Not a bug. Making it a feature request.

hum... not a bug ? PHP is not rewriting html code well, so I'd call it a bug :-)

Anyway... any chance to get it fixed soon ? 
That shouldnt be /that/ hard to do, since you just have to write the input after the first fieldset if there is one, or jst after the form is there isnt any...

Reclassified back to session-related because Yasuo persuaded me to call it a bug ;)

anyone know how long before this is fixed or if there is any known workaround?

I could not find any suitable workaround :(
I hope this will be fixed soon, cause this is really killing me...

Notice .. any blocklevel tag is affected .. not just fieldset and as such any solution to this problem should take this issue into account.

as a workaround in php.ini:

  url_rewriter.tags = "...,form=fakeentry"

change it to 

  url_rewriter.tags = "...,form=action"

to have the id added to the action url instead
of being added as a hidden field

gives you legal xhtml, but session id is
always a GET parameter, even with method=POST ...

Most people cannot access their host's php.ini...
Another workaround ? :)

you can modify this using .htaccess if your provider
allows that or change it at runtime usint ini_set()

Version update and added comment to summary

Yep - this one is annoying me too.  Could the input not be held in its own div /div tag pair?  That would make it legal.

Cheers, David Bond

I've tried using the following:

ini_set("url_rewriter.tags", "a=href,area=href,form=action");

However, now get the session BOTH in the action and in a fake entry.

Any suggestions?

I don't know if I should submit this as a new bug, or if its part of this one, but the <input> element added should be empty ie <input stuff /> in order to be valid xhtml in addition to the fieldset issue.  Probably should be a php.ini option, similar to being able to change argument_seperator.output from & to &amp;.

Fixed in 4.3 CVS. Thanks for your report.

to: sas@php.net

is this bug fixed entirely? re:

[3 Mar 8:08am] ebola@psychoholics.org
Notice .. any blocklevel tag is affected .. not just fieldset and as such any solution to this problem should take this issue into account.

is this really fixed?????

i have php 4.3 and php add the input tag directly after the form tag!

the only _fix_ i found is a comment  in the php.ini

; to URLs.  If you want XHTML conformity, remove the form entry.

It looks like they fixed the openness of input tags, i.e. - the tags close like <input /> rather than <input> but the hidden input field is still automatically inserted *outside* of a block-level element.

It's a mistake to automatically force the hidden input field on us to begin with.  Is there a way to turn JUST that part of the trans-id off?

This bug is still very much a problem in 4.3

so could anybody reopen this bug...
or create a new one?

Opened again.

The adding of the hidden input field can now be turned
off by just removing the 'form=' entry from url_rewriter.tags

And if we can't access php.ini ?

I won't disable this feature!!!!!!!!
Where is the Problem to add a <div> ???

Could you please reopen this BUG!
THX

"removing the 'form=' entry from url_rewriter.tags" does 
not solve the problem if: 1) session.use_cookies is "off" 
(forms need this hidden tag) 2) there is no access to 
php.ini. The solution is a matter of moving the hidden tag 
inserted below a block-level element as it was pointed out 
above. how do we get this bug reopened AND fixed correctly? 
TIA

just open a new one... this seems to be the only way

PHP writes an extra <input type="hidden" etc /> in my code, which is html 4.01 strict. But in html 4.01 strict there should not be a closing slash, so the code becomes invalid.
Is there any way to solve that without changing php.ini?

I don't know if this bug has been fixed, but many of us is still stuck on hosts with "outdated" software. I solved this problem by putting this lines in my .htaccess:
<IfModule mod_php4.c>
  php_value arg_separator.output "&amp;"
  php_value url_rewriter.tags "a=href,area=href,frame=src,input=src"
</IfModule>
..and put the hidden form value where I wanted it with
<input type="hidden" name="PHPSESSID" value="<?php echo session_id(); ?>" />

Seem to work properly and my XHTML1.1 is valid.

I am going to test this very soon and will be fairly surprised if it isn't fixed. I'll test on latest 4.x and 5.x. Maybe a patch if i get some free time.

Good night.

How about, finding a form's first <input> tag, and inserting the hidden field just in front of that... 

That way, if the author has put their first input tag in a valid place, PHP won't change that, and if it isn't in a compliant place, again, PHP won't make it any more or less valid...

Just my $0.02

I'm also getting this problem. Is there a possible fix without having to edit the php.ini file?

i've found that removing the form= and using fieldset=fakeentry worked fine for me on php 4.3.6