Mod rewrite with php and url session data

Using mod rewrite with ecommerce, allowing transfer of session data in url

[mostly]

Hello
I am trying to flatten out my ecommerce site (mod rewrite to SE friendly URLS). I have 2 issues.

My main concern is how do I keep session data in urls if a user is not using cookies.

But also not allowing search engine bots to generate session variable urls for indexing.

Can I turn on mod rewrite according to the requesting client, ie bot or human, within PHP or apache?
Or do I have to rewrite the entire site testing whether there is a bot or a human and adding session_id() in the friendly urls if neccessary.

ie (1212312743392472_film_posters.html) for humans
and spider bots (film_posters.html)

Any thoughts or pointers greatly apreciated.

[jdMorgan]

mostly,

Welcome to WebmasterWorld!

With a little re-arrangement of the order of things, I think this problem is simpler than it may appear.

Don't generate session IDs for spiders (this is actually the hard part, because you need a list of them)

For spiders not supported by your script, add a Disallow in robots.txt

Append the session ID as a query string if no cookie support (Warning: you should generate and check "secure" SIDs to avoid malicious activity), i.e. film_posters.html?ID=1212312743392472 for humans with no cookie support and film_posters.html for 'bots.

mod_rewrite executes unconditionally after a request is received by the server, and before any content is served or any scripts are run. Therefore, a script cannot control mod_rewrite within the current http request. Also therefore, mod_rewrite is used to change search engine friendly URLs into the URLs needed to activate your script. The script itself must output SE-friendly URLs to browsers and 'bots; mod_rewrite cannot change URLs in the server's output data stream.

Jim

[mostly]

many thanks jdmorgan
got me thinking...

finally cracked the whole thing, here is the result for any other developers out there.

In mod rewrite config make sure you append [QSA] to the rewrite rule, this allows the query string to be added to the new url you are generating.

Thus apage.html?SID=121312323123

rewrites to index.php?item=12&class=6&SID=121312323123

if you are using transition session variables on, automatically append the session id to the (fake) url. tres cool. Now I just need to filter bots and make sure they don't get a session.

Hope this helps somebody else..