会话cookie在脚本结束时重置为默认值

Question

I made a simple registration page, which after validation, adds a unique identifier to the session id to identify the user and also sets a session variable 'UID' to a custom value. Then the script redirects to a new page.

   $_SESSION['UID'] = $id;
   session_id($sessID);
   echo session_id();

   session_write_close();
   header("Location: https://localhost/AccountWebsite/landing.php");
   exit();
?>

The landing page is supposed to be accessible only by members (i.e. those with a special unique session id set by my script), and that functionality wasn't working. So to check why, at the moment I allow anyone to access the page and their session id is echoed, and so is the 'UID' session variable.

<?php 
   session_start();
   echo session_id()."
";
   echo $_SESSION['UID'];
?> 

Now, when I echo the id it isn't the one I set myself. It is the generic PHP one, and the variable doesn't exist. During debugging, I commented out the redirect in the registration script, and instead had it echo the session id that it had just set. The echoed id is correct (obviously since it's echoed in the script it's set in), although when I enter the cookie manager on Firefox, it displays the session id as the generic php one, which means the session is reset when the first script ends and not between sessions.

1. Make sure session_start(); is called before any sessions are being called. So a safe bet would be to put it at the beginning of your page, immediately after the opening php tag before anything else. Also ensure there are no whitespaces/tabs before the opening php tag.
2. After the header redirect, end the current script using exit(); (Others have also suggested session_write_close(); and session_regenerate_id(true), you can try those as well, but I'd use exit();)
3. Make sure cookies are enabled in the browser you are using to test it on.
4. Ensure register_globals is off, you can check this on the php.ini file and also using phpinfo(). Refer to this as to how to turn it off.
   1. Make sure you didn't delete or empty the session
5. Make sure the key in your $_SESSION superglobal array is not overwritten anywhere
6. Make sure you redirect to the same domain. So redirecting from a www.yourdomain.com to yourdomain.com doesn't carry the session forward.
7. Make sure your file extension is .php (it happens!)

I have done all of the above from dayuloli's answer on this post and have been debugging all day. Please help, why does the session not keep the id and variable values I set to it by the end of the script and sccross the whole server?

Additional info: I tried another example folder (on htdocs) where one page sets a variable and the other echoes it, and it worked.

Answer 1

You don't need to set a session_id unless you want multiple sessions. If you do specify a session_id, you need to call session_start() afterwards to start using it and submit the cookie into the client's browser.

Beyond that explanation, you need to use session_start() at the top of any script that requires sessions.

From http://php.net/manual/en/function.session-id.php:

session_id() needs to be called before session_start()

session_id() will always send a new cookie when session_start() is called