会话设置在一个地方但在另一个地方没有设置的奇怪问题

Question

I have two php pages for updating account, a frontend and a backend.

Front end (important part):

<?php
  session_cache_limiter('none');
  session_start(); //session gets started

  include_once 'includes/db_connection.php';
  include_once 'includes/signin.php'; //file that deals with login and creates the session variables
  include_once 'includes/updateaccount_process.php'; //back end file
?>

Back end (important part):

<?php
  include_once 'db_connection.php';
  include_once 'signin.php';
?>

If I add session_start() to the back-end file I get a notice saying session already started. If I don't add session_start() the rest of the php script doesn't execute properly due to the dependency on the session variable.

If I add if(!isset($_SESSION)) { session_start(); }, it works perfectly, and I don't get any notice but I don't understand why.

Hope someone can help.

Thanks.

Answer 1

While PHP can generate front-end content, PHP resides on the back-end, i.e. you have are two server-side files. If your first PHP file starts a session, as long as your code doesn't destroy or otherwise disable that session, the session should exist as long as your browser stays open. When you go to another PHP page, if you run this code:

(!isset($_SESSION)) { session_start()

it will check to see if it makes sense to start a new session. If the session no longer exists, then a new one gets created. Running session_start() without checking for a previously set session will cause this error message to appear if the session still is in effect:

Notice: A session had already been started

This additional session_start() then should resume the current session.

There might be other reasons for session problems occurring. If you're using PHP5.4 or greater, you can call session_status() and its return value can indicate whether a session has been disabled or if none exists. It can also confirm whether one is currently active (see Manual).

Incidentally, the core contributor who devised session_status() was primarily concerned about providing users a way to check whether currently an active session exists. (see bug report.)

On the page you designate as "back end", I suggest redoing the code as follows:

<?php
     if (!isset($_SESSION)) || (session_status() !== PHP_SESSION_ACTIVE) ) {
             session_start();
     }
     include_once('signin.php');
     include_once('db_connection.php');

You might consider moving include_once("signin.php") and placing it in the if-conditional block, as a statement following session_start(), as long as the included file only creates session variables and previous code doesn't unset them.

One final point, you may wish to use include() instead of include_once() if both of your pages for a fact only include each file once. Include_once() is slower than include(). You should use include_once only if your script has code that would result in an attempt to include the file more than once in a script (see here).