Session variables getting lost when playing with back/next buttons

[phdphd]

Hi All,

 

I have a big problem with session variables getting lost when playing with back/next buttons. This leads to wrong data being displayed, and possibly PHP error messages.

 

From the user's point of view, there is a series of forms to fill in, one form being allowed to display only if ALL previous ones have been correctly filled in.

 

It all works perfectly. But the problem can appear when playing with back/next buttons.

 

Basically, my files are organized as follows. There is a main php file that "drives" the whole structure, where each remaining file contains POST method and SERVER/PHP_SELF action as form settings. This main file contains 2 parts. The first part is where I test/analyse the existence and contents of the POST variables. The second part is where I call the correct form (through an "include" statement) according to the result of the POST test/analysis. For example, if form_1 is correctly filled in, form_2 is called, if not, form_1 is displayed again.

 

In each POST testing, the part that runs if the form is correctly filled in contains two $_SESSION lines. Assuming form_1 POST variable is being analysed, these 2 lines would be something like $_SESSION[form_2_can_be_displayed]=1 and $_SESSION[user_went_through_form_1]=1. $_SESSION[form_2_can_be_displayed] is the variable that is tested for in the second part of the main php file and that will enable to trigger the display of form_2 through an include statement. $_SESSION[user_went_through_form_1] variable is tested for at the beginning of the analysis of POST variable for form_2. In other words, POST variable for form_2 will only be analysed if the user did successfully go through form_1. $_SESSION[user_went_through_form_1] is never unset except at the very beginning of the analysis of POST variable for form_1 in case form_1 had already been successfully submitted by the user.

 

So, as the user moves from form to form, successive $_SESSION[user_went_through_form_XXX] variables get recorded into the global SESSION variable. With such data, I can safely test a POST if ALL previous forms have been passed through. If this condition is not met, a message appears prompting the user to return to the home page. Assuming form_3 POST variable is being parsed, the structure of the test would be something like this (with simplified ELSE details) :

 

If (isset[post_for_form_3])

{

If (isset($_SESSION[user_went_through_form_1]) && isset($_SESSION[user_went_through_form_2]))

{

If (isset($_SESSION([user_went_through_form_3]))

{

unset $_SESSION([user_went_through_form_3])

}

//process the POST variable//

 

If (user-entered data is OK)

{

$_SESSION([user_went_through_form_3])=1

$_SESSION[form_4_can_be_displayed]=1

}

Else

{

$_SESSION[form_3_can_be_displayed]=1

}

}

Else

{

//Instructions to display the "return to home page" message

}

 

}

 

As said at the beginning of my post, it all works perfect from the first form to the last one, but afterwards if I randomly play with back/next buttons I may suddenly get the " return to home page" message, meaning that the "isset($_SESSION[user_went_through_form_XXX])" line test has failed.  I just do not understand why this happens, because there is no reason why the $_SESSION[user_went_through_form_XXX] should be missing. For example, when falling again on [post_for_form_3], why "isset($_SESSION[user_went_through_form_1])" or "isset($_SESSION[user_went_through_form_2])" should be missing ? These variables were initially set on successful testing of POST variables for form_1 and form_2 and never unset aftewards.

 

Please help !

 

Thanks !

 

[xyph]

This is client-side behaviour. You have to remember the web is stateless. Using session to store variable data can easily cause unexpected results if a user doesn't follow the path you expect them to. You need to plan for the possibility that each request will be unique from the last

[phdphd]

Thanks for your reply. I was afraid something was wrong in my approach.