can't get session while processing an image request?

my tracking system depends on it

[httpwebwitch]

I'll attempt to tell this story with a code narrative:

I write important things into a session:

<?php $_SESSION['importantdata']='i need to track this'; ?>

I put a link on my page:

<a href="3rd.party.service">click me, please!</a>

But since I want to track it, I employ a redirection script:

<a href="myredirection.php?goto=3rd.party.service">click me, please!</a>

3rd.party.service says:
"we don't allow redirections, remove it or you won't get paid"

So I revert:

<a href="3rd.party.service">click me, please!</a>

But I can capture the "click" another way:

<a href="3rd.party.service" onmousedown="alert('test');">click me, please!</a>

and it works!

So I introduce an Image trick to trigger an HTTP hit:

<a href="3rd.party.service" onmousedown="var img = new Image;img.src='/mytrackingscript.php';">click me, please!</a>

== mytrackingscript.php ==

<?php 
write_to_database($_SESSION['importantdata']);
?>

hww says: it's not working!
For some reason when the tracking script is executed, the $_SESSION collection doesn't exist.

I have confirmed that the $_SESSION is empty, by doing this:

mail('[e-mail]','click',serialize($_SESSION));

I *know* there's a session in there. So why is it unavailable when called via the 1x1 pixel image hack? Is this something peculiar in the way that an Image is requested? Don't images support sessions too?

I'm getting the mail. But I'm not getting the $_SESSION data.

The HTTP log shows that the Session cookie is being sent with the request...

This is happening on a classic PHP5 LAMP

any ideas why?

[xiongbin]

session_start() ;

[jatar_k]

off the top of my head, nope, not sure why

I would serialize the session data into the img.src and grab it from $_GET

<added>thinking about it, session_start might work as the image is not like including a script, it is a seperate entity

[httpwebwitch]

jatar that's a good idea
tricky to implement in this situation, but I think I can do it
(all the data is going through a lasagna of XML->rewriting->moreXML->XSLT->render())

first I'll add session_start() and see if that's what I'm missing.

[coopster]

You definitely have to start_session() before attempting to use the $_SESSION superglobal in your script, otherwise it is undefined.

[httpwebwitch]

aw...
it didn't work.
I added

session_start();

right at the top. no dice.

I've tried a few debugging tricks to see what's going on inside that image script... it's part of a live production process serving multiple sites (with no dev server!) so I have to tread carefully.

I've removed the little script that writes the binary image data. I realized it doesn't really matter whether the script actually returns a sane response. The request is all that matters - I can use the response for debugging.

I always have to look that up, so FYI it's this:

header( 'Content-type: image/gif' );
echo chr(71).chr(73).chr(70).chr(56).chr(57).chr(97).
chr(1).chr(0).chr(1).chr(0).chr(128).chr(0).
chr(0).chr(0).chr(0).chr(0).chr(0).chr(0).chr(0).
chr(33).chr(249).chr(4).chr(1).chr(0).chr(0).
chr(0).chr(0).chr(44).chr(0).chr(0).chr(0).chr(0).
chr(1).chr(0).chr(1).chr(0).chr(0).chr(2).chr(2).
chr(68).chr(1).chr(0).chr(59);

I've replaced it with this:

print_r($_SESSION);

Now when I do the mousedown in Firefox, Firebug shows that the script is loading, and its response (which used to be a 1x1 pixel GIF) is:

Array
(
)

that would indicate with no uncertainty that my session, sadly, ain't.

I want to press this a little further. Next I'm going to confirm that the $_SESSION has something in it. That I'm not barking at an empty tree.

I'm reluctant to try the all-GET method (prescribed by jatar), though if it comes to that I know it'll be reliable...

[cameraman]

I've accessed $_SESSION from image scripts without any trouble, so it shouldn't be an empty tree.

[httpwebwitch]

I think something fishy is going on. When I set

$_SESSION['foo']='bar';

in my image script, I DO get

Array(
[foo] => bar
)

It seems like something elsewhere in the system is killing my sessions. I suspect drupal is doing it (the site in question is running a drupal blog). This isn't the first time [webmasterworld.com] I've had issues with customizing things in drupal...

thanks for your advice so far. I'll post here if I hit any more confounding barriers