PHP 4.0 Bug #5360: Session not holding over.

From: thomas@neweve.com Operating system: Red Hat Linux 6.1 PHP version: 4.0.1pl2 PHP Bug Type: Session related Bug description: Session not holding over. This is a baffling problem. Perhaps I'm doing something wrong but I believe I'm doing everything correct. Here is an example script of what I'm talkinng about please save this in a file called "login.phtml" or change the FORM tag to reflect the filename you choose.: ----- <? session_start(); if ($login) { echo "Posted Variable (echo \$PHPSESSID): " . $PHPSESSID . "<BR>"; //session_id($PHPSESSID); echo "session started (echo session_id()): " . session_id() . "<BR>"; session_register("user","pass"); echo "Variable Registered in session (echo session_id()): " . session_id() . "<BR>"; } ?><HTML> <HEAD> <TITLE>Login Testing</TITLE> </HEAD> <BODY BGCOLOR=#FFFFFF> <BR><BR> Session display using "echo SID;":<? echo SID; ?><BR><BR> <FORM METHOD=POST ACTION="login.phtml"> form field populated using &lt;? echo session_id(); ?&gt;<BR> Posting Variable: PHPSESSID: <INPUT TYPE=TEXT NAME="PHPSESSID" VALUE="<? echo session_id(); ?>" WIDTH=50><BR> USER: <INPUT TYPE="text" NAME="user"><BR> PASS: <INPUT TYPE="text" NAME="pass"><BR> <INPUT TYPE=SUBMIT VALUE="login" NAME="login"><BR> </FORM> </BODY> </HTML> ---- In this example, when session_start() is called, a new session variable is created. If I you uncomment the line that forces the session ID back to what it should be, the variables get registered in the proper session but when you echo SID it reverts to the previous session and the $PHPSESSID is updated also to the new, incorrect, session. This was done by testing under an SSL connection because this is where I need to use it. The installation is Apache 1.3.12+mod_ssl One Curious thing: If I change it the method to GET then this is what happens. at the first initialization of the session it creates it, then when you submit the form, a new session is created. But every post after that retains the session ID. Will this only work via the GET method? I sincerely hope not because I need to keep the password hidden.