passing values without using session?

[FalseDawn]

Hi,
I have a script (call it login.php for sake of argument), and another script which is the action of this form (i.e it receives the $_POSTs) - call it processlogin.php

I really need a way to pass values back from processlogin.php to login.php without using $_SESSION (this won't work if cookies are disabled, and I don't want to pass the sessionID in URL)

I could redirect, using the?varname=XX in the URL and then retrive via $_GET in login.php, but this is a bit messy IMO

Can I use the $_POST array somehow? Or is there another alternative?

processlogin.php does not have any visible controls - it just does validation before returning the results to login.php

Thanks for any advice.

[mcibor]

There's a way to post those vars - you can submit the form with javascript:

self.setTimeout("document.form.submit()", 1000); //after 1000 miliseconds=1s. I don't know the least time. Or you can do this onLoad. It will be even better.

However as I know this way is very jeopardizing to the security of your page. Because anybody can prepare such form to submit and therefore be able to login without really doing so.

Therefore I would recommend using the login.php as a validator (I do so). And yes, the Session can be passed via url.

Best regards
Michal Cibor

[FalseDawn]

Hmmm, yes - I realise I could use javascript to submit the form, but this is a pretty nasty hack and won't work if javascript is disabled.

I'm just wondering if there's a way to "inject" values into the $_POST superglobal (in PHP) before doing a redirection to "simulate" the POSTing of a form?
Can I modify the HTTP headers to achieve this?

[FalseDawn]

As a side note, the only reason I'm having to separate the pages and their processing is because of the stupid IE 6 bug "page cannot be displayed" when using HTTPS and posting values to the same form that the input fields are displayed on, and then using the browser back/forward buttons. Gack.

[jatar_k]

what about just including the page instead of redirecting, is that an option?

[FalseDawn]

Not quite sure what you mean by that.

I have kludged a solution that involves passing the session ID in the URL if cookies are disabled.
Not what I wanted, but it works...