$_SESSION problem - page reload creates new Session ID

[Mimi]

Hello,

I am having trouble using the session vars in
PHP 4.3.9
OS: Win XP Prof
Web Server IIS (is local and there are no links to other servers from
the web pages I work on)
Browser: IE 6.0

The problem I am having is that each time I reload the same PHP page, I get
a different
Session ID (and thus all session vars are lost from one page to another).

let's say in firstpage.php I set
$_SESSION["firstvar"] = "someval";
$_SESSION["secvar"] = "otherval";

and in secpage.php I try to retrieve $_SESSION["firstvar"] , it gives me
"Undefined Index error"
I did not know what is happening and when printing out the session id (echo
SID;) I found out
that the ID is changing every time page is reloaded or when moving to
another page.

The problem is that I don't know what might reset the session since I use
"session_auto_s tart"
and have not played with session_start, session_destroy or anything else.

Can someone give me a hint on what might cause this ?

Thanks



Settings taken from PHP_INFO:
=============== =============== =============== =============
Session Support enabled
Registered save handlers files user

Directive Local Value Master Value
session.auto_st art On On
session.bug_com pat_42 On On
session.bug_com pat_warn On On
session.cache_e xpire 180 180
session.cache_l imiter nocache nocache
session.cookie_ domain no value no value
session.cookie_ lifetime 0 0
session.cookie_ path / /
session.cookie_ secure Off Off
session.entropy _file no value no value
session.entropy _length 0 0
session.gc_divi sor 100 100
session.gc_maxl ifetime 1440 1440
session.gc_prob ability 1 1
session.name PHPSESSID PHPSESSID
session.referer _check no value no value
session.save_ha ndler files files
session.save_pa th D:\PHP\SessionD ata D:\PHP\SessionD ata
session.seriali ze_handler php php
session.use_coo kies On On
session.use_onl y_cookies Off Off
session.use_tra ns_sid Off Off

[Erwin Moller]

Re: $_SESSION problem - page reload creates new Session ID

Mimi wrote:
[color=blue]
> Hello,
>
> I am having trouble using the session vars in
> PHP 4.3.9
> OS: Win XP Prof
> Web Server IIS (is local and there are no links to other servers from
> the web pages I work on)
> Browser: IE 6.0
>
> The problem I am having is that each time I reload the same PHP page, I
> get a different
> Session ID (and thus all session vars are lost from one page to another).
>
> let's say in firstpage.php I set
> $_SESSION["firstvar"] = "someval";
> $_SESSION["secvar"] = "otherval";
>
> and in secpage.php I try to retrieve $_SESSION["firstvar"] , it gives me
> "Undefined Index error"
> I did not know what is happening and when printing out the session id
> (echo SID;) I found out
> that the ID is changing every time page is reloaded or when moving to
> another page.
>
> The problem is that I don't know what might reset the session since I use
> "session_auto_s tart"
> and have not played with session_start, session_destroy or anything else.
>
> Can someone give me a hint on what might cause this ?
>
> Thanks
>
>
>
> Settings taken from PHP_INFO:
> =============== =============== =============== =============
> Session Support enabled
> Registered save handlers files user
>
> Directive Local Value Master Value
> session.auto_st art On On
> session.bug_com pat_42 On On
> session.bug_com pat_warn On On
> session.cache_e xpire 180 180
> session.cache_l imiter nocache nocache
> session.cookie_ domain no value no value
> session.cookie_ lifetime 0 0
> session.cookie_ path / /
> session.cookie_ secure Off Off
> session.entropy _file no value no value
> session.entropy _length 0 0
> session.gc_divi sor 100 100
> session.gc_maxl ifetime 1440 1440
> session.gc_prob ability 1 1
> session.name PHPSESSID PHPSESSID
> session.referer _check no value no value
> session.save_ha ndler files files
> session.save_pa th D:\PHP\SessionD ata D:\PHP\SessionD ata
> session.seriali ze_handler php php
> session.use_coo kies On On
> session.use_onl y_cookies Off Off
> session.use_tra ns_sid Off Off[/color]



Looks good to me.
Are you maybe jumping to another domain too when you say you jump to another
page?
Cookies are invisible when the domain changes (or even path in the same
domain in some cases)

http://www.domain1.com/somephp.php <- sets cookie with PHPSESSIONID

http://www.domain2.com/somephp.php <- invisible here

I am unsure if that is the case of course.

A great way to debug theese kind of problems is by simply investigating the
cookies set on your browser.
(Use Firefox or Mozilla for a userfriendly cookieviewer under tools)

Regards,
Erwin Moller

[Pedro Graca]

Re: $_SESSION problem - page reload creates new Session ID

Mimi wrote:[color=blue]
> The problem I am having is that each time I reload the same PHP page, I get
> a different
> Session ID (and thus all session vars are lost from one page to another).[/color]

<snip>
[color=blue]
> Can someone give me a hint on what might cause this ?[/color]

Did you start the session both for the firstpage.php and secpage.php?

--
Mail to my "From:" address is readable by all at http://www.dodgeit.com/
== ** ## !! ------------------------------------------------ !! ## ** ==
TEXT-ONLY mail to the whole "Reply-To:" address ("My Name" <my@address>)
may bypass my spam filter. If it does, I may reply from another address!

[Erwin Moller]

Re: $_SESSION problem - page reload creates new Session ID

Pedro Graca wrote:
[color=blue]
> Mimi wrote:[color=green]
>> The problem I am having is that each time I reload the same PHP page, I
>> get a different
>> Session ID (and thus all session vars are lost from one page to another).[/color]
>
> <snip>
>[color=green]
>> Can someone give me a hint on what might cause this ?[/color]
>
> Did you start the session both for the firstpage.php and secpage.php?
>[/color]

Mimi wrote:
[color=blue]
> The problem is that I don't know what might reset the session since I use
> "session_auto_s tart"[/color]

So that shouldn't be a problem.

Regards,
Erwin Moller

[Pedro Graca]

Re: $_SESSION problem - page reload creates new Session ID

Mimi wrote (edited):[color=blue]
> Can someone give me a hint on what might [make session not work] ?[/color]
[color=blue]
> Settings taken from PHP_INFO:[/color]
<snip>[color=blue]
> session.save_pa th D:\PHP\SessionD ata D:\PHP\SessionD ata[/color]

Are you sure PHP can write files here?

--
Mail to my "From:" address is readable by all at http://www.dodgeit.com/
== ** ## !! ------------------------------------------------ !! ## ** ==
TEXT-ONLY mail to the whole "Reply-To:" address ("My Name" <my@address>)
may bypass my spam filter. If it does, I may reply from another address!

[Mimi]

Re: $_SESSION problem - page reload creates new Session ID

Hello,

Thanks for all your input. Because there were several replies,
I will answer all of them here:

1) Yes, PHP can write in the "session_save_p ath" folder and I can see
there are 120 session files for the day and this is a local machine
where I am the only one to have access to.

2) The files I am trying to access are part of the same domain

3) Because I use "session_auto_s tart" in php.ini I am not required
to use "session_start( )" on php pages; So the answer is NO, I am not using
this function

Because the cause of the problem has not been identified, I am still
asking for your support.

Thanks


"Pedro Graca" <hexkid@dodgeit .com> wrote in message
news:slrncrjj2o .ln2.hexkid@ID-203069.user.uni-berlin.de...[color=blue]
> Mimi wrote (edited):[color=green]
>> Can someone give me a hint on what might [make session not work] ?[/color]
>[color=green]
>> Settings taken from PHP_INFO:[/color]
> <snip>[color=green]
>> session.save_pa th D:\PHP\SessionD ata D:\PHP\SessionD ata[/color]
>
> Are you sure PHP can write files here?
>
> --
> Mail to my "From:" address is readable by all at http://www.dodgeit.com/
> == ** ## !! ------------------------------------------------ !! ## ** ==
> TEXT-ONLY mail to the whole "Reply-To:" address ("My Name" <my@address>)
> may bypass my spam filter. If it does, I may reply from another address![/color]

[Pedro Graca]

Re: $_SESSION problem - page reload creates new Session ID

Mimi wrote:[color=blue]
> Because the cause of the problem has not been identified, I am still
> asking for your support.[/color]

Do you have cookies enabled in your browser?


Verify that and also try passing the session id in the url:

---- firstpage.php ----
echo '<a href="secpage.p hp?', SID, '">second page</a>';


--
Mail to my "From:" address is readable by all at http://www.dodgeit.com/
== ** ## !! ------------------------------------------------ !! ## ** ==
TEXT-ONLY mail to the whole "Reply-To:" address ("My Name" <my@address>)
may bypass my spam filter. If it does, I may reply from another address!

[Mimi]

Re: $_SESSION problem - page reload creates new Session ID

Hello,

Yes, cookies and all the othe stuff are enabled on my browser (internet
options -> internet security).
And Yes, I use SID to display the session ID on my pages.

Since I am able to see the sessions created in "SessionDat a" folder and I
can see that the session vars
are there and set when the application is started. This page is displayed
properly.

The problem occurs when I click to go to another page and in this case at
"page load" a new session
is created which does not contain the session vars I set in the default
page.
A new session ID is created and therefore a new file can be found on the
"SessionDat a" folder.

The code I have in those pages is complex but I do not use any functions
that can trigger the app to
create a new session and that's why I do not understand what might cause
this behavior.

Is anybody aware, besides "session_start( )", of a known function or event
that may trigger
this problem ?

I understand that when cookies are not enabled this might happen but since
they can be set, something else
might happen.

Thank You again.



"Pedro Graca" <hexkid@dodgeit .com> wrote in message
news:slrncrjp8u .ln2.hexkid@ID-203069.user.uni-berlin.de...[color=blue]
> Mimi wrote:[color=green]
>> Because the cause of the problem has not been identified, I am still
>> asking for your support.[/color]
>
> Do you have cookies enabled in your browser?
>
>
> Verify that and also try passing the session id in the url:
>
> ---- firstpage.php ----
> echo '<a href="secpage.p hp?', SID, '">second page</a>';
>
>
> --
> Mail to my "From:" address is readable by all at http://www.dodgeit.com/
> == ** ## !! ------------------------------------------------ !! ## ** ==
> TEXT-ONLY mail to the whole "Reply-To:" address ("My Name" <my@address>)
> may bypass my spam filter. If it does, I may reply from another address![/color]

[Mimi]

Re: $_SESSION problem - page reload creates new Session ID

Hello,

There is one thing I forgot to mention:

On my application I am using FRAMES, and I noticed one strange thing:

If I place the "include (SomeSessionVar s.php)" in the default FRAMESET page
(not in the Frame),
the session vars are not set. I have to include my file in the default page
of one of the
available frames. And only then the vars are set.
The files I talked about are in fact in the same directory ?!



"Mimi" <mimi@coco.co m> wrote in message
news:X1nud.62$F G5.46@fe39.usen etserver.com...[color=blue]
> Hello,
>
> Yes, cookies and all the othe stuff are enabled on my browser (internet
> options -> internet security).
> And Yes, I use SID to display the session ID on my pages.
>
> Since I am able to see the sessions created in "SessionDat a" folder and I
> can see that the session vars
> are there and set when the application is started. This page is displayed
> properly.
>
> The problem occurs when I click to go to another page and in this case at
> "page load" a new session
> is created which does not contain the session vars I set in the default
> page.
> A new session ID is created and therefore a new file can be found on the
> "SessionDat a" folder.
>
> The code I have in those pages is complex but I do not use any functions
> that can trigger the app to
> create a new session and that's why I do not understand what might cause
> this behavior.
>
> Is anybody aware, besides "session_start( )", of a known function or event
> that may trigger
> this problem ?
>
> I understand that when cookies are not enabled this might happen but since
> they can be set, something else
> might happen.
>
> Thank You again.
>
>
>
> "Pedro Graca" <hexkid@dodgeit .com> wrote in message
> news:slrncrjp8u .ln2.hexkid@ID-203069.user.uni-berlin.de...[color=green]
>> Mimi wrote:[color=darkred]
>>> Because the cause of the problem has not been identified, I am still
>>> asking for your support.[/color]
>>
>> Do you have cookies enabled in your browser?
>>
>>
>> Verify that and also try passing the session id in the url:
>>
>> ---- firstpage.php ----
>> echo '<a href="secpage.p hp?', SID, '">second page</a>';
>>
>>
>> --
>> Mail to my "From:" address is readable by all at http://www.dodgeit.com/
>> == ** ## !! ------------------------------------------------ !! ## ** ==
>> TEXT-ONLY mail to the whole "Reply-To:" address ("My Name" <my@address>)
>> may bypass my spam filter. If it does, I may reply from another address![/color]
>
>
>[/color]

[Pedro Graca]

Re: $_SESSION problem - page reload creates new Session ID

Mimi wrote:[color=blue]
> There is one thing I forgot to mention:
>
> On my application I am using FRAMES, and I noticed one strange thing:[/color]

Frames shouldn't be a problem (as far as session data is concerned --
frames are bad!).

A simple script with sessions works for you with your current
configuration?


========
<?php
session_start() ;
if (!isset($_SESSI ON['hits'])) $_SESSION['hits'] = 0;
++$_SESSION['hits'];

echo '<p>Session hits: ', $_SESSION['hits'], '</p>';
echo '<p>Refresh the page or click <a href="', $_SERVER['PHP_SELF'],
'">here</a>.';
?>
--------


At every refresh this page /should/ keep increasing the displayed number
of hits. Does it?

--
Mail to my "From:" address is readable by all at http://www.dodgeit.com/
== ** ## !! ------------------------------------------------ !! ## ** ==
TEXT-ONLY mail to the whole "Reply-To:" address ("My Name" <my@address>)
may bypass my spam filter. If it does, I may reply from another address!

[Mimi]

Re: $_SESSION problem - page reload creates new Session ID

Hello,

Yes, everything works on individual pages. So I can set session variables
and later make references to them or print them out on the screen.
What is not working is accessing session vars that have been already
set on a page just viewed because there is a new session created
when the page is loaded.

What is also strange is that every time I try to refresh any page on my app,
a new session is created and don't understand why !? And that is the reason
I
can not pinpoint the problem.

Thanks anyway for trying to help.



"Pedro Graca" <hexkid@dodgeit .com> wrote in message
news:slrncrkb3g .ln2.hexkid@ID-203069.user.uni-berlin.de...[color=blue]
> Mimi wrote:[color=green]
>> There is one thing I forgot to mention:
>>
>> On my application I am using FRAMES, and I noticed one strange thing:[/color]
>
> Frames shouldn't be a problem (as far as session data is concerned --
> frames are bad!).
>
> A simple script with sessions works for you with your current
> configuration?
>
>
> ========
> <?php
> session_start() ;
> if (!isset($_SESSI ON['hits'])) $_SESSION['hits'] = 0;
> ++$_SESSION['hits'];
>
> echo '<p>Session hits: ', $_SESSION['hits'], '</p>';
> echo '<p>Refresh the page or click <a href="', $_SERVER['PHP_SELF'],
> '">here</a>.';
> ?>
> --------
>
>
> At every refresh this page /should/ keep increasing the displayed number
> of hits. Does it?
>
> --
> Mail to my "From:" address is readable by all at http://www.dodgeit.com/
> == ** ## !! ------------------------------------------------ !! ## ** ==
> TEXT-ONLY mail to the whole "Reply-To:" address ("My Name" <my@address>)
> may bypass my spam filter. If it does, I may reply from another address![/color]

[Mimi]

Re: $_SESSION problem - page reload creates new Session ID

Now this is ridiculous:
After all this fuss I found out what the problem was:

I have ZoneAlarm installed on this computer but under "Cookie Control"
I let session and persistent cookies get through. I only disabled "Third
Party Cookies"

Immediately when I enabled "Third Party Cookies" the session was working as
intended.

I am not sure why ZoneAlarm would consider the local session files as "third
party" ?!

Anyways, Thank You all


"Mimi" <mimi@coco.co m> wrote in message
news:2Irud.69$z 66.4@fe61.usene tserver.com...[color=blue]
> Hello,
>
> Yes, everything works on individual pages. So I can set session variables
> and later make references to them or print them out on the screen.
> What is not working is accessing session vars that have been already
> set on a page just viewed because there is a new session created
> when the page is loaded.
>
> What is also strange is that every time I try to refresh any page on my
> app,
> a new session is created and don't understand why !? And that is the
> reason I
> can not pinpoint the problem.
>
> Thanks anyway for trying to help.
>
>
>
> "Pedro Graca" <hexkid@dodgeit .com> wrote in message
> news:slrncrkb3g .ln2.hexkid@ID-203069.user.uni-berlin.de...[color=green]
>> Mimi wrote:[color=darkred]
>>> There is one thing I forgot to mention:
>>>
>>> On my application I am using FRAMES, and I noticed one strange thing:[/color]
>>
>> Frames shouldn't be a problem (as far as session data is concerned --
>> frames are bad!).
>>
>> A simple script with sessions works for you with your current
>> configuration?
>>
>>
>> ========
>> <?php
>> session_start() ;
>> if (!isset($_SESSI ON['hits'])) $_SESSION['hits'] = 0;
>> ++$_SESSION['hits'];
>>
>> echo '<p>Session hits: ', $_SESSION['hits'], '</p>';
>> echo '<p>Refresh the page or click <a href="', $_SERVER['PHP_SELF'],
>> '">here</a>.';
>> ?>
>> --------
>>
>>
>> At every refresh this page /should/ keep increasing the displayed number
>> of hits. Does it?
>>
>> --
>> Mail to my "From:" address is readable by all at http://www.dodgeit.com/
>> == ** ## !! ------------------------------------------------ !! ## ** ==
>> TEXT-ONLY mail to the whole "Reply-To:" address ("My Name" <my@address>)
>> may bypass my spam filter. If it does, I may reply from another address![/color]
>
>
>[/color]

[Pedro Graca]

Re: $_SESSION problem - page reload creates new Session ID

Mimi wrote:[color=blue]
> Yes, everything works on individual pages.[/color]

Ok. So it is not a problem with the server.
[color=blue]
> So I can set session variables
> and later make references to them or print them out on the screen.[/color]

Just re-checking:
When you say later, do you mean later in the same script (like setting
$_SESSION['something'] = 42 in line 17 and echoing that in line 163)
or later in another request for possibly another URL?
[color=blue]
> What is not working is accessing session vars that have been already
> set on a page just viewed because there is a new session created
> when the page is loaded.
>
> What is also strange is that every time I try to refresh any page on my app,
> a new session is created and don't understand why !? And that is the reason
> I can not pinpoint the problem.[/color]

As fas as the server is concerned all requests are independant.

Between two requests of your browser, there could have been a hundred
requests from other browsers. PHP needs a way to identify that this
101st request is the one to associate with the first and recreate the
session variables. It does that because on the first session_start() it
sent the browser a cookie with the session id and the browser sends the
cookie back to the server. PHP then checks in session.save_pa th for a
file corresponding to that cookie and recreates the session variables.


Something like this happens:

CLIENT => Hey! Gimme "index.php"
SERVER <= I'm going to keep a few values for you saved on my disk.
In order for me to fetch them later I ask you to send
me back the "PHPSESSID=0123 456789abcdef" cookie.

ANOTHER CLIENT => same thing here
SERVER (TO ANOTHER CLIENT) <= almost the same thing (different
session id)

...
100 more requests
...

CLIENT (you again) => Hey! Gimme "list.php"
You stored data for me on your disk. The key
to that data is "PHPSESSID=0123 456789abcdef"
SERVER <= Ok, keep sending me the key to the data and all is well


if the browser didn't send the cookie, PHP thinks it is a request
that is independant of the first and will create a brand new session
id for it (with the corresponding file in the session.save_pa th
directory).



Another way for the browser to tell the server what session to use,
instead of using cookies, is to pass the session id in the URL or in a
(hidden) form field




So, I guess your browser is not sending the session id back to the
server for that specific page you're having problems with.

--
Mail to my "From:" address is readable by all at http://www.dodgeit.com/
== ** ## !! ------------------------------------------------ !! ## ** ==
TEXT-ONLY mail to the whole "Reply-To:" address ("My Name" <my@address>)
may bypass my spam filter. If it does, I may reply from another address!

[Erwin Moller]

Re: $_SESSION problem - page reload creates new Session ID

Mimi wrote:


Hi Mimi,

Glad you solved it.

[color=blue]
> Now this is ridiculous:
> After all this fuss I found out what the problem was:
>
> I have ZoneAlarm installed on this computer but under "Cookie Control"
> I let session and persistent cookies get through. I only disabled "Third
> Party Cookies"[/color]

Woot?
That sounds strange...
I use ZoneAlarm too on my M$-box, but NEVER had trouble like this.
Maybe you hitted some obscure bug in Zonealarm?
Please contact them.
[color=blue]
>
> Immediately when I enabled "Third Party Cookies" the session was working
> as intended.
>
> I am not sure why ZoneAlarm would consider the local session files as
> "third party" ?!
>
> Anyways, Thank You all
>[/color]

You are welcome.

Regards,
Erwin Moller