Mark Hensler — Fri, 02 May 2003 21:53:47 +0000

That's great. Glad it worked out.

TonyMontana — Fri, 02 May 2003 18:33:05 +0000

Yes, that is exactly how it works. Once the session key was recognized on sessions2.php, it was smooth sailing.

Thanks,

TonyMontana

Mark Hensler — Thu, 01 May 2003 18:55:18 +0000

<?php
//sessions1.php

session_start(); 
$sid = session_id();

session_register(\"fla_key\");
session_register(\"sess_key\");
session_register(\"sess_timestamp\");

$sess_expire = 1;   // (in minutes)

$time_stamp = mktime() + ( $sess_expire * 60 );
$enc_time = md5( $time_stamp );

// set session vars
$sess_timestamp = $time_stamp;
$sess_key = $enc_time . $sid;

echo $sess_key;
?>

<?php
//sessions2.php

session_start();

$sid = session_id();
session_register(\"fla_key\");
session_register(\"sess_key\");
session_register(\"sess_timestamp\");

if (!isset($sess_key)) {exit;}

if ($sess_timestamp <= mktime() ) {exit;}

if (!isset($fla_key) || $fla_key!=$sess_key ) {exit;}

// send sensitive data
?>

Ok... I think this is the latest, right? I'm not very experienced with PHP & Flash applications. I'm guessing that the output of sessions1.php is being sent to Flash, and then Flash requests sessions2.php. sessions2.php validates with the session vars, then sends the sensitive data. Is this the plan?

Let me know how this works out. I've never tried mixing sessions with Flash, and I'm curious how it works out.

TonyMontana — Wed, 30 Apr 2003 18:50:15 +0000

Mark, that script works with v.4.0.6! First one I've seen on the net that has.

What kind of session checks would you do before echoing the data?

Here's a couple of simple ones I had in mind:

if(!isset($sess_key)){exit;}

// key sent to Flash in sessions1.php
if( isset($fla_key) && $fla_key != $sess_key ){exit;}

if($sess_timestamp <= mktime() ) {exit;}

Maybe you can embellish upon those, or add a few more options.

Thanks,

Tony

Mark Hensler — Wed, 30 Apr 2003 04:04:52 +0000

ok.. $_SESSION was added in 4.1.0 (release notes)

try this then (not tested):

<?php
//sessions1.php
session_start(); 

echo \"<html><body><pre>\n\";

$sess_expire = '1';

$time_stamp = mktime() + ( $sess_expire * 60 );
$enc_time = md5( $time_stamp );

// echo $_SESSION['sess_key'];
$sid = session_id();
$SID = SID;

echo \"$sid<br>\n\";

// # set session vars
session_register(\"sess_timestamp\");
session_register(\"sess_key\");
$sess_timestamp = $time_stamp;
$sess_key = $enc_time . $sid;
// _KEY is the var to pass with unique id...


// echo alone or with other data
echo \"$sess_key<br>\n\";

echo \"<br>\n\";
echo \"<a href=\\"sessions2.php\\">sessions2.php</a>\n\";

echo \"</pre></body></html>\";
?>

<?php
//sessions2.php
session_start(); 

echo \"<html><body><pre>\n\";

$sid = session_id();
session_register(\"sess_key\");

echo \"$sid<br>\n\";
echo \"$sess_key<br>\n\";

echo \"</pre></body></html>\";
?>

My server is running Apache 2 + PHP 4.3.0... And wouldn't ya know it, PHP 4.3.2RC2 was just released today.

TonyMontana — Tue, 29 Apr 2003 17:52:43 +0000

Mark, on second check, there is only one line being echoed on 'sessions2.php' for me, which is:

echo "$sid\n";

'$_SESSION['sess_key']' is disappearing.

I noticed both lines are showing up on your demo. It must be because of the PHP version I am running (PHP v.4.0.6 which I am getting upgraded).

Mark Hensler — Tue, 29 Apr 2003 16:46:13 +0000

tested script:

<?php
//sessions1.php
session_start(); 

echo \"<html><body><pre>\n\";

$sess_expire = '1';

$time_stamp = mktime() + ( $sess_expire * 60 );
$enc_time = md5( $time_stamp );

// echo $_SESSION['sess_key'];
$sid = session_id();
$SID = SID;

echo \"$sid<br>\n\";

// # set session vars
$_SESSION['sess_timestamp'] = $time_stamp;
$_SESSION['sess_key'] = $enc_time . $sid;
// _KEY is the var to pass with unique id...

$_KEY = $_SESSION['sess_key'];
// echo alone or with other data
echo \"$_KEY<br>\n\";

echo \"<br>\n\";
echo \"<a href=\\"sessions2.php\\">sessions2.php</a>\n\";

echo \"</pre></body></html>\";
?>

<?php
//sessions2.php
session_start(); 

echo \"<html><body><pre>\n\";

$sid = session_id();

echo \"$sid<br>\n\";
echo $_SESSION['sess_key'].\"<br>\n\";

echo \"</pre></body></html>\";
?>

demo: http://host.maxalbert.com/testing_center/sessions1.php
sources: http://host.maxalbert.com/testing_center/phps_files/

Mark Hensler — Tue, 29 Apr 2003 16:39:51 +0000

add this to sessionTest2.php:
$sid = session_id();

TonyMontana — Mon, 28 Apr 2003 19:52:37 +0000

As a simple test, with the first script:

// sessionTest1.php

<?php
 
session_start(); 

$sess_expire = '1';

$time_stamp  =  mktime() + ( $sess_expire * 60 );
$enc_time = md5( $time_stamp );

// echo $_SESSION['sess_key'];
$sid = session_id();
$SID = SID;

// # set session vars
$_SESSION['sess_timestamp'] = $time_stamp;
$_SESSION['sess_key'] = $enc_time . $sid;
// _KEY is the var to pass with unique id...


$_KEY = $_SESSION['sess_key'];
// echo alone or with other data
echo  $_KEY;
?>

A key is echoed. Now try to read session with second script:

// sessionTest2.php

<?php
 
session_start(); 
echo $sid; // returns nothing
?>

hmmmmmmmmmm...

Mark Hensler — Mon, 28 Apr 2003 19:33:13 +0000

here is an exurpt from another script of mine:

<?php
// we don't want messy URLs....
ini_set(\"session.use_trans_sid\", 1);

// how long before session is considered garbage
ini_set('session.gc_maxlifetime', _SESSION_IDLE_TIME * 60);

// percentage to check for garbage
ini_set('session.gc_probability', 1);

// resume any old sessions
// set the PHP session_name
session_name('wahl_session');

// start the PHP session
session_start();

// get the PHP session_id
$sid = session_id();

// SID is a PHP defined constant used for passing sessions in links
// SID = session_name=session_id
$SID = SID;
?>

I dont believe the session_name() is required. But I do know that if you're gonna use it, it needs to be set before calling session_start().

How are you going from one page to the other?