CODEWITHSUNDEEP
phpsession
user3866044
user3866044

Reputation: 181

Session generating new session id on next page when using session_start();

I'm attempting an online ordering system and was hoping to use sessions to generate an order number and keep all items ordered on that order number via the session ID.

The first page generates a session ID and an order number. 

<?php 
error_reporting(E_ALL); ini_set('display_errors', 1);
session_start();
?>
<html>
<head>

 <title>Online Ordering</title>

</head>
<style>
h3 {
    text-align: center;
}
h5 {
    text-align: center;
}
</style>
<body>


<?php 


$sessionid = session_id();
$currentDate = date('Y-m-d');

echo "sessionNUM &nbsp&nbsp&nbsp&nbsp &nbsp&nbsp&nbsp   = $sessionid\n";
echo "<br>";        

//Connect to DB

        require_once 'configordonline.php';
        $conn = new mysqli($hn, $un, $pw, $db);
        if ($conn->connect_error) die($conn->connect_error);


//Enter Session ID and set Order ID
    //search for session info already exsiting

    $result=$conn->query("SELECT * FROM HEADERS WHERE sessionid='$sessionid' AND date='$currentDate'");
    echo mysql_error();
    if(mysqli_num_rows($result) > 0){
    echo "session info already exists";
    }
     else{


$sessionid = session_id();

        $sql="INSERT INTO HEADERS VALUES (NULL, '$sessionid', '$currentDate', 'noneyet')";
        if ($conn->query($sql) === TRUE) {
                  echo "New record created successfully";
        } 
        else {
           echo "Error " . $sql . "<br>" . $conn->error;
        }
}
        $res=$conn->query("select ORDID from HEADERS where sessionid='$sessionid'");
        list($ORDERNUM)= $res->fetch_row();
        echo "<br>";        
        echo "<br>";
        echo "ORDERNUM &nbsp&nbsp&nbsp&nbsp &nbsp&nbsp&nbsp   = $ORDERNUM\n";

        $_SESSION["OrderNum"] = $ORDERNUM;
        echo "<br>";        
        echo "<br>";
        echo "Session variables are set.";


?>

<br><br><br>
<h3>At which location would you like to pick up your order?</h3> 
<form method = "POST">
<input type="hidden" name="pickedlocation" value="HP">

<button type="submit" formaction="redacted.php" style="margin:auto;display:block">HP</button>
</form>
<br>
<form method = "POST">
<input type="hidden" name="pickedlocation" value="BS">

<button type="submit" formaction="redacted.php" style=";margin:auto;display:block">BS</button>
</form>

</body>

</html>

The second page generates a new sessionID and therefore does not grab the order number. 

<?php
session_start();
?>



<?php

require_once 'configordonline.php';
        $conn = new mysqli($hn, $un, $pw, $db);
        if ($conn->connect_error) die($conn->connect_error);

echo "START Debugging Info:";
echo '<br>';
echo '<br>';


$sessionid = session_id();
$currentDate = date('Y-m-d');

echo "sessionNUM &nbsp&nbsp&nbsp&nbsp &nbsp&nbsp&nbsp   = $sessionid\n";echo "<br>";   



 $res=$conn->query("select ORDID from HEADERS where sessionid='$sessionid'");
        list($ORDERNUM)= $res->fetch_row();
        echo "ORDERNUM= $ORDERNUM\n";

echo "<br>";   


$ordernum= $ORDERNUM;
echo $ordernum;
echo '<br>';
$LOCATION = $_POST["pickedlocation"];
echo $LOCATION;
     echo "<br>";   
echo "<br>";   


echo "END Debugging Info";
echo '<br>';
echo "_____________________________";
echo '<br>';
echo '<br>';
echo '<br>';echo '<br>';echo '<br>';echo '<br>';echo '<br>';





if ($LOCATION == 'HP'){




    $sql = "UPDATE HEADERS 
    SET location      = 'HYDEPARK'
    WHERE ORDID = '$ordernum'";


    if ($conn->query($sql) === TRUE) {
        echo "Location updated successfully";


    } 

    else {
    echo "Error updating Location: " . $conn->error;
   }


echo "<br><br>";    
$res=$conn->query("select wait from Wait where location ='HydePark'");
    list($wait)= $res->fetch_row();
    echo "The estimated wait at Hyde Park is currently $wait minutes"; 



}





if ($LOCATION == 'BS'){




    $sql = "UPDATE HEADERS 
    SET location      = 'BARTONSPRINGS'
    WHERE ORDID = '$ordernum'";


    if ($conn->query($sql) === TRUE) {
        echo "Location updated successfully";


    } 

    else {
    echo "Error updating Location: " . $conn->error;
   }

echo "<br><br>";
$res=$conn->query("select wait from Wait where location ='BartonSprings'");
    list($wait)= $res->fetch_row();
    echo "The estimated wait at Barton Springs is currently $wait minutes";


}





?>


<html>
<form>

<button type="submit" formaction="redacted.php" style=";display:block">Continue</button>
</form>

</html>

Upvotes: 0

Views: 290

Answers (1)

Abdel Rahman Karim
Abdel Rahman Karim

Reputation: 114

I think relying on the session ID is not the best approach, not to mention it is less secure since you need to fix the session id for all requests and send it to the client side which will make you vulnerable to session hijack . The alternative is something simple like a time stamp and store it in a session variable . you can do that using this function

Upvotes: 1

Related Questions