php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #26482 Session ID lost when form-tag split
Submitted: 2003-12-01 04:59 UTC Modified: 2003-12-01 09:37 UTC
From: andreas dot schmitter at swisslife dot ch Assigned:
Status: Not a bug Package: Session related
PHP Version: 4.3.4 OS: WIN2000 Prof
Private report: No CVE-ID: None
 [2003-12-01 04:59 UTC] andreas dot schmitter at swisslife dot ch
Description:
------------
For some reasons i can not use cookies for session handling and therfore use the only the transparent session id, which works fine. But recently i got the following problem: 
I have a form which has different action based on a variable ($ref). With the first code snippet 
(output of the Form-Tag as one string)
it worked fine. But with the second snippet (Form-Tag is split) the session id is somehow lost. 

Both ways the form worked and all the variables are passed correctly.

Regards
Andreas Schmitter    

Reproduce code:
---------------
<?php if ($ref=='actlist') {
echo '<form name="goback" method="post" action="act_list.php">';
} else {	
echo '<form name="goback" method="post" action="user_home.php">';
}	
?>
<input type="hidden" name="ref" value="<?php echo $ref ; ?>">		
<input type="submit" class="button" name="back" value="<?php echo $msg['cancel'];?>">
</form>
----------------------------------------------------------
<form name="goback" method="post"
<?php if ($ref=='actlist') {
echo ' action="act_list.php">';
} else {	
echo ' action="user_home.php">';
}	
?>
<input type="hidden" name="ref" value="<?php echo $ref ; ?>">		
<input type="submit" class="button" name="back" value="<?php echo $msg['cancel'];?>">
</form>

Expected result:
----------------
Result of Code Snippet 1:
<form name="goback" method="post" action="user_home.php"><input type="hidden" name="PHPSESSID" value="066a2f65204eccb562831f3f1d8d88e5" /><input type="hidden" name="ref" value="uhome">		
<input type="submit" class="button" name="back" value="Cancel">
-----------------------------
Result of Code Snippet 2:
<form name="goback" method="post" 	  	
 action="user_home.php"><input type="hidden" name="ref" value="uhome">		
<input type="submit" class="button" name="back" value="Cancel">


Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-12-01 09:37 UTC] sniper@php.net
Given the incomplete buggy script, of course it won't work.
This works just fine:

<?php

session_start();
$ref='foo';
$msg = array ('cancel' => 'cancel');
  
?>
<form name="goback" method="post"
<?php if ($ref=='actlist') {   
  echo ' action="act_list.php">';
} else {    
  echo ' action="user_home.php">';
} 
?>
<input type="hidden" name="ref" value="<?php echo $ref;?>">    
<input type="submit" class="button" name="back" value="<?php echo $msg['cancel'];?>">
</form>

Also note: trans-sid is NOT fool-proof. You can't just expect any buggy html to work..
And what you do is pretty weird way to output html anyway.
ALWAYS separate HTML from code as much as possible..e.g.

if ($ref=='actlist') {
  $action = 'act_list.php';
} else {	
  $action = 'user_home.php';
}

And then just do:
<form name="goback" method="post" action="<?php echo $action; ?>">

 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved.
Last updated: Mon Jul 14 21:01:33 2025 UTC