard. Mine validates to XHTML 1.1 Strict and with a change of doctype
most pages also validate to XHTML 1.0 Strict and XHTML 1.0 Basic. If a
dolt like me can do it, I'm sure you can.
[color=blue]
> Line 48, column 139: document type does not allow element "input" here;
> missing one of "p", "h1", "h2", "h3", "h4", "h5", "h6", "div", "pre",
> "address", "fieldset", "ins", "del" start-tag[/color]

You've probably done something like:
<form><input/></form>

You need something nested between the <form> and <input> elements -- some
kind of block element. For example:

<form><fieldset ><input/></fieldset></form>
[color=blue]
> Line 66, column 194: cannot generate system identifier for general
> entity "PHPSESSID"[/color]

You have a URL with an '&' sign in it. Replace the '&' with '&'.

Both of these are errors in HTML 4.01 too -- it's not just XHTML that's
causing you problems.

--
Toby A Inkster BSc (Hons) ARCS
Contact Me ~ http://tobyinkster.co.uk/contact
Now Playing ~ ./william_shatner _-_common_people_ sample.ogg

**Justin Koivisto** · Jul 17 '05, 07:32 AM

Re: Valid XHTML with PHP sessions?

Andy Hassall wrote:[color=blue]
> On Wed, 28 Jul 2004 17:17:48 GMT, Justin Koivisto <spam@koivi.com > wrote:
>
>[color=green]
>>It's not just the form elements... In anchor tags, if you have something
>>like:
>>
>><a href="/?group=3">group 3</a>
>>
>>it's changed to:
>>
>><a href="/?group=3&PHPSES SID=djf8fdjrigk v7eru4i4ei8h3r9 f5n">group 3</a>
>>
>>It uses "&" instead of "&", and since it's done *after* script
>>execution, there isn't a way to simply do a preg_replace on the output
>>buffer. :\[/color]
>
>
> Just set arg_separator.o utput correctly and you're sorted.[/color]

GREAT! (I knew there had to be something for that one...)

Now if I can just get the form thing fixed...

--
Justin Koivisto - spam@koivi.com
PHP POSTERS: Please use comp.lang.php for PHP related questions,
alt.php* groups are not recommended.

**Justin Koivisto** · Jul 17 '05, 07:32 AM

Re: Valid XHTML with PHP sessions?

GreyWyvern wrote:
[color=blue]
> On Wed, 28 Jul 2004 16:56:29 GMT, Justin Koivisto <spam@koivi.com > wrote:
>[color=green]
>> OK, on my quest to get one PHP site that is actually valid XHTML 1.0
>> (strict)...
>>
>> PHP 4.3.8: session.use_tra ns_sid=1
>>
>> What is happening is the validator (that doesn't use cookies) sees
>> things like the following in the source (which are put in there from
>> the use_trans_sid setting after script execution):
>>
>> ...
>> <a href="/statistics/?PHPSESSID=1423 fa4c27d130ea743 ffd9912f60de4">
>> ...
>>
>> Which throws errors like:
>>
>> Line 48, column 139: document type does not allow element "input"
>> here; missing one of "p", "h1", "h2", "h3", "h4", "h5", "h6", "div",
>> "pre", "address", "fieldset", "ins", "del" start-tag[/color]
>
> <form> isn't a container. The <input> tag needs to be contained within
> a grouping tag. Don't use <div>, use <fieldset> instead for more
> meaningful HTML.[/color]

Good tip, it has been changed to fieldset.
[color=blue][color=green]
>> Line 66, column 194: cannot generate system identifier for general
>> entity "PHPSESSID"
>>
>> Anyone have any hints or pointers to correct this?[/color]
>
> I tried inserting that <a> tag in my own XHTML Strict pages and they
> still validated fine.
>
> What I'm guessing is that it isn't the "/statistics/?PHPSESSID=..."
> links it's complaining about, but those where there are extra GET
> variables like "/statistics/?id=4&PHPSESSID =..." where the validator
> would try to make PHPSESSID into an html entity and fail.
>
> Do you have a URI we could look at?[/color]

Not that I can publish here... However, this part has been corrected now
with the setting of arg_separator.o utput to "&" via .htaccess.

--
Justin Koivisto - spam@koivi.com
PHP POSTERS: Please use comp.lang.php for PHP related questions,
alt.php* groups are not recommended.

**Justin Koivisto** · Jul 17 '05, 07:32 AM

Re: Valid XHTML with PHP sessions?

Toby Inkster wrote:
[color=blue]
> Justin Koivisto wrote:
>[color=green]
>>Line 48, column 139: document type does not allow element "input" here;
>>missing one of "p", "h1", "h2", "h3", "h4", "h5", "h6", "div", "pre",
>>"address", "fieldset", "ins", "del" start-tag[/color]
>
> You've probably done something like:
> <form><input/></form>[/color]

Not me, PHP... but only when session.use_tra ns_sid = 1 and the client
doesn't have cookies...
[color=blue][color=green]
>>Line 66, column 194: cannot generate system identifier for general
>>entity "PHPSESSID"[/color]
>
> You have a URL with an '&' sign in it. Replace the '&' with '&'.[/color]

Solved by setting arg_separator.o utput to "&"... it was PHP, not the
code (that validates just fine).

--
Justin Koivisto - spam@koivi.com
PHP POSTERS: Please use comp.lang.php for PHP related questions,
alt.php* groups are not recommended.

**Charles Sweeney** · Jul 17 '05, 07:32 AM

Re: Valid XHTML with PHP sessions?

Justin Koivisto wrote:
[color=blue]
> OK, on my quest to get one PHP site that is actually valid XHTML 1.0
> (strict)...[/color]

For why?

--
Charles Sweeney

Charles Sweeney

http://CharlesSweeney.com

Charles Sweeney's homepage.

**Ian.H** · Jul 17 '05, 07:32 AM

Re: Valid XHTML with PHP sessions?

On Wed, 28 Jul 2004 17:17:48 +0000, Justin Koivisto wrote:

[ snip ]

[color=blue][color=green]
>> I don't know what routine PHP uses when inserting the session ID into a
>> form area other than it appears to add it to a newline under the <form>
>> initiation line. Hoping that it kind of "ignores" the <div> after <form>,
>> it'll end up dumping the hidden element into the <div> area which will
>> allow for valid XHTML (<form> is not a container etc etc)
>>
>> It may be that, PHP actually checks for the entire <form...> tag and
>> inserts the hidden field directly after it inwhich case the above idea
>> would obviously fail, but it's something I'd try myself if you haven't
>> already. Would be interested to hear the results of this if you do try it =)[/color]
>
> Nope. PHP replaces '<form ...>' with '<form ...><input... />' - even if
> there is a DIV element after the FORM start tag.[/color]

Good to hear the anchor side of things is sorted Justin.. but the above is
a little of a bitch =\ Other than Tim's suggestion of reading the bugs DB,
not sure what to offer as a solution (I haven't read the bugs DB regarding
this either..... yet =) ).

Regards,

Ian

--
Ian.H
digiServ Network
London, UK

http://digiserv.net/

**Justin Koivisto** · Jul 17 '05, 07:32 AM

Re: Valid XHTML with PHP sessions?

Charles Sweeney wrote:
[color=blue]
> Justin Koivisto wrote:
>[color=green]
>>OK, on my quest to get one PHP site that is actually valid XHTML 1.0
>>(strict)...[/color]
>
> For why?[/color]

shits & giggles really...

--
Justin Koivisto - spam@koivi.com
PHP POSTERS: Please use comp.lang.php for PHP related questions,
alt.php* groups are not recommended.

**Justin Koivisto** · Jul 17 '05, 07:32 AM

SOLVED: Valid XHTML with PHP sessions?

Justin Koivisto wrote:
[color=blue]
> OK, on my quest to get one PHP site that is actually valid XHTML 1.0
> (strict)...
>
> PHP 4.3.8: session.use_tra ns_sid=1
>
> What is happening is the validator (that doesn't use cookies) sees
> things like the following in the source (which are put in there from the
> use_trans_sid setting after script execution):
>
> ...
> <a href="/statistics/?PHPSESSID=1423 fa4c27d130ea743 ffd9912f60de4">
> ...
>
> Which throws errors like:
>
> Line 48, column 139: document type does not allow element "input" here;
> missing one of "p", "h1", "h2", "h3", "h4", "h5", "h6", "div", "pre",
> "address", "fieldset", "ins", "del" start-tag
>
> and
>
> Line 66, column 194: cannot generate system identifier for general
> entity "PHPSESSID"
>
> Anyone have any hints or pointers to correct this?[/color]

OK, the form's hidden input part of the problem (from my .htaccess file):

php_value url_rewriter.ta gs
"a=href,area=hr ef,frame=src,in put=src,fieldse t=fakeentry"

The anchor tag part:
php_value arg_separator.o utput "&"

Hope this helps someone!

--
Justin Koivisto - spam@koivi.com
PHP POSTERS: Please use comp.lang.php for PHP related questions,
alt.php* groups are not recommended.

**Charles Sweeney** · Jul 17 '05, 07:32 AM

Re: Valid XHTML with PHP sessions?

Justin Koivisto wrote:
[color=blue]
> Charles Sweeney wrote:
>[color=green]
>> Justin Koivisto wrote:
>>[color=darkred]
>>>OK, on my quest to get one PHP site that is actually valid XHTML 1.0
>>>(strict).. .[/color]
>>
>> For why?[/color]
>
> shits & giggles really...[/color]

As good a reason as any Mr K.

--
Charles Sweeney

Charles Sweeney

http://CharlesSweeney.com

Charles Sweeney's homepage.

Valid XHTML with PHP sessions?

Valid XHTML with PHP sessions?

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment