User Contributed Notes: session_register
stevenf@shellnet.co.uk
23-Oct-1999 06:33
Should variables set via session_register not override those I might set via GET/POST vars? At the moment I have to have <PRE> if (isset($loggedin)) { exit; }</PRE> before all my session code to check if someone's gonna try setting that and getting into things when they've not logged in.
Is this right?
ivan@digialliance.com
09-Nov-1999 11:00
somehow session_register(...) returns false even when the variable has been successfully registered. could someone verify on that?
tojo@perceptive.se
11-Nov-1999 07:00
i cant seem to be able to use session variables at all.
1. session_is_registered("var") never returns true.
2. when printing a variable, nothing is ever printed on screen..
what gives?
herman@hermann.dyn.tj
30-Nov-1999 11:34
I session_register a class, created on my first page.
When I try to execute a function on a second page, it is not working and gives me a message, stating that the page has no data.
I verified if the object passed the two pages, and the 'session_is_registered' gives me: 'object'.
Am i missing something or is it impossible?
derekd@rmci.net
13-Dec-1999 12:33
Once a variable is registered with session_register() you can no longer modify it... not with a FORM via post, or via the "?name=value" on the end of the URL... That is weak...
andy@i-nova.com
14-Dec-1999 03:48
that is not weak, that is secure.
if anyone could simply post a form variable and override anything that they want, you could be allowing an easy method of attack into your website.
andy@i-nova.com
14-Dec-1999 03:57
Any one having trouble registering more then one variable per session_register statement?
if i do session_register ("var1", "var2", "var3") for example, i get an error message:
Warning: Wrong parameter count for session_register()
i've also tried putting the variables into an array, but that doesn't seem to register them all.
orange@fobie.net
19-Dec-1999 10:26
I can't get session vars to work on virtual hosts... why is that?
The code looks like this on http://vvv.fobie.net/test.fob
<?php
session_save_path('/tmp/');
session_register("fob666");
$fob666="testing";
echo " $fob666 ";
?>
And on the other one, http://sb.kryogen.net/test.fob
<?php
session_save_path('/tmp/');
session_register("fob666");
echo " $fob666 ";
?>
What do I need to add to get it to work on both?
ksmith@web-oats.com
29-Dec-1999 07:56
It should be
<pre>
session_register("var1, var2, var3");
</pre>
johnston@itactics.com
10-Jan-2000 05:01
Sometimes I got weird behavior trying to update session variables... I found the best way to do this was to unregister them and then re-register them and always try to do it on the lowest stack level.
I suggest to the people writing php that there be some more lower level session functions. Like, keep session_register() appart from session_start - like, dont make it do a session start because that seems to reload the value from the session - not just overwrite the current one. there should be a session_storekey($keyname,$value) session_getkey($keyname) that returns the value so u can set it to whatever variable u wana... maybe session_restore_state(SID) that loads up ALL of the variables in a session - and it'd be nice to be able to deal more specifically with session IDS (like put them into a $SID=14453214132 or whatever variable.) and use those variables to keep track of sessions - like what if u wana join two sessions from two web pages? *shrug*
gkelley@usnhmail.unh.edu
13-Jan-2000 08:27
If what I'm reading here is correct about not being able to modify a variable if it is a registered session variable, then you are defeating the entire purpose of session variables! Active Server Pages allows changing the value of session variables throughout the session on any page and keeps track of the current value. This is the way things should work - because the value of certain things WILL change throughout your app - like ordertotal as you navigate order pages - it needs to be updateable. Once I have set a session variable with a value and registered it, I can no longer change it. This is completely incorrect (and don't tell me it's a security issue, it isn't) Dell uses ASP and does $6M of business a day, so dynamic session variables are obviously working for them!
jbrindle@mail.snu.edu
30-Jan-2000 04:53
obviously you can modify registered variables, or as you said, they would be of no use, you are apparently confused because i have a couple hundred session variables registered in one of my projects and they constanty are modified throughout the app.
robp@wincom.net
28-Feb-2000 02:03
I'm using v4b4pl1 and can't seem to modify an existing session variable, either. I even tried:
session_unregister("ship_to");
session_register("ship_to");
but that doesn't work if those functions are called right after each other in the same script. If I unregister the variable on one execution of a script, then register it on the next, it then (finally) takes the new value.
davidd@retailservicesinc.com
15-Mar-2000 04:34
I was having trouble making sessions work for the win32 php4b3pl1. I noticed that sessions_set_path returned \tmp as the directory to write the session files. Then I noticed my temp directory was really \temp. Creating this directory helped.
phpnovice@hotmail.com
01-May-2000 03:53
<PRE>
3,4 and 5 read below :
I had the similar problems as stated in 3,4 and 5. I think the solution would to be to start_session() before calling the session_is_registered() or even session_register(). Also make sure your sesion_register() is called like setcookie(), as header. Funny but true, I assumed that the session_register needs to kick off a session but unless you session_start(), cannot not register any variable. Also, if you are checking for any registered variable on an another page, again use session_start() before checking the variable value. But the session_start() doesnt start another session, so you will be fine with the values.
</PRE>
daniel@rootsys.com.br
08-May-2000 07:22
I'm having trouble when trying to set the value of a session variable. Does anyone know how to do it? (and dont tell me its impossible, because if you cant change the value of a variable it turns to a constant, and if so of almost no use) .
phpnovice@hotmail.com
17-May-2000 06:17
This is for the person having the previous problem, try to session start before you try to change or set any session variables through the session register function. Should work as I had the same problem.
roy@tuginternet.com
28-Jun-2000 01:07
Re: changing registered variables.
registered session vars cannot be changed by the user. I.e. typing in
http://www.money.com/securestuff/index.php?valid_user=true
will not cause the "$valid_user" var, which we have previously registered,
to be overwritten with the value "true".
You can change the value of registered vars in your script. I.e. coding
if ($thisguyisvalid) {
$valid_user = 'true';
}
will work. The $valid_user var will continue to be set at true for the
session, or until you explicitly change it again.
dhartford@ghsinc.com
05-Jul-2000 09:48
I am having similar problems using SESSION_REGISTER() as well - should the variables set with SESSION_REGISTER() show up in PHPINFO()? If someone has successfully used SESSION_REGISTER() to carry variables across multiple pages securely, please tell us how you did it.
pflugfelder.1@email.com
07-Jul-2000 09:55
Could anyone tell me if it is possible to register an object as a session variable ? It seem to work at first but when I try to use a class method PHP don't seem to recognize them anymore ...
gtz@tiredidea.com
15-Jul-2000 10:06
I was having similiar problems getting to print any session variables out until I double checked the temp path. I was using /tmp when on my hosts system it is /export/php. Changing that solved all of my session variable printing troubles. Hope it helps.
kaufmann@cyland.com
20-Jul-2000 10:47
Registering objects as session variable works just fine. But I create dynamically new objects stored in an array inside the top object. They seem not to be resumed.
cyberlotnet@hotmail.com
30-Jul-2000 02:37
session_register is just plain buggy..
I had 5 variables within session_register and it worked.. a couple hours after closing my browser and coming back.. I had to put each variable into its own session_register because it was failing with multiples..
high_impedance@yahoo.de
31-Jul-2000 12:35
The first example in the manual does not work on my server (using OmniHTTPd). It does not count but there is no error message. What are the correct settings in the php.ini file? I do not want to use cookies because I do not want to rely on them. I would be glad if I can get a working example. Please contact me via email. Thank you very much!
kc0@hotmail.com
13-Aug-2000 04:07
If you can't change the session_registered vars by using the post method, you can use this approach.. not very attractive, but hey, it worked for me!
page1:
session_start();
session_register("temp_var");
[start a form, submit to form 2]
echo <input name=temp_var type="text" value"$var">;
[end a form]
FORM2:
session_start()
$var=$temp_var;
session_unregister("temp_var");
this is how i change my vars.
hope there will be a better solution soon!!
rupert@complinet.com
15-Aug-2000 06:58
<pre>
variables must be set before they can be registered; however, don't fall into the same trap as i did by doing
$bob= array();
session_register('bob');
and then wonder why $bob always seems to be empty (d'oh!); instead use
if (!isset($bob)) {$bob= array();};
session_register('bob');