Hello all. I am having a problem with Sessions in PHP. I have a main file, lets call it index.php , and in it I include 3 files (headers and footers). These files USED to have .inc termination (header1.inc) however, I read somewhere that for security reasons I should rename them to .php (header1.php) if I had any php executing in them so that people would not be able to grab the file and look at the code. Because of this I renamed the files to .php. And now I am unable to have "direct/easy" access to my session variables in these files. What I mean is that if I write the code echo session_id() on the .php files nothing appears but if i do it on the .inc or the main files, I get the session id perfectly. Another thing is that the php code on my include files needs the Session data to display information, and before I made the termination change it used to work perfectly and now doesn't

Anybody can tell me if I can fix this without having to rename the files to .inc?
I am on a private webhost so i do not know exactly what php settings are set.

Thank you for your help and time.

Just wondering, did you put <?php ?> in your .php file? the one that used to be .inc?

This sounds like a different problem, can I see your session code. How you set it and try to retrieve it.

Hello, thank you for your replies.

edit: I just want to clear up that I do NOT pass the session id in the url. I do it with cookies for now. As before, this works with the .inc file andn ot with .php. Thanks

First thing I want to clear up, is that I do use the appropriate php tags on my files. You should note that the files are exactly the same, just that I changed the termination of the file from .inc to .php.

On all of my main pages (the ones that call the include files) I have the very first commands be:

PHP Code:

<? session_start(); header("Cache-control: private"); ?>

When a person logs in, the variables are set to the session this way (after some checking of input and inside php tags):

PHP Code:

$_SESSION['username'] = $login_username;
$_SESSION['password'] = $login_password; 


The include file, with .php termination that works when it has a .inc is structured this way:

PHP Code:

//PURE HTML CODE BEFORE

<?
    if($_SESSION['username'] == ''){ 
              echo "user HTML stuff";
    }else{ 
        echo "login html";
        }
?>

//PURE HTML CODE AFTER

As I said before, this code works perfectly, when the include file has a .inc termination.

In the .php include file, I tried ecoing the session_id and nothing appeared. I then tried putting the session_start code on top and ecoing the session_id and a sesion id appears but it is different from the session_id of the main file.

Thank you for your help!

How do you mean the session id is different from the main file? Which file? Are you looking in the actuall session files in your temp directory?

You should be careful, the comment I made about the different session ids was just a "test" i made. originally, no session id is output from the include file with the .php termination.

the test I made involver adding session_start() to the top of the .php include file and in that case a session_id appears but it is different from the session id i get from echo in the index.php file.

This below shows the TEST i made

FILE: index.php

PHP Code:

<?
session_start();
echo session_id();   // FIRST echo of session_id
include ("http://url.com/header.php");  //Calling include file
?>

FILE: header.php

PHP Code:

session_start();
echo session_id();  //SECOND echo of session id 


1. when i run this, the first and second session_id are different
2. if I remove session_start from include.php, the second session id is not echoed


Thank you for your help. I am on a shared web host, the only results i can see are from the browser.

First. The two will be different as your effectively creating two sessions by calling session_start twice. Second. I'm not too sure why the session is not be created from the include file, have you tested other variables to make sure that the included file is being included properly?

Hello. Ok, I understand now why I get a different session id in the include file.

But if I remove session_start from that include file, NO session id will echo.

if I echo the session id from a .inc include file, the session id (same as from the index file) appears. ITs not a problem with variables...

Im going to leave it at this, I can see you are as baffled as I Thank you very much for your help anyways. Take care.

This website was the only reference I could find to this problem but it was left unsolved...and here I am 3 years later.

My problem was very similar except that the session was disappearing in the second level included file, that is, the file was being included correctly but the session was being lost.

main file-->include file1
file1-->include file2

That is the session was ok in file 1 but disappeared in file 2
Then I found by rigorous debugging that I had defined some constants retrieved locally into variables for repeated use in making URL refs inside links like
href="{$urlBase}pathToFile"
and then I had used one of these vars similarly to access include file 2 so

include "{$urlBase}pathToFile";

It appears the problem with that was that it used url including to access the include file. (I have allow_url_include on in the php ini file for now although it can be seen as a security risk) so that when file 2 was included its path resolved to

http://{urlBase}pathToFile

whereas for file 1 the path resolved to something akin to

/var/www/htdocs/pathToFile

So for some reason including via the full path is different from including via url.
Once I used the full path to include, the sessions worked just fine in both files.

I have been unable to find a reference to this issue on php.net. The closest I came was on this page: http://www.php.net/manual/en/function.include.php where it says

"This is not strictly speaking the same thing as including the file and having it inherit the parent file's variable scope; the script is actually being run on the remote server and the result is then being included into the local script."

of course here we are talking about the local server but otherwise it applies.

The 'inherit the parent file's variable scope' reference is I suspect the salient section.

Anyway hope this helps someone.

Johnny

This was a bit of thanks all especially the last comment which was very recent especailly considering how old this topic is.

I have a similiar if not the same problem. However, all parts of my page return the same session ID so you would think they are using the same session data etc etc etc

Instead the site behaves as if there is no session data and I'm really struggling to get around it. 6 months learning PHP I finally devised my own layout and method of using PHP's include function to its full ability and it turns out its more trouble than its worth for me now sooooooooo

If anyone comes up with a solution please let me know and I'll return the favour with any information I get. I'm currently in talks with ExpertExchange.com so who knows