php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login
Bug #5965 Transparent session ID doesn't work with certain <form name="..."> combinations
Submitted: 2000-08-04 15:53 UTC Modified: 2000-08-04 16:54 UTC
From: gregor dot maier at newlogic dot com Assigned:
Status: Closed Package: Session related
PHP Version: 4.0.1pl2 OS: SunOS 2.5.1
Private report: No CVE-ID: None
View Add Comment Developer Edit
Welcome! If you don't have a Git account, you can't do anything here.
You can add a comment by following this link or if you reported this bug, you can edit this bug over here.
(description)
Block user comment
Status: Assign to:
Package:
Bug Type:
Summary:
From: gregor dot maier at newlogic dot com
New email:
PHP Version: OS:

 

 [2000-08-04 15:53 UTC] gregor dot maier at newlogic dot com
I am using session management with transparent session IDs. The SID is only sometimes added to the URL when using a form with a name element. If the SID is added depends on the order in which the elements are used.

This line doesn't work (SID is NOT added to the action-URL)
    <form name="myform" action="myscript.php4" method="post">
But the following line works
    <form action="myscript.php4" name="myform" method="post">

<!-- Here's a longer example -->
 <tr>  
      <td>
      <form name="testme_form" action="session01.php4" method="post">
         <input name="text" value="Hello World">
         <input type="submit" value="doesnt">
      </form>
      </td>
   </tr>
   <tr>  
      <td>
      <form action="session01.php4" name="testme_form2" method="post">
         <input name="text" value="Hello World">
         <input type="submit" value="works">
      </form>
      </td>
   </tr>
   
   <tr>  
      <td>
      <form name="testme_form3" action="session02.php4" method="post">
         <input name="text" value="Hello World">
         <input type="submit" value="Doesnt work with 02">
      </form>
      </td>
   </tr>
   <tr>  
      <td>
      <form action="session02.php4" name="testme_form4" method="post">
         <input name="text" value="Hello World">
         <input type="submit" value="works with 02">
      </form>
      </td>
   </tr>

<!-- END -->

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2000-08-04 16:54 UTC] hholzgra@php.net
already fixed in CVS
 [2002-02-20 22:51 UTC] teilo+php at teilo dot net
Is there no way to disable it though?  I could not find any.

Rough guess is that most people are still serving HTML 4.01 transitional pages or someother version of HTML.  This then breaks conformance for those pages.

Also PHP ignores the fact that you may already be sending this. eg if you have the following 
<FORM ... action="mydynpage.php?downloadID=a50d7195a107538e8043c4223e900a48"> php still adds the hidden input.
 [2002-02-20 22:52 UTC] teilo+php at teilo dot net
Arrg bloody browser.. Sorry wrong bug
 
PHP Copyright © 2001-2024 The PHP Group
All rights reserved.
Last updated: Sat Jul 20 01:01:29 2024 UTC