Problem transferring data between pages using PHP session

[dunno]

Hi guys,

 

I am having a problem transferring data between pages, using PHP sessions. I have a HTML SELECT drop-down to let user set the number of posts per page to display.

<form method="POST" style="margin:auto;position:relative;width:35%;padding:17px;top:47px;">
          			<span>select posts-per-page:</span>
          			<select name="ppp">
          				<option selected disabled>--select ppp--</option>
          				<option value=10>10</option>
          				<option value=15>15</option>
          				<option value=20>20</option>
          				<option value=50>50</option>
          				<option value=100>100</option>
          			</select>
          			<input type="submit" name="submit" value="OK"/>
          		</form>

I want to transfer the value selected by user to a session so that I can load the value in other pages. The value of posts per page is carried by variable $ppp; so, file1 contains the code

$_SESSION['ppp'] = $ppp;

That seems to work great; the system updates correctly the session's value as user submits different numbers of posts-per-page.

 

The problem is in page2.php: it doesn't update to the new user's selection; I already have a session active in that page so I don't need session_start(). To call the session, I use the line

$ppp=$_SESSION['ppp'];

When user changes the selection from 50 to 100 posts per age, for example, the value of page1.php changes as expected, but the value transferred to page2.php doesn't change, appears to remain with the default value the page loads with. I don't know if the problem is that I already have a session going. Can you have more than one session running simultaneously in a page?

Can anybody help? Thanks in advance!

 

Sept

[Barand]

1 ) Are you calling session_start() on page1 and page2?

2) I see no mention of $_POST['ppp'] when setting the session value.

[dunno]

Hi Barand,

 

Thank you for your prompt response. Yes, session_start() is called at the beginning of both pages.And $_POST['ppp'] is called at the time of setting the value of $ppp, thus

$ppp=0;
              if (isset($_POST['submit'])){
                  $ppp=$_POST['ppp'];
                  show("<div>The number of posts-per-page is now set to ".$ppp."</div>");
                }

              else{
                  $ppp=15;
                  show("<div>The selected number of posts-per-page is default ".$ppp.".</div>");
              }
               //note session didn't need session_start() for a session is already started

               $_SESSION['ppp'] = $ppp;

As I said, all the part concerning page1.php seems to work; the problem is that page2.php does not update as required.

Kind Regards,

 

Sept

[Strider64]

Well, if you just update the $_SESSION on page1 directly, but go straight to page 2 then how is it going to update?

It will update if you go to page 1 first then page 2. I hope I'm making sense?

 

You need to update it in a configuration file of some sort or it as a set option where you can't go to any other pages if you update ppp?

Edited July 11, 2021 by Strider64

[dunno]

Hi Strider64,

Thank you for your answer.

I think you are right in the bottom-line issue, but I cannot quite pinpoint it; I have tried a simple sandbox exercise of a select box transferring data between two pages and it works flawlessly, even without a page change; I mean, once the session is set in page1.php, it will be available globally to the server, so that any page loaded can use it. I don't understand why it doesn't work in the main website!

The issue is there is no actual page switching in browser just a form submission, although there are two PHP  pages involved. In page1.php, user just selects an option (i.e., 100 posts per page), that value is assigned to a local variable, and then the local variable to session:

	if (isset($_POST['submit'])){ //if form submitted
	  $ppp=$_POST['ppp']; //assign value from select box
	}else{ 
	  $ppp=15; //default number of posts-per-page
	}
	$_SESSION['ppp']=$ppp; //session index created with new number of posts-per-page

This works without issues. The problem happens when I attempt in page2.php to assign the session to the variable in charge of controlling the number of posts-per-page:

$ppp = $_SESSION['ppp'];

This does not work as expected: the value transfers correctly on loading the page (so the session is somehow working) but, for some reason, it doesn't update in page2.php when new values are submitted via the select box (i.e., when the value of the session is altered).

Forgive my ignorance, but could you explain further the point about

Quote

update it in a configuration file of some sort

 I don't follow you exactly but it sounds like a path for me to pursue (as I am rapidly running out of options).

Once again, thanks so much for your help.

Looking forward to your response,

Sept

[Psycho]

@dunno You start by referring to page1 (the form page) and page2 (the page to shows the posts per page). But, in response to Barand's reply you show the code where the session value is set, but don't explain where that code is run. Is that code on page1, page2, or some other page? If that code is executed on every execution of page2, then it will reset the ppp value to 15 whenever the user doesn't select a new ppp value since you are ALWAYS resetting the session value - even when the user did not submit a change. If that code is on an intermediary page (a third script) - is session_start() initiated on that page?

EDIT: I'm going to assume that the code to set the ppp session value based on the user's submission is at the top of the script that displays the posts. In that case, you should change the logic like this:

    //Set list of APPROVED ppp values (prevents users from submitting arbitrary vaues)
    $pppValues = array(10, 15, 20, 50, 100);
    //This array should be in a config file and ALSO used to create the select list options

    //Set default value of $ppp value
    $ppp = 15;
    
    //Check if user submitted new ppp value (that is in approved list)
    if (isset($_POST['ppp']) && in_array($_POST['ppp'], $pppValues))
    {
      $ppp = $_POST['ppp']; //Assign value from POST submission
      $_SESSION['ppp']=$ppp; //Set value in session (only set if user submitted new value)
    }
    //If user did not submit new ppp value, check if ppp value already set in session
    elseif (isset($_SESSION['ppp'])
    {
      $ppp = $_SESSION['ppp']; //Assign value from session
    }
    
    //Rest of script can use $ppp to display correct number of posts

 

Quote

You need to update it in a configuration file of some sort or it as a set option where you can't go to any other pages if you update ppp?

@Strider64 Not sure what you mean. Session values are a common process of keeping values static between page loads. No need to store the value in a config value.

Edited July 11, 2021 by Psycho

[dunno]

Hi Psycho

Thank you very much for your question.

There are only two pages involved: page1.php, where value from the form is assigned to a local variable, and then that of the local variable to the session; and page2.php, assigning value from session to a local variable. This is the code run in page2.php:

	$page_number =isset($_GET['page']) ? (int)$_GET['page'] : 1;
	$ppp = $_SESSION['ppp'];
    $offset = ($page_number-1) * $ppp;
    $query="select * from images order by id desc limit $ppp offset $offset";

I hope this answers your question; please let me know. The whole thing is part of a complex pagination system; it is the abstraction of turning it into code running in page1.php & page2.php which makes my question awkward to ask.

I don't fully follow you when you say: "If that code is executed on every execution of page2, then it will reset the ppp value to 15". The execution of page2.php code should use the value carried by the session; page1.php will only be reset to 15 if no number have been submitted in the form (when page loads)

if (isset($_POST['submit'])){ //if form submitted
	  $ppp=$_POST['ppp']; //assign value from select box
	}else{ 
	  $ppp=15; //default number of posts-per-page
	}

Also, thanks so much for the code submitted; you guys are amazing! I don't fully understand the use the array; its main use, if I understand your code correctly, is ensuring user enters valid values for the number of posts-per-page, but users cannot enter invalid values since they are chosen in the select box. Or does the array serves any other purpose?

I have tested your approach, but the problem seems to persist: array key "ppp" still not recognized in page2.php; I'll test some more and let you know.

Sept

[Barand]

23 minutes ago, dunno said:

but users cannot enter invalid values since they are chosen in the select box

Don't assume that the only way data can be sent to your page is from a nice user correctly using your form.

Assume the opposite - that the data hasn't come from a benvolent source.

[dunno]

 

@BarandThank you for the tip! I'll bear it in mind.

@PsychoThe issue is that page2.php does not recognize array key $_SESSION['ppp'] defined & initialized in page1.php; the system throws the error: "Undefined array key 'ppp'". However, I have issued session_name(), session_id(), and session_status() to both page1.php and page2.php and the session actually exists in both pages; in both the session status was 2 (active) and both shared the same name/id:

session value index.php=15
session id index.php=6nnebina356tsmbusmipt9b6ek
session name index.php=PHPSESSID
session status index.php=2

So the session exists in both pages, that seems clear. On reviewing the code in depth, I've noticed the page where the session's value is set is positioned in the final HTML layout "below" the page where the value is used; maybe the problem is that I'm trying to use a session whose value hasn't been given yet. According to this, the reason why page2.php fails to see the array index is because no value has been assigned to it yet, so it remains null. If my conclusions are correct, the problem is positional: I need to assign the session's value before I use it. 

To test this, I added a single line of code to footer.php  

 $ppp=$_SESSION['ppp'];

And it worked out of the box! But, to be honest, once I have located the problem, I haven't the remotest idea of how to deal with it. Can you think of any solution without having to re-design the site completely?

Thanks in advance for all your help.

Sept

Edited July 11, 2021 by dunno

[Psycho]

17 hours ago, dunno said:

I don't fully follow you when you say: "If that code is executed on every execution of page2, then it will reset the ppp value to 15". The execution of page2.php code should use the value carried by the session; page1.php will only be reset to 15 if no number have been submitted in the form (when page loads)

if (isset($_POST['submit'])){ //if form submitted
	  $ppp=$_POST['ppp']; //assign value from select box
	}else{ 
	  $ppp=15; //default number of posts-per-page
	}

 

You forgot the next line. The full bit of code you had is

	if (isset($_POST['submit'])){ //if form submitted
	  $ppp=$_POST['ppp']; //assign value from select box
	}else{ 
	  $ppp=15; //default number of posts-per-page
	}
	$_SESSION['ppp']=$ppp; //session index created with new number of posts-per-page

If there is no POST submit, then $ppp is set to the default of 15. Then, the last line, is setting the session value to that same default of 15. It NEVER checks to see if there is an existing session value. It will simply overwrite any previous session value. The code needs to work in this manner:

1. Check if the user submitted a new ppp value. If so, set the 'working' value in the script and set the session value
2. If not #1, check if there is a saved session value. If so, set the 'working' value in the script
3. If not #1 or #2, use a default.

In the code I provided, I set the default first and let the logic for #1 and #2 overwrite the default.

I don't know why the code is not working for you. There is obviously something in the code that you have not provided. But, here are some other comments:

• Why are you checking for $_POST['submit']? You only need to check for $_POST['ppp'], since that is the value you would be working with
• As Barand stated, and I alluded to, NEVER trust data from the user. It is a trivial matter to pass a value that is not in a select list for a form field, to add other field value in a form request, remove others, pass values that would have been validated on the client-side, etc. For a select list, I suggest having a defined list (such as an array in a config file) and use that list to a) Create the select list and b) validate that the user passed an approved value.

Quote

So the session exists in both pages, that seems clear. On reviewing the code in depth, I've noticed the page where the session's value is set is positioned in the final HTML layout "below" the page where the value is used; maybe the problem is that I'm trying to use a session whose value hasn't been given yet. According to this, the reason why page2.php fails to see the array index is because no value has been assigned to it yet, so it remains null. If my conclusions are correct, the problem is positional: I need to assign the session's value before I use it. 

So, put the code to check for a POST ppp value, or a session ppp value or to use a default at the top of the script before you need the ppp value. Not sure why this is a question.

[dunno]

@PsychoI was just trying to explain the solution I found; now the system is working (with a few minor glitches). After realizing my problem was just positional, I reshuffled the HTML layout to have the session value assignment above its usage, and that worked. I also changed the logic slightly by including the session within the if (avoiding some recursion), and integrating Barand excellent tip, thus:

	$pppValues = array(10, 15, 20, 50, 100);

    if(isset($_POST['submit'])){//if ppp number submitted through form
      if(in_array($_POST['ppp'], $pppValues)){
        $get_ppp = $_POST['ppp'];
        $_SESSION['ppp']=$get_ppp;
      }else{
        $_SESSION['ppp']=15;
      }
    }

The reason why I check for $_POST['submit'] first is I want to ensure the ppp values are only changed via form submission and not in any other way (ie, reloading the page); that way, I ensure that when the number of ppp change, it is because user has selected a valid number.

Thank you for all your help.

Sept

[Barand]

What if no new value has been posted but your session value already contains 50?

Perhaps...

$get_ppp = $_POST['ppp'] ?? $_SESSION['ppp'] ?? 15;
$_SESSION['ppp'] = $get_ppp;

 

Edited July 12, 2021 by Barand