Session Start Issue

It breaks my forms

[LinusIT]

Hi

On my intranet home page I am using some NTLM code to read the current logged on user, it then writes values based on those results into session data. This is working fine but to read the data on other pages I need to use Session_Start(). When I add Session_Start(); to the beginning of each page, the forms fail.

By fail I mean the forms are present but when I process the form, nothing happens. The screen refreshes as though it had worked but nothing is inserted or updated on my database.

If I remove Session_Start() and load the page again, it works fine.

Any help would be great please.

[penders]

Are you receiving data in your $_GET[] or $_POST[] arrays (whatever method you are using for your forms) when the form is submitted?

[httpwebwitch]

maybe you're using $_REQUEST, and you have session variables with the same name as your form elements?

drag out your basic debugging chops. at the top of the page, add this:

print_r($_GET);
print_r($_POST);
print_r($_SESSION);

look at what's in each of those superglobals, there are bound to be some clues

turn your error logging to "super-sensitive" mode (E_ALL) and watch the error logs to see if any are being thrown.

[rocknbil]

Also check for conditionals in the submit process dependent on session variables:

if (isset($_SESSION['somevar'])) {
process_form();
}
else { just_display_form(); }

[LinusIT]

Thanks for the replies.

I am using $_POST for my forms and by using the code httpwebwitch suggested I can see that the array is empty. Here's what it shows me when I submit a form:

Array ( ) Array ( ) Array ( [SESS_USER_ID] => 3 [SESS_USERNAME] => fred.moore [SESS_ACCESS_LEVEL] => 1 ) ID:3

Any ideas?

[httpwebwitch]

so you've established that the presence or absence of session_start() breaks or unbreaks the form?

Hit the page with a debugging tool like Firebug, or Fiddler... can you tell if the page is refreshing or making a second request back to itself?

[LinusIT]

As it is currently, with session_start() present it breaks the form, when session_start() is commented out and the page reloads the form works.

Just to show you, here's one of the simplier forms:

<form name="weighbridge" method="post" action="<?php echo $PHP_SELF; ?>" autocomplete="off">
<input type="hidden" id="user_id" name="user_id" value="<?php echo $_SESSION['SESS_USER_ID']; ?>" />
<input type="hidden" id="reference" name="reference" value="Start Balance" />
<table cellpadding="0" cellspacing="0" id="models">
<tr>
<td>Start Balance</td>
<td><input type="text" class="w80" id="in" name="in" value="" tabindex="1" /></td>
<td><input type="submit" name="start_submit" class="button" value="Insert" tabindex="2" /></td>
</tr>
</table>
</form>

And the SQL code that process the form:

if(isset($_POST['start_submit'])){
$date=date("Y-m-d H:i:s");

$sql="INSERT INTO weighbridge (weighbridge_date, weighbridge_ref, weighbridge_in, weighbridge_entered_by) VALUES ('$date', '$_POST[reference]', '$_POST[in]', '$_POST[user_id]')";
$checkresult = mysql_query($sql) or die(mysql_error());

if ($checkresult) {
header("location:index.php");
exit();
}
}

[penders]

As @httpwebwitch suggests, do you get any notices/warnings/errors output with E_ALL error checking enabled?

error_reporting(E_ALL | E_STRICT); // Include E_STRICT as well! 
ini_set('display_errors','On');

Do you have register_globals enabled, or is $PHP_SELF one of your own?! If it is, this could potentially cause you problems (as well as being a potential security issue).

$sql="INSERT INTO weighbridge (weighbridge_date, weighbridge_ref, weighbridge_in, weighbridge_entered_by) 
VALUES ('$date', '$_POST[reference]', '$_POST[in]', '$_POST[user_id]')";

As an aside... If this is in the public domain then storing unvalidated, unescaped raw POST data directly into your database is a big security issue.

[LinusIT]

From using php_info() it tells me register_globals is off. I have always used $PHP_SELF for the forms action.

This is running on a local network only, I'll be making more security features once I've got these damn forms working again.

One thing I've just remembered is just before implementing the ntlm code all of this was working under the root directory. I then got the ntlm working which is currently disabled due to issues. Also, I created folders and moved the files into their respective folders to tidy things up a little. Would this have anything to do with it?

Appreciate your help, thanks.

[penders]

From using php_info() it tells me register_globals is off. I have always used $PHP_SELF for the forms action.

If register_globals is off and you aren't explicitly setting $PHP_SELF then $PHP_SELF is not normally set?!

One thing I've just remembered is just before implementing the ntlm code all of this was working under the root directory. I then got the ntlm working which is currently disabled due to issues. Also, I created folders and moved the files into their respective folders to tidy things up a little. Would this have anything to do with it?

Well, if it worked before your changes and didn't after then it certainly does sound like whatever you changed had something to do with it. Did you make any changes to PHP itself?

[LinusIT]

The setup I've got is apache running on server 2008 x64 with php and mysql as well. I haven't changed much of the setup, other than turning safe mode (I think) off. I'll do some testing and report back.