note 72330 added to function.session-id

in addition to what said "jpjounier at hotmail dot com" it's EXTREMELY important to test if "session_id()" gives a result or not. If you do not, you take the risk to have a new session starting over with the loss of your session variables. php.ini can be different on each webserver you'll host your script on. If you only rely on the behavior of your script on one server, you might have trouble on others. One VERY important session's option of php.ini is 'session.auto_start' . If setted at 'true', session will then start automaticaly for each page that user will open without the need of using session_start(). The point is that if you have a script like this one: /***************** verif_logging.php: *****************/ <?php include('includes/class_user'); $login = $_POST['login']; $pass = $_POST['pass']; if($user->connection($login,$pass){ // user logging validation session_start(); //start the session $_SESSION['user_logged'] = true; // user logged in header('location : control_panel.php'); // go to control panel } else { // go back to logging page header('location : logging.php?' . $user->error_string); } ?> /**************** control_panel.php: ****************/ <?php session_start(); echo $_SESSION['user_logged']; ?> All will be ok as long as 'session.auto_start ' is at 'false'. Otherwise, you'll have a brand new session created with empty $_SESSION and new SID. This has been brain breaker for me until I realise that my webserver has 'session.auto_start' at 'true' and that I couldn't change it (some webhost doesn't let user change php.ini options). So I changed the code this way: /*************** control_panel.php: ***************/ <?php if (session_id() == "") session_start(); // if no active session we start a new one echo $_SESSION['user_logged']; ?> And then everything is ok regardless if 'session.auto_start' is set to 'false' or 'true'. Furthermore, as said 'risaac at deadletter dot com' (04-Apr-2006 08:46) in a comment on 'session_write_close()', it might be a clever thing to check if the newly activated session has $_SESSION empty or setted with the value you passed by as expected. If empty, then you might have launched a brand new session and surely lost every fromer data unless you know what was the SID (passed by $_GET for example, not recommended but possible). ---- Server IP: 195.221.21.36 Probable Submitter: 86.75.154.220 ---- Manual Page -- http://www.php.net/manual/en/function.session-id.php Edit -- https://master.php.net/note/edit/72330 Del: integrated -- https://master.php.net/note/delete/72330/integrated Del: useless -- https://master.php.net/note/delete/72330/useless Del: bad code -- https://master.php.net/note/delete/72330/bad+code Del: spam -- https://master.php.net/note/delete/72330/spam Del: non-english -- https://master.php.net/note/delete/72330/non-english Del: in docs -- https://master.php.net/note/delete/72330/in+docs Del: other reasons-- https://master.php.net/note/delete/72330 Reject -- https://master.php.net/note/reject/72330 Search -- https://master.php.net/manage/user-notes.php