Simple Session Question

[pullahomer]

Here is a simple piece of code:

<?php
session_start();
echo SID;
?>

The SID displays the first time the page is loaded but disappears after reload. I though the SID gets passed each time within the same session. If this is not true, how does server know the user is still in the same session?

Pull

[wildteen88]

PHP creats a cookie on the users computer which contains the session id. PJP creates a cookie every time you intiate session_start if PHP was unable to set a cookie it puit the PHPSESSID in the URL instead or as a hidden form field, if you are using forms.

[pullahomer]

Thanks for the reply. I am still puzzled by the fact that the SID didn't show when the page reloaded. I set my IE to accept any cookies. I also checked the server tmp/ directory and the SID was there and didn't change when the page reloaded.

Here is what I thought what should be happening:

client sends request (with session_start statement) to the server -->
server generates a SID and sends it back to the client and it is stored as cookie -->
page reloads, client sends second request to the server (I assume the cookie is sent along with the request) -->
server opens a session, or, if the session ID sent by client matches the stored session ID, it resumes the same session and send the SID back to the client.

If my thought process were correct, the same SID should be sent back forth and I should be able to grab it. However, SID only shows on the initial page load not on reload? Apparently I am missing something.

Pull

[pullahomer]

I guess I just answered my own question.

1. Cookie is sent along with the client request to the server.
2. Server verifies the cookie then takes actions accordingly.
3. Server does not send the session ID back unless it is explicitly coded, i.e., appending the session ID to the URL. Server only serves as a cookie verifier. If cookie does not match the record on the server, a new cookie is generated and sent to the client (of course you need to have session_start to have the cookie generated).
4. SID is generated only when the client rejects cookie, i.e., no cookie is returned to the server. Then SID can be propagated to the link to pass the session ID back forth.
5. When you have cookie enabled, session_id() is the way to catch the session ID, not SID.

Just want to share my findings. It drove me nuts for a few days. As much as I like PHP, the PHP documentation does not provide a great deal of help.

Pull

[toplay]

FYI: Our session troubleshooting guide:
[a href=\"http://www.phpfreaks.com/forums/index.php?showtopic=31047&view=findpost&p=157705\" target=\"_blank\"]http://www.phpfreaks.com/forums/index.php?...ndpost&p=157705[/a]