April 29, 2011

PHP Session ID the same but variables are lost

Question by Nick

I have a login page that sets session variables upon successful login. The login page then redirects to an admin page. The admin page is able to read session variables just fine. But when I do a jQuery load() function that loads viewUsers.php in the content div the session variables are gone. The weird part is the session id is the same.

I used var_dump() on both the admin page and the viewUsers page. The admin pages shows all the proper variables from the login page but the viewUsers page which is called with a jQuery load() function var_dump of $_SESSION is blank. var_dump of $_COOKIE[‘PHPSESSID’] has the proper ID though, it doesn’t make any sense to me.

This is how I set the session variables.

$_SESSION['userID'] = $userInfo['ID'];
$_SESSION['userType'] = $userInfo['userType'];
$_SESSION['programID'] = $userInfo['programID'];

This is the jQuery

$("#content").load("viewUsers.php");

All pages have session_start() at the very top. The session variables also didn’t work when I tried window.open and window.location instead of a jQuery load() function.

Some how the session variables are getting lost even though I have the correct session id. If anyone could shed any light on this I would really appreciate it!

As of right now I’m populating hidden fields and using a post function instead of load to get around it. I understand this isn’t the best way, but it’s the only way I could figure out how to do it.

Edit:
Here is the top of the index which read the session variables fine.

 <?php
    session_start();
    //require("session.php");
    if(!isset($_SESSION['userID'])){
        header("location: ../login/index.php");
    }
?>

Here is the entire viewusers

    <?php 
session_start();

//foreach($_POST as $name => $value){
    //$_SESSION[$name] = $value;
//}

//echo " session id " . $_COOKIE['PHPSESSID'];
var_dump($_COOKIE);
var_dump($_SESSION);
?>

<?php require("adminFunctions.php"); ?>


<h2>View Current Users</h2>
<?php require("userlinks.php"); ?>
<table id="userTable" class="tablesorter">
    <?php getUsers($_SESSION['programID'], $_SESSION['userType']) ?>
</table>
<script type="text/javascript">

    $('td[name="userID"]').hide();

    //$("#userTable th").click(function(){
        //color();
        //colorTable();
        //color();
    //});

    function colorTable(){
        $("tr:odd").css("background-color", "#c0c0c0");
        $("tr:even").css("background-color", "#ffffff");
    }

    function color(){
        $("tr:odd").css("background-color", "#ffffff");
        $("tr:even").css("background-color", "#ffffff");
    }

    $(document).ready(function(){
        //colorTable();
        $("#userTable").tablesorter({widgets: ['zebra']});

    });
</script>

Another Edit:
Here is the javascript code to load viewusers
The only reason I’m using post is because I set the session variables as hidden fields in order to pass session variables. On viewusers I use a foreach loop to set the session variables. I understand this isn’t secure.
function maintainUsers(){

$.post("viewUsers.php", $("#sessionform").serialize(),function(data){
        //alert(data);
        $("#content").load("viewUsers.php");
    });
}

Answer by Starx

Normally, this sort of error occurs when you dont use session_start() to read the session data.

Try placing (Although, you said you have, I would suggest rechecking)

session_start();

At the beginning of your viewUsers.php

In case, the above is not the case, thenyour current page (the one from which you execute the .load() function) is resetting the session and tampering with the values. Unless you upload the code or find it out, there is no solution for this case.

...

Please fill the form - I will response as fast as I can!