So no reply from the C5 folks. Does that mean session variables simply don't persist in C5 and the problem is going to be ignored? Maybe the long explanation was too convoluted so let me try again. I wrote a PHP file to check login info from a webpage. If the login info is valid, I want to set a session variable. When I do that, it does not persist! I've see a lot of discussion on this but no real answers. DOES THIS WORK IN C5 OR NOT? It's pretty good that this is the only real complaint I have about C5, but it is a big one and it is very limiting. I really believe (hope) I am doing something wrong (or not doing something I should be) but really there should exist straight forward documentation on this. Just point me to it! Any help would be appreciated.

I have delevopped quite a few addons that rely on the session for c5 (and besides the login itself does rely on it).

If the Session variables were reset nothing would work on c5 … so there might be something wrong in the way you are handling the session.

First of all is the code setting those variables in a proper c5 environment (within a tool or something like that, and called through the dispatcher?), having session_start() is an oddity I never had, so I would start from there … (to me it sounds like you are trying a direct load of the tool page without going through the dispatcher).

BTW, posting some code would + urls would help us understand your problem and the way you are trying to solve it.

So the file is not going through the dispatcher (I assume you mean being handled by index.php). what is happening is a javascript program talks to a PHP program (via JSON). The PHP program gets data from the javascript program which extracts the data from an HTML form. The PHP uses the data to verify the login. If the login is verified, the PHP program sets the session variables. These variables do not persist. If C5 needs to know about the PHP file, then how does that happen? Do I need to launch the PHP program through the dispatcher in some way? I can readily believe I am doing something wrong (or not doing something I should be) but with so many posts on this subject and NO really answer, I would think there would be some type of documentation. Here is the PHP code that does the user/pw lookup and sets the session variables (minus my security settings). Any help would be appreciated.

By the way, I know all the PHP/MySQL stuff works because I can do this with cookies on the client side. I just don't like that solution.

<?php
// connect to db
mysql_connect("mysql1002.ixwebhosting.com",$user,$password);
@mysql_select_db($database) or die( "Unable to select database");
//////////////////////
////////////////////// query BIM_sec for email & pw
$query = "SELECT * FROM BIM_sec WHERE email = '$_POST[uemail]' AND pw = '$_POST[upw]'";
$result = mysql_query($query) or die(mysql_error());
$num_rows = mysql_num_rows($result);
//////////////////////////////////////////
$retval = "INVALID";

if ($num_rows == 1){
$row = mysql_fetch_array($result) or die(mysql_error());
$sec_key = $row['sec_key'];
$usertype = $row['usertype'];
//////////////////////////////////////////////////////
if ($usertype == "P") {
$queryPro = "SELECT * FROM BIM_provider WHERE sec_key = '$sec_key'";
$resultPro = mysql_query($queryPro) or die(mysql_error());
$pro_rowcount = mysql_num_rows($resultPro);
if ($pro_rowcount == 1) {
$prorow = mysql_fetch_array($resultPro) or die(mysql_error());
$firstname = $prorow['first_name'];
$lastname = $prorow['last_name'];
$retval = $sec_key."/".$firstname."/".$lastname."/"."P";
} else {
$retval = "INVALID";
}

} else {
if ($usertype == "C") {
$queryCon = "SELECT * FROM BIM_customer WHERE sec_key = '$sec_key'";
$resultCon = mysql_query($queryCon) or die(mysql_error());
$con_rowcount = mysql_num_rows($resultCon);
if ($con_rowcount == 1) {
$conrow = mysql_fetch_array($resultCon) or die(mysql_error());
$firstname = $conrow['first_name'];
$lastname = $conrow['last_name'];
$retval = $sec_key."/".$firstname."/".$lastname."/"."C";
} else {
$retval = "INVALID";
}
}
}
if ($retval == "INVALID") {
$_SESSION['BIMuser'] = "NONE";
$_SESSION['BIMfirstname'] = "";
$_SESSION['BIMlastname'] = "";
$_SESSION['BIMusertype'] = "U";
$_SESSION['BMIneedlogin'] = true;
echo ($retval);
} else {
$_SESSION['BIMuser'] = $sec_key;
$_SESSION['BIMfirstname'] = $firstname;
$_SESSION['BIMlastname'] = $lastname;
$_SESSION['BIMusertype'] = $usertype;
$_SESSION['BMIneedlogin'] = false;
if ($_SESSION['BMIneedlogin'] == false) {
echo ($retval."/"."FALSE");
} else {
echo ($retval."/"."TRUE");
}

}
//echo ("18/k/c/C/".$_SESSION['BIMuser']);
//echo ($retval);
} else {
$_SESSION['BIMuser'] = "NONE";
$_SESSION['BIMfirstname'] = "";
$_SESSION['BIMlastname'] = "";
$_SESSION['BIMusertype'] = "U";
$_SESSION['BMIneedlogin'] = true;
echo ($retval."/".$_SESSION['BMIneedlogin']);
}

?>

I find session variables work most reliably if I create my own personal or package namespace.



In the past, a number of session users have come across hard to track bugs because they didn't namespace and experienced collisions.

Als have a look at my Quick Param View block. It can be set to dump the session to the page. Useful for diagnostics.

[PS]
Another thought - unless you have good reason not to, al;ways connect to the db through the c5 interface and not directly through php calls.

Thanks for the reply. I'm just at the beginning on this project and I think I'm just going to forget about C5. It is great for most of my sites but anytime I have had to work with Session variables, I get absolutely no good information on why they don't just work. I don't like doing something where I don't understand the underlying mechanism -- even if only conceptually - and I don't understand why the C5 folks can't provide better guidance on this. If C5 ever hopes to play in the big leagues -- and believe me I think it can -- the session variable thing needs to be addressed not in the forums but in the documentation. I build 80-90% of my sites with it so I obviously think it has a lot of pluses, but the session problem is not one of them.

Hi John, how would you handle undefined session keys if you're using this approach? I remember having such variables and ended up having lot's of if / else and isset. It doesn't look very neat. Any ideas?

if(isset($_SESSION['booking_system']['be'][$accommodationID]['options'][$optionID])){
$_SESSION['booking_system']['be'][$accommodationID]['options'][$optionID] = 'foo';
}

@akodde. Pretty much as you have done, but all encapsulated in a model class to simplify the keys.

@kellycunningham
$_SESSION is a php thing and nothing to do with c5. If a particular host account has problems, it will be because of the way php and apache are set up and will have problems regardless of whether we run code that uses $_SESSION within c5 or directly.

The difference c5 makes is to introduce the possibility of other c5 code also using $_SESSION. So while a self sufficient script can often ignore the risk of name collisions, within c5 we have to be very aware that such collisions are possible and establish a namespace.

Hum, using the [ code ] block would have made that post readable …

Nevertheless, since you are not building your code into a tool or any c5 environment, it is possible that the Session is not shared between c5 and your application.

Session can be named, as you might expect, since you are not naming yours … you are basically placing your variables in a different session. Take a look at concrete/startup/session.php for more information :



SESSION is defined in concrete/config/base.php (and can be overriden by any other configuration file of your site if you need) :



Nevertheless, you really should not add a random php file like that, instead you should add a tool or a single page and have c5 dispatcher serve it. That way you would not have to bother with the session_start etc… Executing code outside the c5 environemnt like you do and expecting it to work with no problem with the rest of c5 is pretty much a bad idea.

So, to answer your question, a good grep for session_start in c5 installation would have led you to read the file I mentionned and understand what you are doing wrong …

To ensure that you are running your script within c5, you should place that at the beginning of your file: