php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #5965 Transparent session ID doesn't work with certain <form name="..."> combinations
Submitted: 2000-08-04 15:53 UTC Modified: 2000-08-04 16:54 UTC
From: gregor dot maier at newlogic dot com Assigned:
Status: Closed Package: Session related
PHP Version: 4.0.1pl2 OS: SunOS 2.5.1
Private report: No CVE-ID: None
 [2000-08-04 15:53 UTC] gregor dot maier at newlogic dot com
I am using session management with transparent session IDs. The SID is only sometimes added to the URL when using a form with a name element. If the SID is added depends on the order in which the elements are used.

This line doesn't work (SID is NOT added to the action-URL)
    <form name="myform" action="myscript.php4" method="post">
But the following line works
    <form action="myscript.php4" name="myform" method="post">

<!-- Here's a longer example -->
 <tr>  
      <td>
      <form name="testme_form" action="session01.php4" method="post">
         <input name="text" value="Hello World">
         <input type="submit" value="doesnt">
      </form>
      </td>
   </tr>
   <tr>  
      <td>
      <form action="session01.php4" name="testme_form2" method="post">
         <input name="text" value="Hello World">
         <input type="submit" value="works">
      </form>
      </td>
   </tr>
   
   <tr>  
      <td>
      <form name="testme_form3" action="session02.php4" method="post">
         <input name="text" value="Hello World">
         <input type="submit" value="Doesnt work with 02">
      </form>
      </td>
   </tr>
   <tr>  
      <td>
      <form action="session02.php4" name="testme_form4" method="post">
         <input name="text" value="Hello World">
         <input type="submit" value="works with 02">
      </form>
      </td>
   </tr>

<!-- END -->

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-08-04 16:54 UTC] hholzgra@php.net
already fixed in CVS
 [2002-02-20 22:51 UTC] teilo+php at teilo dot net
Is there no way to disable it though?  I could not find any.

Rough guess is that most people are still serving HTML 4.01 transitional pages or someother version of HTML.  This then breaks conformance for those pages.

Also PHP ignores the fact that you may already be sending this. eg if you have the following 
<FORM ... action="mydynpage.php?downloadID=a50d7195a107538e8043c4223e900a48"> php still adds the hidden input.
 [2002-02-20 22:52 UTC] teilo+php at teilo dot net
Arrg bloody browser.. Sorry wrong bug
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Wed Oct 30 22:01:28 2024 UTC