CODEWITHSUNDEEP
phpformssessiontabs
The Thirsty Ape
The Thirsty Ape

Reputation: 1095

How to manage multiple tabs with PHP

I have an application that uses several different forms to perform various actions. Some of the forms access data from submissions in other forms.

For example: a user places a new order on one form and adds a new item in another, the items can be added to orders.

So this leads to the possibility that a user may be adding an order and realize that an item must be added first. So naturally a new tab will be opened to do so instead of losing the information added to the order.

Currently I have a $_SESSION['form'] variable to let the form handling script know which function to use after form submission. The problem is that with multiple tabs open, this value will get overwritten by the last opened tab. I have had a couple ideas on how to handle this but so far nothing ideal.

Idea one: use a hash value to identify different page loads and send the hash as a hidden field

$hash = $_POST['hash'];
$form = $_SESSION[$hash]['form'];

Issue: session overloading. This method will make a new session value each time a form is loaded to uniquely identify the form submission. I could unset the value upon submission, but what if a form page is loaded and never submit, or if the page is refreshed. I would prefer to keep the session as light weight as possible.

Idea two: use AJAX to set the $_SESSION['form'] value upon clicking submit

Issue: users that do not use JS. I would like to be able to continue providing support to users that prefer to disable JS if possible, although this method seems like it could be a bit better. However, I am unsure whether there could be browser compatibility issues here.

Idea three: create a hash id for each window

Issue: PHP can't distinguish between browser tabs. This would be the most ideal by far.

Idea four: split the form handling script into multiple files, thus removing the need for a value to select which function to use.

Issue: inconvenient, but I am open to this idea if it proves to be the only real method to handle this issue. It would require a fair bit of re-structuring though.

Any ideas on how to securely manage different tabs and session information in PHP?

Upvotes: 2

Views: 3545

Answers (1)

Richard
Richard

Reputation: 2100

This is just my opinion, but I would use idea #1-- each time the form loads, give it a random hash (just md5 of the time() + random number would suffice), and then keep up with those hashes like they are unique window identifiers.

Yes, it might bloat your session a little, but if it doesn't slow down the user's experience, I wouldn't worry about it. If it really bothers you, you can keep track of how many window ID's you've created for the user (in the session) and limit it to 100 or 1000. This would prevent a malicious user from writing a script to open millions of windows.

Remember, when the user's session is destroyed (by logging out/closing the browser), all those hashes are gone too. And if you were REALLY feeling industrious, you could have a system of expiration on hashes. Like, after 2 hours they will be removed from the session.

But honestly-- if it were me, I'd just leave them in the session and not worry about it.

Just my 2 cents, Richard

Upvotes: 1

Related Questions